Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
This is a clear example of manipulation of Data - this Data should be accessed upon request. This raises a privacy concern and we need to critically review and I will go back to the statement I once mentioned. If this Data is required then there must be consent from the Domain owner to grant access to third party to access the data. It seems quite complex to implement needs a real assessment of the Purpose of the Data that is being collected. Regards Nanghaka Daniel K. Executive Director - ILICIT Africa / Council Member - FOSSFA / Community Lead - ISOC Uganda Chapter Mobile +256 772 898298 (Uganda) Skype: daniel.nanghaka ----------------------------------------- *"Working for Africa" * ----------------------------------------- On Thu, Feb 9, 2017 at 12:27 PM, Volker Greimann <vgreimann@key-systems.net> wrote:
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-atte ntion-whois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I would like to underline the fact that the data commissioners commented in some of their earliest (2000) correspondence with ICANN that it was not acceptable to organize a directory in such a way as to allow reverse directory lookup, in other words what are all the domains that an individual has registered. There is no legitimate purpose for that search capability to be available to the wider public. This does not of course mean that bona fide investigators should not be allowed to do that. I realize that idea seems quaint these days in the age of google, but back then it was not a crazy idea.... cheers Stephanie On 2017-02-09 04:27, Volker Greimann wrote:
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv...
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
+1. John Horton President and CEO, LegitScript *Follow LegitScript: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | Blog <http://blog.legitscript.com/> | Google+ <https://plus.google.com/112436813474708014933/posts>* On February 9, 2017 at 8:39:31 AM, Greg Aaron (gca@icginc.com) wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto: gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Agree with Greg and John Richard Leaning External Relations RIPE NCC
On 9 Feb 2017, at 16:41, John Horton <john.horton@legitscript.com> wrote:
+1.
John Horton President and CEO, LegitScript <wBqYjd_P11PQGFdPcMEyZsVBBGWuq7I4h2wc_UF-Ke2HXh-SOizd8U0cJWDpOdchYnanz6JRhJ8Zq1wYhIkccv1u2zZJ4OxNgesjT6Neb_6GyXjFV2tOv7uJVxx7MN_IDdvo8zgML4MZtOX_ekeEBgDD0d5y4f7ZD4gwNssxqnxDE7tsV5Cn4W4Rc2zj2QFP5V3fRm893MaZ50I=s0-d-e1-ft>
Follow LegitScript: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | Blog <http://blog.legitscript.com/> | Google+ <https://plus.google.com/112436813474708014933/posts>
On February 9, 2017 at 8:39:31 AM, Greg Aaron (gca@icginc.com <mailto:gca@icginc.com>) wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is <http://mashable.com/2017/02/07/sean-spicer-who-is>
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... <http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv...>
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net/> / www.RRPproxy.net <http://www.rrpproxy.net/> www.domaindiscount24.com <http://www.domaindiscount24.com/> / www.BrandShelter.com <http://www.brandshelter.com/>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu/>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net/> / www.RRPproxy.net <http://www.rrpproxy.net/> www.domaindiscount24.com <http://www.domaindiscount24.com/> / www.BrandShelter.com <http://www.brandshelter.com/>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu/>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Dnsservers, domainstatus, various dates, Registrar None of these data are personal data imo The only info you see in Whois are the contact ID the user have at the registrar/ registry Sent from my iPhone On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com<mailto:nathaliecoupet@yahoo.com>> wrote: Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of gca@icginc.com<mailto:gca@icginc.com>> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is<http://mashable.com/2017/02/07/sean-spicer-who-is> also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
If someone or a group of people were to be the subject of a smear campaign, persectution or harassment by an individual, would the contact ID be sufficient to initiate proceeding to find out the identity of the author? What is the procedure for collecting a contact ID? Is there some type of ID verification? Thank you,Nathalie On Thursday, February 9, 2017 12:18 PM, "benny@nordreg.se" <benny@nordreg.se> wrote: Dnsservers, domainstatus, various dates, Registrar None of these data are personal data imo The only info you see in Whois are the contact ID the user have at the registrar/ registry Sent from my iPhone On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote: Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Unless the person takes careful measures to keep their fake identity/domain separate, and never mention the domain from their real names, domain whois won't even be necessary to find out who they are. Public records and social media are another resource for accomplishing this task. Tracking the average person down is not hard, because they usually don't put any effort into hiding. On Thu, Feb 9, 2017 at 12:25 PM, nathalie coupet via gnso-rds-pdp-wg < gnso-rds-pdp-wg@icann.org> wrote:
If someone or a group of people were to be the subject of a smear campaign, persectution or harassment by an individual, would the contact ID be sufficient to initiate proceeding to find out the identity of the author? What is the procedure for collecting a contact ID? Is there some type of ID verification?
Thank you, Nathalie
On Thursday, February 9, 2017 12:18 PM, "benny@nordreg.se" < benny@nordreg.se> wrote:
Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" < benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 <+46%2042%2019%2070%2080> Direct: +47.32260201 <+47%2032%2026%2002%2001> Mobile: +47.40410200 <+47%20404%2010%20200>
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings- attention-whois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net <http://www.rrpproxy.net/> www.domaindiscount24.com / www.BrandShelter.com <http://www.brandshelter.com/>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net <http://www.rrpproxy.net/> www.domaindiscount24.com / www.BrandShelter.com <http://www.brandshelter.com/>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Then there are no reason to not hide the personal info if it is that easy Why are we putting all the people at the spammers list because a small part of registrant are criminals? Sent from my iPhone On 9 Feb 2017, at 18:27, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: Unless the person takes careful measures to keep their fake identity/domain separate, and never mention the domain from their real names, domain whois won't even be necessary to find out who they are. Public records and social media are another resource for accomplishing this task. Tracking the average person down is not hard, because they usually don't put any effort into hiding. On Thu, Feb 9, 2017 at 12:25 PM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: If someone or a group of people were to be the subject of a smear campaign, persectution or harassment by an individual, would the contact ID be sufficient to initiate proceeding to find out the identity of the author? What is the procedure for collecting a contact ID? Is there some type of ID verification? Thank you, Nathalie On Thursday, February 9, 2017 12:18 PM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Dnsservers, domainstatus, various dates, Registrar None of these data are personal data imo The only info you see in Whois are the contact ID the user have at the registrar/ registry Sent from my iPhone On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com<mailto:nathaliecoupet@yahoo.com>> wrote: Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080<tel:+46%2042%2019%2070%2080> Direct: +47.32260201<tel:+47%2032%2026%2002%2001> Mobile: +47.40410200<tel:+47%20404%2010%20200> On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of gca@icginc.com<mailto:gca@icginc.com>> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is<http://mashable.com/2017/02/07/sean-spicer-who-is> also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning.
The data are collected just not shown, court order can release data For private persons living in Sweden there social security number are collected for control and validation but never presented For private persons outside Sweden a unique number must be sett from the registrar to identify the registrant in the system Anyway that is not the thing we are discussing in RDS The personal info can be hidden by default and policy can restrict how to reveal that date Sent from my iPhone On 9 Feb 2017, at 18:23, nathalie coupet <nathaliecoupet@yahoo.com<mailto:nathaliecoupet@yahoo.com>> wrote: If someone or a group of people were to be the subject of a smear campaign, persectution or harassment by an individual, would the contact ID be sufficient to initiate proceeding to find out the identity of the author? What is the procedure for collecting a contact ID? Is there some type of ID verification? Thank you, Nathalie On Thursday, February 9, 2017 12:18 PM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Dnsservers, domainstatus, various dates, Registrar None of these data are personal data imo The only info you see in Whois are the contact ID the user have at the registrar/ registry Sent from my iPhone On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com<mailto:nathaliecoupet@yahoo.com>> wrote: Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of gca@icginc.com<mailto:gca@icginc.com>> wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is<http://mashable.com/2017/02/07/sean-spicer-who-is> also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
After registering my very first domain, I started receiving spam and learned pretty quickly that the information was public. Only so much can/should be done to protect the Spicers of this world from themselves. Pivoting off domain whois is my #1 valued resource in cybercrime investigations. On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" < benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 <+46%2042%2019%2070%2080> Direct: +47.32260201 <+47%2032%2026%2002%2001> Mobile: +47.40410200 <+47%20404%2010%20200>
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings- attention-whois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Access to Whois data is also necessary for protection -- protection of internet users (some of whom are registrants, some not) and even non-users (since you can be a victim of Internet-based abuse without being on the Internet yourself (e.g., bank fraud, identity theft, child porn, etc.)). As Greg A. pointed out, registrants have options in terms "protection" (e.g., privacy/proxy, getting a third level domain (so common for blogs), forming an entity, etc. Victims often don't have options (or if they do, the link between the failure to pick the right option and the harm is much more attenuated). If we have to choose between protecting people from their own stupidity and protecting people from other people's abusive, illegal and/or malicious acts, I'll choose the latter one. I don't think we have to make that choice (at least not in a binary fashion), but it's important to weigh both sides of the equation. Greg Shatan *Greg Shatan *C: 917-816-6428 S: gsshatan gregshatanipc@gmail.com On Thu, Feb 9, 2017 at 12:26 PM, allison nixon <elsakoo@gmail.com> wrote:
After registering my very first domain, I started receiving spam and learned pretty quickly that the information was public.
Only so much can/should be done to protect the Spicers of this world from themselves.
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" < benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 <+46%2042%2019%2070%2080> Direct: +47.32260201 <+47%2032%2026%2002%2001> Mobile: +47.40410200 <+47%20404%2010%20200>
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto: gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-atte ntion-whois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc. And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized. Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com <mailto:nathaliecoupet@yahoo.com>> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 <tel:+46%2042%2019%2070%2080> Direct: +47.32260201 <tel:+47%2032%2026%2002%2001> Mobile: +47.40410200 <tel:+47%20404%2010%20200>
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of gca@icginc.com <mailto:gca@icginc.com>> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is <http://mashable.com/2017/02/07/sean-spicer-who-is>
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... <http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv...>
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
+1 to Volker Spot on, we cant let the criminals endanger all innocents life by default expose data as we do today -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 10:41, Volker Greimann <vgreimann@key-systems.net> wrote:
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc.
And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized.
Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote: Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv...
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
We need to find balance and a constructive way to propose solutions, not this endless back and forth of edge cases. -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 10, 2017 4:44 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois +1 to Volker Spot on, we cant let the criminals endanger all innocents life by default expose data as we do today -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 10:41, Volker Greimann <vgreimann@key-systems.net> wrote:
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc.
And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized.
Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote: Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here:
http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-wh ois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I don’t see this as an edge case, it is a dammed big problem that the data are public A private person or for that matter company has not by registering a domain and accepted to give info for the matter of registration in the same time accepted to get his email or other info published in the whois used and abused. That is a key problem we need to solve in the group. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 17:01, Victoria Sheckler <vsheckler@riaa.com> wrote:
We need to find balance and a constructive way to propose solutions, not this endless back and forth of edge cases.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 10, 2017 4:44 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
+1 to Volker
Spot on, we cant let the criminals endanger all innocents life by default expose data as we do today
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 10:41, Volker Greimann <vgreimann@key-systems.net> wrote:
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc.
And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized.
Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote: Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here:
http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-wh ois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
How about puting 'fat' information behind a 'thin' wall? For example, to prevent public viewing of a registrant's personal information, why not require an email registration or some other light form of identification? It would deter spammers and other frauds, while insuring a certain level of public viewing (also to deter fraud). To the argument that the vast majority of Internet users do not use WHOIS, this might be true now but not in the future. Furthermore, this argument was also used by people who opposed the paper version of the phone book, and a survey shoed that about 11% of households rely on the phone book to get information. The consensus was that people who do not have access to the Internet need it, therefore it qualifies as a public service which has to be kept for the public good. Scott Hollenbeck's RDAP project requires exactly that: identification through email (right, Scott?). This is simple enough and everybody could live with this solution, I think. Nathalie On Monday, February 13, 2017 8:42 AM, Michele Neylon - Blacknight <michele@blacknight.com> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of nathalie coupet via gnso-rds-pdp-wg Sent: Monday, February 13, 2017 10:08 AM To: Michele Neylon - Blacknight <michele@blacknight.com>; benny@nordreg.se; Victoria Sheckler <vsheckler@riaa.com> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois How about puting 'fat' information behind a 'thin' wall? For example, to prevent public viewing of a registrant's personal information, why not require an email registration or some other light form of identification? It would deter spammers and other frauds, while insuring a certain level of public viewing (also to deter fraud). To the argument that the vast majority of Internet users do not use WHOIS, this might be true now but not in the future. Furthermore, this argument was also used by people who opposed the paper version of the phone book, and a survey shoed that about 11% of households rely on the phone book to get information. The consensus was that people who do not have access to the Internet need it, therefore it qualifies as a public service which has to be kept for the public good. Scott Hollenbeck's RDAP project requires exactly that: identification through email (right, Scott?). This is simple enough and everybody could live with this solution, I think. My implementation does indeed support a basic level of authentication and access control using credentials issued by certain email providers. Finer-grained access control can be implemented using more rigorous processes for assigning client credentials. Scott
All, So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed.
Also it’s one of the biggest sources of complaints we get from our clients (registrants)
It’s definitely not an “edge case”.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Short and quick, The car metaphor was a counter to the transitive data bread crumbs argument suggested for thinning thin data. It was an argument against deleting a data field on the grounds that it might assist a bread crumbs trail. It was not intended to suggest more. As for a malicious fleet of cars, they leave a lot of bread crumbs and many starting points. Sam L On 2017-02-14 5:38 AM, allison nixon wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
Hi Allison, Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email? With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs? Nathalie On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com> wrote: This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote: All, So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org on behalf of michele@blacknight.com> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg -- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.c om Phone: 613 476-0429 cell: 416-816-2852 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Nathalie and others, I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally. If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate. So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties. - A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. - Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). - Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. - Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details? For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease. I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions. John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg < gnso-rds-pdp-wg@icann.org> wrote:
Hi Allison,
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs?
Nathalie
On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org <gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.c om <http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Tuesday, February 14, 2017 9:00 AM To: nathalie coupet <nathaliecoupet@yahoo.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Nathalie and others, I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. [SAH] [snip] I have to disagree with “you don't have to register or justify your need to access information on the internet”. While there are certainly examples of *some* information being available openly, there are just as many examples where some form of registration or user identification is a required part of gaining access to content. One example: the Virginia Department of Motor Vehicles maintains information about the registration of my personal vehicles that is accessible through a web site. That information *is not* available to the general public, and I had to go through a series of steps to prove to the DMV that I am the one and only person who should have online access to that information. Taking the statement above at face value would imply that my registration information should be freely available to anyone, and I cannot accept that as fact. Scott
Hi John,
(...) I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. Is it though? Only for domain names do you have such a database. Other services on the open and decentralized internet do not seem to require it. For example the ones actually doing the abuse, e.g. users of mail and hosting services. Why should a domain name be treated differently than any other service that constitutes the internet?
First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally. You do have to justify the publication of private details. And I am sorry, but "Legitscript might need it" or even "Legitscript may not need this particular set of data but someone elses data" does not cut it as far as justifications go.
If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate. Sounds good to me. If you want all this data on other people, why are you so shy about your own data? A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. Does that reporter have a legally enforceable right to access that data? Would he have such a right to find out who rents the hosting space at hosting provider X?
* Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why).
Does that reporter have a legally enforceable right to access that data? Would he have such a right to find out who rents the hosting space at hosting provider X? Maybe a look at the tax returns of the elected politician would be more helpfull (Oops, hot topic!)
* Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness.
Should such research be possible? Does the right to academic freedom beat out the right of countless individuals to data privacy?
* Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details?
We have not determined that yet. Let's consider that down the road along with the question if law enforcement of a particular jurisdiction should even be able to access data on a data subject in another jurisdiction. If I remember correctly, the legal authority of most law enforcement agencies ends at their national border.
For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease. Well, I would argue that private data being public as it is now is worse than anything you proposed so far. --
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Hi John, I agree we do not want to create a centralized registration and surveillance scheme. Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no. Theo On 14-2-2017 14:59, John Horton wrote:
Nathalie and others,
I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance.
First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally.
If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate.
So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties.
* A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. * Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). * Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. * Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details?
For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease.
I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions.
John Horton President and CEO, LegitScript
*FollowLegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> wrote:
Hi Allison,
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs?
Nathalie
On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social <http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.c om <http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
A lot of replies since last night
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
I am personally OK with being held accountable for the data i search for. I think a lot of the desire to require subpeonas or search warrants for WHOIS data is a need for the "watchers" to be held accountable, which I do believe in on a philosophical level. My search history would include NDA and sensitive information such as identities of clients and investigations in progress, so I wouldn't want it broadcasted, but I am absolutely prepared to demonstrate that my use is not abusive.
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
I don't take it personally at all. And the spam to WHOIS data is a problem. I used to use real data on some old domains of mine, until I started receiving the spam, and discovered the existence of WHOIS and how easy it is to access. I have not used real info since that time. But the reality is that cybercrime is a growing multi billion dollar "industry", and the community of people that resist this industry is VERY small, and VERY overwhelmed. If our jobs get harder, it won't be us who are "buhu"ing, it will be you and everyone else who will pay higher fees on everything. We will be paid handsomely regardless, so I'm not speaking on behalf of myself but on behalf of the people I try to protect. If you want to make light of a global problem, please choose one that doesn't involve unbelievable amounts of monetary losses, and doesn't cause far worse privacy violations than the stuff yall seem to be concerned about. Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious!
the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.
At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the "free and open Internet" when the Internet doesn't work anymore? Those are the battles that are being fought right now, and pretending this isn't a problem is a "wall" on yalls part, not mine. Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast's network will die if they don't do this. As a consequence I can't send outbound TCP/25 SMTP anymore: https://www.xfinity.com/support/internet/list-of-blocked-ports/ And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country's TLD has too much abuse, most network operators will agree, and legitimate sites (like that country's government, companies, and media outlets) are an acceptable loss. You're going to see more of this, and that country's government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it's more likely that the entire country will simply suffer harms instead. I am really surprised at how little credence is being given to these problems. On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <gtheo@xs4all.nl> wrote:
Hi John,
I agree we do not want to create a centralized registration and surveillance scheme.
Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no.
Theo On 14-2-2017 14:59, John Horton wrote:
Nathalie and others,
I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance.
First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally.
If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate.
So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties.
- A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. - Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). - Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. - Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details?
For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease.
I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions.
John Horton President and CEO, LegitScript
*Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg < gnso-rds-pdp-wg@icann.org> wrote:
Hi Allison,
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs?
Nathalie
On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org <gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.c om <http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
That old horse again?
Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious!
Those statistics are only their perceived truth just like the audience at Trumps inauguration was the largest ever! Their statistics are deeply flawed as they only look at a small part of domain names and disregard major pieces of the puzzle: According to nTLD stats, .science has 232,611 domains, yet the Spamhaus reports bases their badness rating on an arbitrary number of domains "seen". They even state that if a domain is not in the focus of their anti-abuse systems, it will not be counted as seen. By ignoring the majority of domains in a TLD one can dream up any percentage one likes, apparently. Look at the numbers for .top: Apparently 400,469 domains are used maliciously. 400,469! That is a lot of abuse that I somehow have not heard about from any other source, never seen in my spam filters, etc. But I will not dispute that there may be a large number of domains in that TLD may be used for abuse. Yet the report does not go into further detail? Could a contributing factor of "badness" be a low price, attracting the wrong kind of customer? How is this badness distributed amongst registrars? They also do not detail how they decided a domain was malicious in the first place? Yet on the other hand they accuse registries and registrars of knowingly aiding and abetting criminals. Without providing proof. Or even complaining to ICANN about them, apparently. I would assume that when you make such bold statements as Spamhaus does, they have the evidence to back them up... I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something. Best, Volker
the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.
At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the "free and open Internet" when the Internet doesn't work anymore? Those are the battles that are being fought right now, and pretending this isn't a problem is a "wall" on yalls part, not mine.
Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast's network will die if they don't do this. As a consequence I can't send outbound TCP/25 SMTP anymore: https://www.xfinity.com/support/internet/list-of-blocked-ports/
And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country's TLD has too much abuse, most network operators will agree, and legitimate sites (like that country's government, companies, and media outlets) are an acceptable loss. You're going to see more of this, and that country's government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it's more likely that the entire country will simply suffer harms instead.
I am really surprised at how little credence is being given to these problems.
On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote:
Hi John,
I agree we do not want to create a centralized registration and surveillance scheme.
Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no.
Theo On 14-2-2017 14:59, John Horton wrote:
Nathalie and others,
I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance.
First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally.
If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate.
So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties.
* A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. * Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). * Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. * Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details?
For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease.
I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions.
John Horton President and CEO, LegitScript
*FollowLegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> wrote:
Hi Allison,
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs?
Nathalie
On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social <http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: http://samlanfranco.blogspot.c om <http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
I'm happy to work with group leadership to provide hard data from MarkMonitor (perhaps other consumer protection and anti-abuse groups can join) about volume of abuse. These are not "alternative facts." It's also incredibly inappropriate to continue trying to discredit arguments for transparency by comparing us to the current US administration. K Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos. On Feb 14, 2017, at 9:13 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: That old horse again? Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious! Those statistics are only their perceived truth just like the audience at Trumps inauguration was the largest ever! Their statistics are deeply flawed as they only look at a small part of domain names and disregard major pieces of the puzzle: According to nTLD stats, .science has 232,611 domains, yet the Spamhaus reports bases their badness rating on an arbitrary number of domains "seen". They even state that if a domain is not in the focus of their anti-abuse systems, it will not be counted as seen. By ignoring the majority of domains in a TLD one can dream up any percentage one likes, apparently. Look at the numbers for .top: Apparently 400,469 domains are used maliciously. 400,469! That is a lot of abuse that I somehow have not heard about from any other source, never seen in my spam filters, etc. But I will not dispute that there may be a large number of domains in that TLD may be used for abuse. Yet the report does not go into further detail? Could a contributing factor of "badness" be a low price, attracting the wrong kind of customer? How is this badness distributed amongst registrars? They also do not detail how they decided a domain was malicious in the first place? Yet on the other hand they accuse registries and registrars of knowingly aiding and abetting criminals. Without providing proof. Or even complaining to ICANN about them, apparently. I would assume that when you make such bold statements as Spamhaus does, they have the evidence to back them up... I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something. Best, Volker
the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.
At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the "free and open Internet" when the Internet doesn't work anymore? Those are the battles that are being fought right now, and pretending this isn't a problem is a "wall" on yalls part, not mine. Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast's network will die if they don't do this. As a consequence I can't send outbound TCP/25 SMTP anymore: https://www.xfinity.com/support/internet/list-of-blocked-ports/ And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country's TLD has too much abuse, most network operators will agree, and legitimate sites (like that country's government, companies, and media outlets) are an acceptable loss. You're going to see more of this, and that country's government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it's more likely that the entire country will simply suffer harms instead. I am really surprised at how little credence is being given to these problems. On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote: Hi John, I agree we do not want to create a centralized registration and surveillance scheme. Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no. Theo On 14-2-2017 14:59, John Horton wrote: Nathalie and others, I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally. If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate. So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties. * A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. * Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). * Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. * Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details? For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease. I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions. John Horton President and CEO, LegitScript [cid:] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [cid:][cid:] On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: Hi Allison, Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email? With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs? Nathalie On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net<mailto:sam@lanfranco.net>> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote: All, So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com<mailto:michele@blacknight.com>> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social<http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: http://samlanfranco.blogspot.c om<http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I would appreciate reviewing that data. -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Kiran Malancharuvil via gnso-rds-pdp-wg Sent: Tuesday, February 14, 2017 5:36 PM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois I'm happy to work with group leadership to provide hard data from MarkMonitor (perhaps other consumer protection and anti-abuse groups can join) about volume of abuse. These are not "alternative facts." It's also incredibly inappropriate to continue trying to discredit arguments for transparency by comparing us to the current US administration. K Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos. On Feb 14, 2017, at 9:13 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: That old horse again? Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious! Those statistics are only their perceived truth just like the audience at Trumps inauguration was the largest ever! Their statistics are deeply flawed as they only look at a small part of domain names and disregard major pieces of the puzzle: According to nTLD stats, .science has 232,611 domains, yet the Spamhaus reports bases their badness rating on an arbitrary number of domains "seen". They even state that if a domain is not in the focus of their anti-abuse systems, it will not be counted as seen. By ignoring the majority of domains in a TLD one can dream up any percentage one likes, apparently. Look at the numbers for .top: Apparently 400,469 domains are used maliciously. 400,469! That is a lot of abuse that I somehow have not heard about from any other source, never seen in my spam filters, etc. But I will not dispute that there may be a large number of domains in that TLD may be used for abuse. Yet the report does not go into further detail? Could a contributing factor of "badness" be a low price, attracting the wrong kind of customer? How is this badness distributed amongst registrars? They also do not detail how they decided a domain was malicious in the first place? Yet on the other hand they accuse registries and registrars of knowingly aiding and abetting criminals. Without providing proof. Or even complaining to ICANN about them, apparently. I would assume that when you make such bold statements as Spamhaus does, they have the evidence to back them up... I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something. Best, Volker
the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.
At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the "free and open Internet" when the Internet doesn't work anymore? Those are the battles that are being fought right now, and pretending this isn't a problem is a "wall" on yalls part, not mine. Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast's network will die if they don't do this. As a consequence I can't send outbound TCP/25 SMTP anymore: https://www.xfinity.com/support/internet/list-of-blocked-ports/ And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country's TLD has too much abuse, most network operators will agree, and legitimate sites (like that country's government, companies, and media outlets) are an acceptable loss. You're going to see more of this, and that country's government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it's more likely that the entire country will simply suffer harms instead. I am really surprised at how little credence is being given to these problems. On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote: Hi John, I agree we do not want to create a centralized registration and surveillance scheme. Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no. Theo On 14-2-2017 14:59, John Horton wrote: Nathalie and others, I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally. If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate. So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties. * A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. * Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). * Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. * Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details? For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease. I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions. John Horton President and CEO, LegitScript [cid:] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [cid:][cid:] On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: Hi Allison, Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email? With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs? Nathalie On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net<mailto:sam@lanfranco.net>> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote: All, So it seems the debate has progressed from "thin data" to "thick data" (i.e. data that includes email). I know we are all super excited to talk about "thick data" but I don't think we are there yet (are we? Hopefully I didn't miss the party.) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because "thin data" can be used to link/point/discover other data then "thin data" equals "personal data") I just don't buy it. I don't disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com<mailto:michele@blacknight.com>> wrote: I agree and I know from how I've used various email addresses that they are actively being harvested and spammed. Also it's one of the biggest sources of complaints we get from our clients (registrants) It's definitely not an "edge case". Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social<http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: http://samlanfranco.blogspot.c om<http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Dear Volker: I will fact-check a few items here. One, you just mis-stated Spamhaus' findings and methodology. Two, there's a reason why you don't see these problems in your mailbox. It's not because the problems don't exist - it's because you have a company taking care of the problem. Three, you may not trust Spamhaus, but some of us here with experience disagree with you. One: You claimed below that Spamhaus says that "93.3 percent of all domains registered under the .science TLD are malicious. Spamhaus said no such thing. Spamhaus is saying that of the recent mail flow they received that contain .science domains, 93% of that email was spam. That is a measurement based on real-life observation and a well-described l methodology: https://www.spamhaus.org/statistics/tlds/ There are 232,611 domains in the .science TLD right now. Spamhaus says that 61,418 mails containing .science domains reached Spamhaus' mail sensors recently, and 57,323 of those were spam - 93% of the .science domains that Spamhaus saw in use, and 26% of all the domains that exist in the .science TLD. Plus: a) Spamhaus's sensors only see a certain percentage of all the mail in the world, and b) these are recent stats.... more spam .science domains were found in the past but not counted there. So that under-states the problem in this TLD. Either way, these numbers are bad news. Two: You don't see much spam in your spam filters because your company, Key-Systems, employs a spam-fighting email service company called Hornet Security. Hornet Security prevents spam, phishing attempts, and malware from even getting to your company (and your mailbox and filter). Hornet Security uses blocklists in its solution. I would not be surprised if Spamhaus was one of them. DIG ;ANSWER key-systems.net. 11665 IN MX 10 mx19a.antispameurope.com. antispameurope.com --> hornetsecurity.com Three: You may not trust Spamhaus, but they are respected members of the anti-spam industry. Spamhaus' data protects three billion email boxes. They have worked as a trusted partner of law enforcement on some big cybercrime cases. I have had personal experience with their staff over the years. And I would not be surprised if the majority of the people on this working group have their mail (and possibly networks) protected in part by Spamhaus's IP and domain name blocklists. Other: I don't see what your questions about pricing have to do with the current discussion. Criminals certainly seem to like cheap domains, but you know that ICANN does not regulate the prices that registrars charge. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Tuesday, February 14, 2017 12:13 PM To: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois That old horse again? Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious! Those statistics are only their perceived truth just like the audience at Trumps inauguration was the largest ever! Their statistics are deeply flawed as they only look at a small part of domain names and disregard major pieces of the puzzle: According to nTLD stats, .science has 232,611 domains, yet the Spamhaus reports bases their badness rating on an arbitrary number of domains "seen". They even state that if a domain is not in the focus of their anti-abuse systems, it will not be counted as seen. By ignoring the majority of domains in a TLD one can dream up any percentage one likes, apparently. Look at the numbers for .top: Apparently 400,469 domains are used maliciously. 400,469! That is a lot of abuse that I somehow have not heard about from any other source, never seen in my spam filters, etc. But I will not dispute that there may be a large number of domains in that TLD may be used for abuse. Yet the report does not go into further detail? Could a contributing factor of "badness" be a low price, attracting the wrong kind of customer? How is this badness distributed amongst registrars? They also do not detail how they decided a domain was malicious in the first place? Yet on the other hand they accuse registries and registrars of knowingly aiding and abetting criminals. Without providing proof. Or even complaining to ICANN about them, apparently. I would assume that when you make such bold statements as Spamhaus does, they have the evidence to back them up... I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something. Best, Volker
the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.
At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the "free and open Internet" when the Internet doesn't work anymore? Those are the battles that are being fought right now, and pretending this isn't a problem is a "wall" on yalls part, not mine. Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast's network will die if they don't do this. As a consequence I can't send outbound TCP/25 SMTP anymore: https://www.xfinity.com/support/internet/list-of-blocked-ports/ And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country's TLD has too much abuse, most network operators will agree, and legitimate sites (like that country's government, companies, and media outlets) are an acceptable loss. You're going to see more of this, and that country's government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it's more likely that the entire country will simply suffer harms instead. I am really surprised at how little credence is being given to these problems. On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote: Hi John, I agree we do not want to create a centralized registration and surveillance scheme. Such a system would be subject to many regulations and fines from Data Regulators. If we do not execute privacy properly we are creating a system that will cost millions of dollars in fines alone. Tho that would actually answer the question are the costs of RDS viable. The answer would be no. Theo On 14-2-2017 14:59, John Horton wrote: Nathalie and others, I wanted to take a moment and explain why I'm strongly opposed to requiring email or other registration in order to view thin or thick details. For the reasons outlined below, I think it's antithetical to the open and decentralized nature of the internet, and constitutes a form of internet surveillance. First, putting aside repressive regimes, private networks and edge cases, one of the hallmark principles of the internet is that it's open; you don't have to register or justify your need to access information on the internet. And, it's decentralized. Historically, its open nature has included not only being able to see a website, but also the registration details for the website's domain name. And, whatever governments may do (which isn't the question here), there's no centralized internet surveillance or registration authority for internet users generally. If we impose a scheme where there is a central organization with the authority to a) require registration and b) centrally control access, and c) (as has been proposed) require the user to provide a reason for their access, that organization then also has the ability to d) make judgment calls about what reasons are valid and which are not and e) maintain data on who accessed what RDS data, for what reason, for how long and why. Note also that at least one version of the EWG report said that f) the organization would be empowered to levy punitive measures against internet users who accessed more data than the RDS deems appropriate. So: you have a system that surveils internet users who access some information and maintains data on their use of that data. Let's think about the following scenarios from the point of view of openness, decentralization and civil liberties. * A journalist (or blogger) is writing an investigative article and wants to find out who is behind a domain name. If we require registration and disclosure of the reason, that in essence creates a situation where the RDS de facto is monitoring that journalist and determining if their basis for conducting the investigation is worthy. It also allows the RDS the ability to monitor the journalist's use of the domain name registration data. This potentially chills free speech. * Consider a political activist who wishes to expose corruption by an elected politician and wants to access RDS information to show, for example, conflicts of interests in the politician's business operations. Once the political activist has to disclose who they are, let alone why they are accessing the information, that not only chills legitimate political activism but also potentially opens up a route for government abuse (e.g., if a government agency were able to subpoena the list of who accessed RDS information for which domain names and why). * Academic researchers periodically review Whois/RDS data; requiring them to register before reviewing data and disclose why they are doing the research potentially empowers the RDS to monitor academic research and determine its worthiness. * Imagine that a cybercrime network is under investigation (as they are wont to be); requiring law enforcement to register -- particularly if there is a log of which domain names they reviewed RDS for -- can potentially compromise the investigation if that information is disclosed. Would registrants have the right to be informed every time that someone registered to review their RDS details? For one central entity to possess that much power over internet users is something that I think we should avoid, and it's antithetical to the principles of openness and decentralization. There are other well-known solutions to spam and inappropriate contacts; forcing all other legitimate activities to grind to a screeching halt -- particular under the umbrella of a surveillance scheme -- is a cure worse than the disease. I recognize and agree that we should try to find constructive solutions to this that require some compromise, and I'm grateful not only for the expertise that Stephanie and others have brought to this group, but also that Benny and others have pointed out some of the problems with Whois details being inappropriately used (e.g., for spam). However, I wanted to outline my strong concerns about creating a centralized registration and surveillance scheme over one subset of internet users as part of the solutions. John Horton President and CEO, LegitScript Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> On Tue, Feb 14, 2017 at 4:10 AM, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: Hi Allison, Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email? With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs? Nathalie On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net<mailto:sam@lanfranco.net>> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote: All, So it seems the debate has progressed from "thin data" to "thick data" (i.e. data that includes email). I know we are all super excited to talk about "thick data" but I don't think we are there yet (are we? Hopefully I didn't miss the party...) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because "thin data" can be used to link/point/discover other data then "thin data" equals "personal data") I just don't buy it. I don't disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com<mailto:michele@blacknight.com>> wrote: I agree and I know from how I've used various email addresses that they are actively being harvested and spammed. Also it's one of the biggest sources of complaints we get from our clients (registrants) It's definitely not an "edge case". Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social<http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: http://samlanfranco.blogspot.c om<http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Volker Greimann wrote:
That old horse again?
Here are some hard facts about the volume of abuse going on: https://www.spamhaus.org/statistics/tlds/ Right now, 93.3 percent of all domains registered under the .science TLD are malicious!
Those statistics are only their perceived truth just like the audience at Trumps inauguration was the largest ever!
Can you please make less emotionally charged statements?
Their statistics are deeply flawed as they only look at a small part of domain names and disregard major pieces of the puzzle: According to nTLD stats, .science has 232,611 domains, yet the Spamhaus reports bases their badness rating on an arbitrary number of domains "seen". They even state that if a domain is not in the focus of their anti-abuse systems, it will not be counted as seen. By ignoring the majority of domains in a TLD one can dream up any percentage one likes, apparently.
I'll give you an example; Let's say that I am a widget manufacture, and I have a new widget that I'm selling -- But this widget has a flaw where that at may burst into flames and explode. There have only been 100 sold and of those 78 have exploded... But I have 1,000,000 more of these things in storage and not currently in use by anyone. What percentage of exploding widgets would you recommend reporting? Spamhaus doesn't really care about domains parked and attempting to be sold by some domainer, nor do we care about domains registered defensively in order to protect one's brand. Honestly, there is a number of good reasons that domains exist, but are not actively used. -- Denny Watson Sr. Investigator The Spamhaus Project
Hi Denny, nice to meet you.
I'll give you an example;
Let's say that I am a widget manufacture, and I have a new widget that I'm selling -- But this widget has a flaw where that at may burst into flames and explode.
There have only been 100 sold and of those 78 have exploded... But I have 1,000,000 more of these things in storage and not currently in use by anyone. What percentage of exploding widgets would you recommend reporting? This is a completely different analogy as Spamhaus does not look at all domains registered/sold, nor does it look at all domains that are being used, but only at those domains you have "observed" without ever going into much detail how this is determined beyond that they are "showing up in mail feeds and related DNS traffic". You even admit that domains that are "used for traffic outside of our systems' focus" are not included in your summary. As your focus seems to be mainly mail and fraud prevention, this method sounds like it eliminates a majority of domains simply because they are not in your focus of preventing spam. Correct me if I misunderstand the statements on your website. Spamhaus doesn't really care about domains parked and attempting to be sold by some domainer, nor do we care about domains registered defensively in order to protect one's brand. Honestly, there is a number of good reasons that domains exist, but are not actively used. Or are actively used but "for traffic outside of our systems' focus".
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
The thing with private data is that it is amazing what you can legitimately and illegitimately do with it. You can correlate, investigate, use, abuse it in any shape or form, but at the end of the day, the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please. Many jurisdictions have decided that the protection of the individual weighs heavier than any potentially beneficial uses. And if you have a right to access the data, you will still be able to do so. Best, Volker Am 14.02.2017 um 13:10 schrieb nathalie coupet via gnso-rds-pdp-wg:
Hi Allison,
Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email?
With regards to privacy by design, instead of pushing for the implementation of this concept inside the realm of WHOIS where it is foreign, since it is an engineering concept, why not advocate for its implementation at the design level of the Internet, where it belongs?
Nathalie
On Tuesday, February 14, 2017 12:38 AM, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote:
I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann .org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social <http://mneylon.social/> Some thoughts: http://ceo.hosting/ ----------------------------- -- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- *----------------------------- ---------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ------------------------------ ---------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.c om <http://samlanfranco.blogspot.com/> Phone: 613 476-0429 cell: 416-816-2852
______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
I think Benny is right that we are going to all have to "look past our own walls and find a solution which are to the better for all". That will be hard but I am still optimistic that we can do it. Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 8:29 AM To: allison nixon <elsakoo@gmail.com> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Let me translate Allison's comments in the light of your mockery. You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… Welcome to the discussion -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote:
A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Hi Benny, Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts. John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi John, indeed, stricter data protection laws, court decisions or a different appreciation of the need of users to be protected from abuse of their private data may dictate stricter handling in the future. I hope you are not arguing against allowing for such changes? Best, Volker Am 14.02.2017 um 18:18 schrieb John Horton:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
*FollowLegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 <tel:%2B46.42197080> Direct: +47.32260201 <tel:%2B47.32260201> Mobile: +47.40410200 <tel:%2B47.40410200>
> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… > > Welcome to the discussion > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 <tel:%2B46.42197080> > Direct: +47.32260201 <tel:%2B47.32260201> > Mobile: +47.40410200 <tel:%2B47.40410200> > > > On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com <mailto:jcb@bambenekconsulting.com>> wrote: > > > > Let me translate Allison's comments in the light of your mockery. > > > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > > > Sent from my iPhone > > > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > >> > >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > >> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > >> > >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > >> > >> > >> -- > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > >> > >> Benny Samuelsen > >> Registry Manager - Domainexpert > >> > >> Nordreg AB - ICANN accredited registrar > >> IANA-ID: 638 > >> Phone: +46.42197080 <tel:%2B46.42197080> > >> Direct: +47.32260201 <tel:%2B47.32260201> > >> Mobile: +47.40410200 <tel:%2B47.40410200> > >> > >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > >>> > >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > >>> > >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > >>> > >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > >>> > >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > >>> > >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > >>> > >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > >>> > >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > >>> > >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > >>> > >>> > >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote: > >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > >>> > >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > >>> > >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > >>> > >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > >>> > >>> Sam L > >>> > >>> > >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: > >>> All, > >>> > >>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > >>> > >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > >>> > >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > >>> > >>> Alex > >>> > >>> > >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > >>> > >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) > >>> It’s definitely not an “edge case”. > >>> Regards > >>> Michele > >>> -- > >>> Mr Michele Neylon > >>> Blacknight Solutions > >>> Hosting, Colocation & Domains > >>> https://www.blacknight.com/ > >>> http://blacknight.blog/ > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%209183072> > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > >>> Social: http://mneylon.social > >>> Some thoughts: http://ceo.hosting/ > >>> ------------------------------- > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> -- > >>> *--------------------------------------------* > >>> "It is a disgrace to be rich and honoured > >>> in an unjust state" -Confucius > >>> ---------------------------------------------- > >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > >>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > >>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco > >>> blog: http://samlanfranco.blogspot.com <http://samlanfranco.blogspot.com> > >>> Phone: 613 476-0429 <tel:613%20476-0429> cell: 416-816-2852 > >>> > >>> > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> > >>> > >>> -- > >>> _________________________________ > >>> Note to self: Pillage BEFORE burning. > >> > >> _______________________________________________ > >> gnso-rds-pdp-wg mailing list > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
All public policy is weighed against the pantheon of interests. Very rarely is only one interest the only person in the room. Yes there are data privacy laws, but there also is the need of criminal investigations. The reason I keep bringing up child sexual exploitation is the fact that governments consistently use that to justify overreach. Sociologically laws operate on a pendulum. Swing it one way too hard, a prevailing force swings it the other way. We are seeing this play out in real time with the political dynamics in many countries in Europe and the US. So yes, protect privacy but that's not the only interest. You can say "boo hoo" about that and then knuckledraggers like me show up, grab the pendulum and swing it the other way against the wall. Sent from my iPhone
On Feb 14, 2017, at 09:22, Volker Greimann <vgreimann@key-systems.net> wrote:
Hi John,
indeed, stricter data protection laws, court decisions or a different appreciation of the need of users to be protected from abuse of their private data may dictate stricter handling in the future. I hope you are not arguing against allowing for such changes?
Best,
Volker
Am 14.02.2017 um 18:18 schrieb John Horton: Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured > in an unjust state" -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Can we elevate the level of this discussion please? To those of us who have spent our careers dealing with these matters, and patiently listening to arguments on all sides, It is just plain discouraging. We are trying to find what is best for all. That will not make everyone happy. Grabbing the pendulum and swinging it the other way against the wall seems a little intemperate to me, we are trying to engage in effective discussion. Everyone recognizes there are cost and paperwork repercussions for gated access, I hope, but it is reasonable to believe those costs have gone down thanks to technological innovations. Most importantly from the perspective of ICANN and its multistakeholder experiment, if we cannot work this out effectively in a PDP, ICANN will have failed and we will have to revert to national solutions. I don't think anyone wants that. Stephanie Perrin On 2017-02-14 13:52, John Bambenek via gnso-rds-pdp-wg wrote:
All public policy is weighed against the pantheon of interests. Very rarely is only one interest the only person in the room. Yes there are data privacy laws, but there also is the need of criminal investigations. The reason I keep bringing up child sexual exploitation is the fact that governments consistently use that to justify overreach. Sociologically laws operate on a pendulum. Swing it one way too hard, a prevailing force swings it the other way. We are seeing this play out in real time with the political dynamics in many countries in Europe and the US.
So yes, protect privacy but that's not the only interest. You can say "boo hoo" about that and then knuckledraggers like me show up, grab the pendulum and swing it the other way against the wall.
Sent from my iPhone
On Feb 14, 2017, at 09:22, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Hi John,
indeed, stricter data protection laws, court decisions or a different appreciation of the need of users to be protected from abuse of their private data may dictate stricter handling in the future. I hope you are not arguing against allowing for such changes?
Best,
Volker
Am 14.02.2017 um 18:18 schrieb John Horton:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
*FollowLegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 <tel:%2B46.42197080> Direct: +47.32260201 <tel:%2B47.32260201> Mobile: +47.40410200 <tel:%2B47.40410200>
> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… > > Welcome to the discussion > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 <tel:%2B46.42197080> > Direct: +47.32260201 <tel:%2B47.32260201> > Mobile: +47.40410200 <tel:%2B47.40410200> > > > On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com <mailto:jcb@bambenekconsulting.com>> wrote: > > > > Let me translate Allison's comments in the light of your mockery. > > > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > > > Sent from my iPhone > > > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > >> > >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > >> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > >> > >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > >> > >> > >> -- > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > >> > >> Benny Samuelsen > >> Registry Manager - Domainexpert > >> > >> Nordreg AB - ICANN accredited registrar > >> IANA-ID: 638 > >> Phone: +46.42197080 <tel:%2B46.42197080> > >> Direct: +47.32260201 <tel:%2B47.32260201> > >> Mobile: +47.40410200 <tel:%2B47.40410200> > >> > >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > >>> > >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > >>> > >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > >>> > >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > >>> > >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > >>> > >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > >>> > >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > >>> > >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > >>> > >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > >>> > >>> > >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote: > >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > >>> > >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > >>> > >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > >>> > >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > >>> > >>> Sam L > >>> > >>> > >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: > >>> All, > >>> > >>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > >>> > >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > >>> > >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > >>> > >>> Alex > >>> > >>> > >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > >>> > >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) > >>> It’s definitely not an “edge case”. > >>> Regards > >>> Michele > >>> -- > >>> Mr Michele Neylon > >>> Blacknight Solutions > >>> Hosting, Colocation & Domains > >>> https://www.blacknight.com/ > >>> http://blacknight.blog/ > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%209183072> > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > >>> Social: http://mneylon.social > >>> Some thoughts: http://ceo.hosting/ > >>> ------------------------------- > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> -- > >>> *--------------------------------------------* > >>> "It is a disgrace to be rich and honoured > >>> in an unjust state" -Confucius > >>> ---------------------------------------------- > >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > >>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > >>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco > >>> blog: http://samlanfranco.blogspot.com <http://samlanfranco.blogspot.com> > >>> Phone: 613 476-0429 <tel:613%20476-0429> cell: 416-816-2852 > >>> > >>> > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > >>> > >>> > >>> > >>> -- > >>> _________________________________ > >>> Note to self: Pillage BEFORE burning. > >> > >> _______________________________________________ > >> gnso-rds-pdp-wg mailing list > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email:vgreimann@key-systems.net
Web:www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email:vgreimann@key-systems.net
Web:www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi John None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive… Everything can be changed with new privacy laws coming in to force -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them. Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed. How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience. On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
On 14 Feb 2017, at 18:39, allison nixon <elsakoo@gmail.com> wrote:
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
So you are saying that none of this spam are not originating from whois harvesting?
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
So since that is only a small part of the problem as you state it then we shall not do the effort to reduce it as a part of the change we want? I am trying to understand the viewpoint and the argument for letting public whois info being used to generate spam and scams as less important here -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
So you are saying that none of this spam are not originating from whois harvesting?
Do you understand how spam emails are harvested? WHOIS is one source of emails, and there are many other sources of emails that are subsequently fed into botnets, "lead lists" et cetera. Shutting off the spigot for one source of emails is unlikely to make any significant impact in the volume of spam you, or the average person will receive. And if the email WHOIS was deliberately disclosed by a company or person, that e-mail will also be on their website and will still be spammed. The only category of people who would be harmed exclusively by this WHOIS status quo are people who made a foolish mistake and didn't intend to disclose something publicly. It's a far more effective solution to start an investigation against these scammers that send emails and snailmail to registrants making false claims about their domain expiration. That should have happened years ago, honestly.
So since that is only a small part of the problem as you state it then we shall not do the effort to reduce it as a part of the change we want? I am trying to understand the viewpoint and the argument for letting public whois info being used to generate spam and scams as less important here
Because the anti-abuse community are simply members of the public. There appears to be a low level of respect given here for the efforts of that community, so I have a corresponding low level of confidence that continued access to this data will be allowed. On Tue, Feb 14, 2017 at 12:50 PM, benny@nordreg.se <benny@nordreg.se> wrote:
On 14 Feb 2017, at 18:39, allison nixon <elsakoo@gmail.com> wrote:
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
So you are saying that none of this spam are not originating from whois harvesting?
How many of you people actually have day to day experience in fighting
spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
So since that is only a small part of the problem as you state it then we shall not do the effort to reduce it as a part of the change we want?
I am trying to understand the viewpoint and the argument for letting public whois info being used to generate spam and scams as less important here
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
-- _________________________________ Note to self: Pillage BEFORE burning.
On 14 Feb 2017, at 18:59, allison nixon <elsakoo@gmail.com> wrote:
So you are saying that none of this spam are not originating from whois harvesting?
Do you understand how spam emails are harvested? WHOIS is one source of emails, and there are many other sources of emails that are subsequently fed into botnets, "lead lists" et cetera. Shutting off the spigot for one source of emails is unlikely to make any significant impact in the volume of spam you, or the average person will receive. And if the email WHOIS was deliberately disclosed by a company or person, that e-mail will also be on their website and will still be spammed. The only category of people who would be harmed exclusively by this WHOIS status quo are people who made a foolish mistake and didn't intend to disclose something publicly.
Ah come on… dont’t give me that, answer my question without a lecture, been working with this for more than 20 years so please dont use that ignorant “do you understand”… I know very well how this is working...
It's a far more effective solution to start an investigation against these scammers that send emails and snailmail to registrants making false claims about their domain expiration. That should have happened years ago, honestly.
So I have heard but none hava managed to stop it and they are harming innocent people everyday with there scams but apparently not important...
So since that is only a small part of the problem as you state it then we shall not do the effort to reduce it as a part of the change we want? I am trying to understand the viewpoint and the argument for letting public whois info being used to generate spam and scams as less important here
Because the anti-abuse community are simply members of the public. There appears to be a low level of respect given here for the efforts of that community, so I have a corresponding low level of confidence that continued access to this data will be allowed.
Have you ever thought about that the level of respect arise from the level of respect from the anti-abuse community towards the ones who can and will help if they are shown the respect they should have? I think this is a two-way problem which in the last ICANN meetings have been in initiatives to help and the dialog has been open and positive. A change are needed on both sides absolutely -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
Ah come on… dont’t give me that, answer my question without a lecture, been working with this for more than 20 years so please dont use that ignorant “do you understand”… I know very well how this is working...
Then why ask that question? So many of the things I read in this thread appear to demonstrate a lack of experience in practical situations where privacy is violated(rightly AND wrongly). I don't know you or what you spent 20 years doing, I am only addressing the points you brought up.
So I have heard but none hava managed to stop it and they are harming innocent people everyday with there scams but apparently not important...
It is important, and the fact that it hasn't been addressed yet is a direct consequence of the large amount of Internet abuse compared to the small number of people equipped to investigate it.
Have you ever thought about that the level of respect arise from the level of respect from the anti-abuse community towards the ones who can and will help if they are shown the respect they should have? I think this is a two-way problem which in the last ICANN meetings have been in initiatives to help and the dialog has been open and positive. A change are needed on both sides absolutely
I have no history participating in those communities, and I have almost no history posting to this list. I am mostly too busy to read all the longwinded emails exchanged here, but this thread was just so off-base that I had to respond. It seems that people here use an Internet where cybercrime doesn't exist and isn't a concern. That was what concerned me. I don't know almost any of you and I'm not asking for your respect. The lack of concern for the major issue of cyber crime is what moved me to post. If there was proper consideration given to that issue within this group, I'd probably disappear back into the ether On Tue, Feb 14, 2017 at 1:20 PM, benny@nordreg.se <benny@nordreg.se> wrote:
On 14 Feb 2017, at 18:59, allison nixon <elsakoo@gmail.com> wrote:
So you are saying that none of this spam are not originating from whois harvesting?
Do you understand how spam emails are harvested? WHOIS is one source of emails, and there are many other sources of emails that are subsequently fed into botnets, "lead lists" et cetera. Shutting off the spigot for one source of emails is unlikely to make any significant impact in the volume of spam you, or the average person will receive. And if the email WHOIS was deliberately disclosed by a company or person, that e-mail will also be on their website and will still be spammed. The only category of people who would be harmed exclusively by this WHOIS status quo are people who made a foolish mistake and didn't intend to disclose something publicly.
Ah come on… dont’t give me that, answer my question without a lecture, been working with this for more than 20 years so please dont use that ignorant “do you understand”… I know very well how this is working...
It's a far more effective solution to start an investigation against
these scammers that send emails and snailmail to registrants making false claims about their domain expiration. That should have happened years ago, honestly.
So I have heard but none hava managed to stop it and they are harming innocent people everyday with there scams but apparently not important...
So since that is only a small part of the problem as you state it then
we shall not do the effort to reduce it as a part of the change we want?
I am trying to understand the viewpoint and the argument for letting public whois info being used to generate spam and scams as less important here
Because the anti-abuse community are simply members of the public. There appears to be a low level of respect given here for the efforts of that community, so I have a corresponding low level of confidence that continued access to this data will be allowed.
Have you ever thought about that the level of respect arise from the level of respect from the anti-abuse community towards the ones who can and will help if they are shown the respect they should have? I think this is a two-way problem which in the last ICANN meetings have been in initiatives to help and the dialog has been open and positive. A change are needed on both sides absolutely
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
-- _________________________________ Note to self: Pillage BEFORE burning.
Hi Allion, to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%. to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world? And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best, Volker Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 <tel:%2B46.42197080> Direct: +47.32260201 <tel:%2B47.32260201> Mobile: +47.40410200 <tel:%2B47.40410200>
> On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com <mailto:john.horton@legitscript.com>> wrote: > > Hi Benny, > > Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts. > > John Horton > President and CEO, LegitScript > > > Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+ > > > > On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 <tel:%2B46.42197080> > Direct: +47.32260201 <tel:%2B47.32260201> > Mobile: +47.40410200 <tel:%2B47.40410200> > > > On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > > > Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers > > > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > > A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… > > > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > > In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… > > > > Welcome to the discussion > > > > > > > > -- > > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > > > Benny Samuelsen > > Registry Manager - Domainexpert > > > > Nordreg AB - ICANN accredited registrar > > IANA-ID: 638 > > Phone: +46.42197080 <tel:%2B46.42197080> > > Direct: +47.32260201 <tel:%2B47.32260201> > > Mobile: +47.40410200 <tel:%2B47.40410200> > > > > > On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com <mailto:jcb@bambenekconsulting.com>> wrote: > > > > > > Let me translate Allison's comments in the light of your mockery. > > > > > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > > > > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > > > > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > > > > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > > > > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > > > > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > > > > > Sent from my iPhone > > > > > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > > >> > > >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > > >> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > > >> > > >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > >>> > > >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > >>> > > >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > >>> > > >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > >>> > > >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > >>> > > >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > >>> > > >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > >>> > > >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > >>> > > >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > >>> > > >>> > > >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote: > > >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > >>> > > >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > >>> > > >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > >>> > > >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > >>> > > >>> Sam L > > >>> > > >>> > > >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: > > >>> All, > > >>> > > >>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > >>> > > >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > >>> > > >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > >>> > > >>> Alex > > >>> > > >>> > > >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > > >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) > > >>> It’s definitely not an “edge case”. > > >>> Regards > > >>> Michele > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Social: http://mneylon.social > > >>> Some thoughts: http://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> -- > > >>> *--------------------------------------------* > > >>> "It is a disgrace to be rich and honoured > > >>> in an unjust state" -Confucius > > >>> ---------------------------------------------- > > >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > > >>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > > >>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco > > >>> blog: http://samlanfranco.blogspot.com <http://samlanfranco.blogspot.com> > > >>> Phone: 613 476-0429 cell: 416-816-2852 > > >>> > > >>> > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> > > >>> > > >>> -- > > >>> _________________________________ > > >>> Note to self: Pillage BEFORE burning. > > >> > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > > > > > > > -- > > _________________________________ > > Note to self: Pillage BEFORE burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> >
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group. On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote:
Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <+353%2059%20918%203072> > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured > in an unjust state" -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 <(613)%20476-0429> cell: 416-816-2852 <(416)%20816-2852> > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901>
Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of allison nixon Sent: Tuesday, February 14, 2017 1:21 PM To: Volker Greimann <vgreimann@key-systems.net> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion. [SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing: https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whoi... Scott
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. On Tue, Feb 14, 2017 at 1:31 PM, Hollenbeck, Scott <shollenbeck@verisign.com
wrote:
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *allison nixon *Sent:* Tuesday, February 14, 2017 1:21 PM *To:* Volker Greimann <vgreimann@key-systems.net> *Cc:* RDS PDP WG <gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
[SAH] Actually, there **are** requirements to provide valid data and for registrars to perform validation processing:
https://www.icann.org/resources/pages/approved-with- specs-2013-09-17-en#whois-accuracy
Scott
-- _________________________________ Note to self: Pillage BEFORE burning.
From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott
Scott, when I say fake email for WHOIS, most people generally understand it to mean a junk email address, a "mailinator" or "yopmail" address, or a newly created email address that will never be used again. The "verification" process is straightforward and quickly learned by anyone that doesn't understand, and no part of the process forces people to use an e-mail address that they actively use. At this point in time most Internet users understand the concept of a junk email address.
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
The fact that it happened twice, three, and ten years ago does not change the daily reality that this information is not verified, even when reported through a registrar's abuse channels. I'm going to continue stating that this policy is a joke until the reality of the bad state of WHOIS data changes, and then I will change my mind based on the evidence. On Tue, Feb 14, 2017 at 1:56 PM, Hollenbeck, Scott <shollenbeck@verisign.com
wrote:
*From:* allison nixon [mailto:elsakoo@gmail.com] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
-- _________________________________ Note to self: Pillage BEFORE burning.
On 14 Feb 2017, at 20:07, allison nixon <elsakoo@gmail.com> wrote:
Scott, when I say fake email for WHOIS, most people generally understand it to mean a junk email address, a "mailinator" or "yopmail" address, or a newly created email address that will never be used again. The "verification" process is straightforward and quickly learned by anyone that doesn't understand, and no part of the process forces people to use an e-mail address that they actively use. At this point in time most Internet users understand the concept of a junk email address.
I would say that the reason for people using those kind of emails are exactly why we should take away the public whois data, people are forced to use it because info are harvested and abused. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
Scott, when I say fake email for WHOIS, most people generally understand it to mean a junk email address, a "mailinator" or "yopmail" address, or a newly created email address that will never be used again. The "verification" process is straightforward and quickly learned by anyone that doesn't understand, and no part of the process forces people to use an e-mail address that they actively use. At this point in time most Internet users understand the concept of a junk email address. That is a completely different issue as the whois is essentially correct and the address fulfills all policy requirements. The availability and use of such addresses may also have legitimate purposes. The fact that it happened twice, three, and ten years ago does not change the daily reality that this information is not verified, even when reported through a registrar's abuse channels. I'm going to continue stating that this policy is a joke until the reality of the bad state of WHOIS data changes, and then I will change my mind based on the evidence. Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
Best, Volker
On Tue, Feb 14, 2017 at 1:56 PM, Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> wrote:
*From:*allison nixon [mailto:elsakoo@gmail.com <mailto:elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> *Cc:* vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
>>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
*//*
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en <https://www.icann.org/news/announcement-2-2007-03-16-en>
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... <https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1...>
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com' <elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott
Greg, I used the email address example only to address this statement originally sent by Allison (with emphasis added in bold italics for people with HTML-capable mail readers): “So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email” All I’m trying to do is note that this kind of advice can cause real unintended operational consequences for well-meaning registrants who might think it’s a great way to avoid having their PII published via services like WHOIS. It isn’t. Scott From: Greg Aaron [mailto:gca@icginc.com] Sent: Tuesday, February 14, 2017 2:20 PM To: Hollenbeck, Scott <shollenbeck@verisign.com>; 'elsakoo@gmail.com' <elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] RE: [gnso-rds-pdp-wg] Dangers of public whois No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com' <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott
Why isn't it? I've been doing it for years. It's a great way to avoid having my PII abused. Please demonstrate these consequences to me. On Tue, Feb 14, 2017 at 2:34 PM, Hollenbeck, Scott <shollenbeck@verisign.com
wrote:
Greg, I used the email address example only to address this statement originally sent by Allison (with emphasis added in bold italics for people with HTML-capable mail readers):
“So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a *fake email*”
All I’m trying to do is note that this kind of advice can cause real unintended operational consequences for well-meaning registrants who might think it’s a great way to avoid having their PII published via services like WHOIS. It isn’t.
Scott
*From:* Greg Aaron [mailto:gca@icginc.com] *Sent:* Tuesday, February 14, 2017 2:20 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com>; 'elsakoo@gmail.com' < elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] RE: [gnso-rds-pdp-wg] Dangers of public whois
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:* allison nixon [mailto:elsakoo@gmail.com <elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
-- _________________________________ Note to self: Pillage BEFORE burning.
Focusing on “fake”, I’m interpreting “fake email” as an address that is syntactically valid (it is formatted as local-part@domain as specified in Section 2.3.11 of RFC 5321) but incapable of receiving messages due to errors in processing either the local-part or the domain when attempting to deliver mail to the address. As I noted earlier, inability to deliver email sent to a contact address is one of the reasons for which an RAA-compliant registrar may suspend a registered domain. Scott From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 2:45 PM To: Hollenbeck, Scott <shollenbeck@verisign.com> Cc: gca@icginc.com; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Why isn't it? I've been doing it for years. It's a great way to avoid having my PII abused. Please demonstrate these consequences to me. On Tue, Feb 14, 2017 at 2:34 PM, Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> wrote: Greg, I used the email address example only to address this statement originally sent by Allison (with emphasis added in bold italics for people with HTML-capable mail readers): “So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email” All I’m trying to do is note that this kind of advice can cause real unintended operational consequences for well-meaning registrants who might think it’s a great way to avoid having their PII published via services like WHOIS. It isn’t. Scott From: Greg Aaron [mailto:gca@icginc.com<mailto:gca@icginc.com>] Sent: Tuesday, February 14, 2017 2:20 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>>; 'elsakoo@gmail.com<mailto:elsakoo@gmail.com>' <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> Cc: 'gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Subject: [EXTERNAL] RE: [gnso-rds-pdp-wg] Dangers of public whois No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com<mailto:elsakoo@gmail.com>' <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> Cc: 'gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott -- _________________________________ Note to self: Pillage BEFORE burning.
Yes, and you have to click a link to "verify". I know all that. No one here is confused about this. What I am confused about is the faith and assumption that the names, phone numbers, and physical addresses are correct in any way. If there is a process for reporting a wrong WHOIS detail, why is there no process for validating the same WHOIS detail? This is such a joke. Can we consider garbage as PII? What privacy controls do we need to protect garbage? What penalties should people suffer for not properly protecting garbage? Why are registrars not validating physical addresses and phone numbers? On Tue, Feb 14, 2017 at 3:26 PM, Hollenbeck, Scott <shollenbeck@verisign.com
wrote:
Focusing on “fake”, I’m interpreting “fake email” as an address that is syntactically valid (it is formatted as local-part@domain as specified in Section 2.3.11 of RFC 5321) but incapable of receiving messages due to errors in processing either the local-part or the domain when attempting to deliver mail to the address. As I noted earlier, inability to deliver email sent to a contact address is one of the reasons for which an RAA-compliant registrar may suspend a registered domain.
Scott
*From:* allison nixon [mailto:elsakoo@gmail.com] *Sent:* Tuesday, February 14, 2017 2:45 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* gca@icginc.com; gnso-rds-pdp-wg@icann.org
*Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Why isn't it? I've been doing it for years. It's a great way to avoid having my PII abused. Please demonstrate these consequences to me.
On Tue, Feb 14, 2017 at 2:34 PM, Hollenbeck, Scott < shollenbeck@verisign.com> wrote:
Greg, I used the email address example only to address this statement originally sent by Allison (with emphasis added in bold italics for people with HTML-capable mail readers):
“So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a *fake email*”
All I’m trying to do is note that this kind of advice can cause real unintended operational consequences for well-meaning registrants who might think it’s a great way to avoid having their PII published via services like WHOIS. It isn’t.
Scott
*From:* Greg Aaron [mailto:gca@icginc.com] *Sent:* Tuesday, February 14, 2017 2:20 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com>; 'elsakoo@gmail.com' < elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] RE: [gnso-rds-pdp-wg] Dangers of public whois
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:* allison nixon [mailto:elsakoo@gmail.com <elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
--
_________________________________ Note to self: Pillage BEFORE burning.
-- _________________________________ Note to self: Pillage BEFORE burning.
Hi Greg, that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible. Volker Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:*gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:*allison nixon [mailto:elsakoo@gmail.com] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> *Cc:* vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
*//*
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1...
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response. Cue yakety sax. The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong. On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:* allison nixon [mailto:elsakoo@gmail.com <elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Allison, I think it would be helpful if you didn’t lump all registrars into the same bucket just because you have had some bad experiences. That would make it easier for all of us to work collaboratively to find solutions going forward. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of allison nixon Sent: Wednesday, February 15, 2017 10:30 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response. Cue yakety sax. The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong. On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Hi Greg, that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible. Volker Am 14.02.2017 um 20:19 schrieb Greg Aaron: No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com<mailto:elsakoo@gmail.com>' <elsakoo@gmail.com><mailto:elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois >>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing: How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning.
Would any other registrar have responded to my address change with a "no, that is not your correct address"? On Wed, Feb 15, 2017 at 10:46 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
Allison,
I think it would be helpful if you didn’t lump all registrars into the same bucket just because you have had some bad experiences. That would make it easier for all of us to work collaboratively to find solutions going forward.
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *allison nixon *Sent:* Wednesday, February 15, 2017 10:30 AM *To:* Volker Greimann <vgreimann@key-systems.net> *Cc:* RDS PDP WG <gnso-rds-pdp-wg@icann.org>
*Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response.
Cue yakety sax.
The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:* allison nixon [mailto:elsakoo@gmail.com <elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann
- Rechtsabteilung -
Key-Systems GmbH
Im Oberen Werk 1
66386 St. Ingbert
Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901>
Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851>
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net
www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems
www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin
Handelsregister Nr.: HR B 18835 - Saarbruecken
Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann
- legal department -
Key-Systems GmbH
Im Oberen Werk 1
66386 St. Ingbert
Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901>
Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851>
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net
www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems
www.twitter.com/key_systems
CEO: Alexander Siffrin
Registration No.: HR B 18835 - Saarbruecken
V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
_________________________________ Note to self: Pillage BEFORE burning.
-- _________________________________ Note to self: Pillage BEFORE burning.
Yes I have a case like that now where the validation was rejected by the contact, they want to change to another fake adress and the answer to that request are no that are not ok -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 15 Feb 2017, at 16:57, allison nixon <elsakoo@gmail.com> wrote:
Would any other registrar have responded to my address change with a "no, that is not your correct address"?
On Wed, Feb 15, 2017 at 10:46 AM, Gomes, Chuck <cgomes@verisign.com> wrote: Allison,
I think it would be helpful if you didn’t lump all registrars into the same bucket just because you have had some bad experiences. That would make it easier for all of us to work collaboratively to find solutions going forward.
Chuck
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of allison nixon Sent: Wednesday, February 15, 2017 10:30 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org>
Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response.
Cue yakety sax.
The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com' <elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1...
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
_________________________________ Note to self: Pillage BEFORE burning.
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
How did you determine the address was fake? Was it tied to a larger pattern of abuse, or was the address nonexistant in your country's postal database? Or did you factually know that it was a real address but not owned by the registrant? On Wed, Feb 15, 2017 at 10:59 AM, benny@nordreg.se <benny@nordreg.se> wrote:
Yes I have a case like that now where the validation was rejected by the contact, they want to change to another fake adress and the answer to that request are no that are not ok
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 15 Feb 2017, at 16:57, allison nixon <elsakoo@gmail.com> wrote:
Would any other registrar have responded to my address change with a "no, that is not your correct address"?
On Wed, Feb 15, 2017 at 10:46 AM, Gomes, Chuck <cgomes@verisign.com> wrote: Allison,
I think it would be helpful if you didn’t lump all registrars into the same bucket just because you have had some bad experiences. That would make it easier for all of us to work collaboratively to find solutions going forward.
Chuck
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of allison nixon Sent: Wednesday, February 15, 2017 10:30 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org>
Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response.
Cue yakety sax.
The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com' <elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/ serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
_________________________________ Note to self: Pillage BEFORE burning.
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
I am not in a position to speak for registrars. Chuck From: allison nixon [mailto:elsakoo@gmail.com] Sent: Wednesday, February 15, 2017 10:57 AM To: Gomes, Chuck <cgomes@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Would any other registrar have responded to my address change with a "no, that is not your correct address"? On Wed, Feb 15, 2017 at 10:46 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: Allison, I think it would be helpful if you didn’t lump all registrars into the same bucket just because you have had some bad experiences. That would make it easier for all of us to work collaboratively to find solutions going forward. Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of allison nixon Sent: Wednesday, February 15, 2017 10:30 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response. Cue yakety sax. The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong. On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Hi Greg, that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible. Volker Am 14.02.2017 um 20:19 schrieb Greg Aaron: No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: 'elsakoo@gmail.com<mailto:elsakoo@gmail.com>' <elsakoo@gmail.com><mailto:elsakoo@gmail.com> Cc: 'gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [mailto:elsakoo@gmail.com] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott <shollenbeck@verisign.com<mailto:shollenbeck@verisign.com>> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois >>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing: How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851<tel:+49%206894%209396851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning. -- _________________________________ Note to self: Pillage BEFORE burning.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
Yet we hear claims on this list again and again that it is used by internet users all the time to verify whether the site they want to conduct commercial transactions on is legit.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
That does not mean we can act however we please, can set aside consumer rights and ignore all laws.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong. If provided with actual evidence of wilful use of incorrect data and the data either remains uncorrected or no evidence of acuracy of the correction is presented, then you will find that many registrars will deactivate the domain. For many, the threat of suspension of their domain is compulsion enough.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com <mailto:elsakoo@gmail.com>' <elsakoo@gmail.com> <mailto:elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:*allison nixon [mailto:elsakoo@gmail.com] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> *Cc:* vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
>>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
*//*
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en <https://www.icann.org/news/announcement-2-2007-03-16-en>
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... <https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1...>
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.:+49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.:+49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email:vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web:www.key-systems.net <http://www.key-systems.net> /www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> /www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.:+49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.:+49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email:vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web:www.key-systems.net <http://www.key-systems.net> /www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> /www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
You seem to be saying: Let's abolish whois altogether since it is all fake info anyway...? Am 15.02.2017 um 16:29 schrieb allison nixon:
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response.
Cue yakety sax.
The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com <mailto:elsakoo@gmail.com>' <elsakoo@gmail.com> <mailto:elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>' <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:*allison nixon [mailto:elsakoo@gmail.com] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> *Cc:* vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
>>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
*//*
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en <https://www.icann.org/news/announcement-2-2007-03-16-en>
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... <https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1...>
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.:+49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.:+49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email:vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web:www.key-systems.net <http://www.key-systems.net> /www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> /www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.:+49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.:+49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email:vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web:www.key-systems.net <http://www.key-systems.net> /www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> /www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Yet we hear claims on this list again and again that it is used by internet users all the time to verify whether the site they want to conduct commercial transactions on is legit.
Really? Because a lot of domains have WHOIS privacy enabled, which is as good as a fake address.
If provided with actual evidence of wilful use of incorrect data and the data either remains uncorrected or no evidence of acuracy of the correction is presented, then you will find that many registrars will deactivate the domain. For many, the threat of suspension of their domain is compulsion enough.
And if the registrant doesn't flagrantly admit to doing so, and they use an address of the nearest football stadium or enemy's house, the song and dance continues. Or they use existing whois privacy, input 123 fake st, and the complainant has no standing to make additional complaints
You seem to be saying: Let's abolish whois altogether since it is all fake info anyway...?
Not really, just pointing out the ridiculousness of the assumptions being made here. On Wed, Feb 15, 2017 at 11:22 AM, Volker Greimann <vgreimann@key-systems.net
wrote:
You seem to be saying: Let's abolish whois altogether since it is all fake info anyway...?
Am 15.02.2017 um 16:29 schrieb allison nixon:
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response.
Cue yakety sax.
The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong.
On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
Hi Greg,
that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible.
Volker
Am 14.02.2017 um 20:19 schrieb Greg Aaron:
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names.
All best,
--Greg
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounce s@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Hollenbeck, Scott *Sent:* Tuesday, February 14, 2017 1:57 PM *To:* 'elsakoo@gmail.com' <elsakoo@gmail.com> <elsakoo@gmail.com> *Cc:* 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
*From:* allison nixon [mailto:elsakoo@gmail.com <elsakoo@gmail.com>] *Sent:* Tuesday, February 14, 2017 1:35 PM *To:* Hollenbeck, Scott <shollenbeck@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/serad- to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott
_______________________________________________ gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- _________________________________ Note to self: Pillage BEFORE burning.
HI Allison, I have kept quiet for most of the debate back and forward and have not put my head above the parapet for the odd comment made through fear of the "oh another registrar - comment". However, if you have had a bad experience with a registrar, you report it to ICANN, please do not hang around, we like you want the bad actors to change their direction and be good and worthwhile registrars - whois inaccuracy reports come from ICANN and I have my fair share of them. I certainly do not risk my ICANN creds over someone’s whois - if there is a report, and the address looks bogus (and even if not as we have to provide ICANN some proof and "google maps" doesn’t cut it) we require ID, generally government based proving the address that has been updated is correct. Now, that does not prove verification, that proves validation, I am sure as you I believe suggested you could put down anyone’s address and it would be valid, however, verifying it is completely different, and costly, I believe Volker mentioned it before, if a solution can be found and it is commercially viable - confirm who is paying for it, as it is unfair to burden the registrant with extra cost, similar to the registrar, nor the registry. I cited once before, I know my neighbours name, his address (should do, he is my neighbour after all), his age, and because of cake last year, his birthday - lastly I know his height and can have a stab at his mothers maiden name (he mentioned it once before in passing conversation as it was similar to my mothers), thus quite a bit of information not really out in the public. You are probably now thinking where am I going with this. Verification can ONLY be done with the tools the governments of our world have, they know your passport number, driving license number, marriage date and other such dates. Only the governments can provide a way of verification that is as close as damn it to being the person you are dealing with. One final point to your comment " Really? Because a lot of domains have WHOIS privacy enabled, which is as good as a fake address. " We pay plenty for our office address per year, this is our privacy/proxy service address, so please don't tar all services with the same brush, some are great, some do as they need and some don't. Kind regards, Chris From: "allison nixon" <elsakoo@gmail.com> To: "Volker Greimann" <vgreimann@key-systems.net> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Wednesday, 15 February, 2017 16:31:40 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Yet we hear claims on this list again and again that it is used by internet users all the time to verify whether the site they want to conduct commercial transactions on is legit.
Really? Because a lot of domains have WHOIS privacy enabled, which is as good as a fake address.
If provided with actual evidence of wilful use of incorrect data and the data either remains uncorrected or no evidence of acuracy of the correction is presented, then you will find that many registrars will deactivate the domain. For many, the threat of suspension of their domain is compulsion enough.
And if the registrant doesn't flagrantly admit to doing so, and they use an address of the nearest football stadium or enemy's house, the song and dance continues. Or they use existing whois privacy, input 123 fake st, and the complainant has no standing to make additional complaints
You seem to be saying: Let's abolish whois altogether since it is all fake info anyway...?
Not really, just pointing out the ridiculousness of the assumptions being made here. On Wed, Feb 15, 2017 at 11:22 AM, Volker Greimann < vgreimann@key-systems.net > wrote: You seem to be saying: Let's abolish whois altogether since it is all fake info anyway...? Am 15.02.2017 um 16:29 schrieb allison nixon: BQ_BEGIN
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Really? because I saw firsthand exactly how serious such an investigation is and it's a joke.
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating.
While my domain was not involved in abuse, making a single address change, and saying "I assure you, this is where people should send mail" is more than enough to satisfy my registrar. Nothing stops someone from making a second complaint against a domain, especially if the goal is for takedown or harassment (which it almost always would be). And that second complaint would be as equally valid as the first one, and equally valid as my subsequent response. Cue yakety sax. The emperor wears no clothes.
Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena.
And the registrar doesn't publish payment info when the customer pays with a fake credit card. the comparison to WHOIS is nonsensical. WHOIS is not involved in private commercial transactions.
There has to be some form of due process, anything else is anarchy.
The Internet is in a state of anarchy.
Verification may be impossible. Validation on the other hand is possible. If you do not like the policy as it stands, propose an alternative solution. Ideally also tell us who will pay for it.
I do not actually think that physical addresses and phone numbers should be verified. I am saying that this dance around the issue of correct WHOIS data is a hilarious joke. You seem to have legal obligations to pretend otherwise, as a registrar, but I don't and I'm pointing out the nakedness of this particular emperor. There is absolutely no compulsion to provide correct info. I challenge you to prove me wrong. On Wed, Feb 15, 2017 at 5:00 AM, Volker Greimann < vgreimann@key-systems.net > wrote: BQ_BEGIN Hi Greg, that is a totally different issue. Maybe such services need better regulation, but as long as the policy requirements are met, taking action solely based on the use of such services is impossible. Volker Am 14.02.2017 um 20:19 schrieb Greg Aaron: BQ_BEGIN No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to register lots of domain names. All best, --Greg From: gnso-rds-pdp-wg-bounces@icann.org [ mailto:gnso-rds-pdp-wg-bounces@icann.org ] On Behalf Of Hollenbeck, Scott Sent: Tuesday, February 14, 2017 1:57 PM To: ' elsakoo@gmail.com ' <elsakoo@gmail.com> Cc: ' gnso-rds-pdp-wg@icann.org ' <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois From: allison nixon [ mailto:elsakoo@gmail.com ] Sent: Tuesday, February 14, 2017 1:35 PM To: Hollenbeck, Scott < shollenbeck@verisign.com > Cc: vgreimann@key-systems.net ; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously? Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are two examples: https://www.icann.org/news/announcement-2-2007-03-16-en https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul1... worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that. Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA). Scott _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END -- _________________________________ Note to self: Pillage BEFORE burning. BQ_END -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. BQ_END -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Allison As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
Another post about the problems with public whois How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocalling-base... -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Another post about the problems with public whois How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocalling-base... -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Let us take a simple example A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. So why on earth are we forcing registrants to give up this right to choose to whom they share that info? Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. The Status Quo hammering are not productive at all. RDS are meant to make change to the better! Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocalling-base...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. -----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Let us take a simple example A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. So why on earth are we forcing registrants to give up this right to choose to whom they share that info? Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. The Status Quo hammering are not productive at all. RDS are meant to make change to the better! Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I have no problem understanding your example but come up with an idea which can secure that access and also benefit the privacy of those not doing anything wrong buy still are abused on a daily basis. Funny that you choose a trademark as an example because there are so many categories of trademarks that another's use of for example xp.sometld don't have to be an infringement on Microsoft's trademark for XP but that's another discussion Sent from my iPhone
On 17 Feb 2017, at 20:50, Mark Svancarek <marksv@microsoft.com> wrote:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
For a mark holder like Microsoft, it's not so hard to solve the secured access problem - one solution could be to allow mark holders to sign up for access rights. (I am not designing a technical solution in this email, so for purposes of discussion please don't oppose this idea on potential implementation details.) There are plenty of egregious examples of trademark violation, so throwing out a silly one doesn't advance your argument. -----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 12:17 PM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois I have no problem understanding your example but come up with an idea which can secure that access and also benefit the privacy of those not doing anything wrong buy still are abused on a daily basis. Funny that you choose a trademark as an example because there are so many categories of trademarks that another's use of for example xp.sometld don't have to be an infringement on Microsoft's trademark for XP but that's another discussion Sent from my iPhone
On 17 Feb 2017, at 20:50, Mark Svancarek <marksv@microsoft.com> wrote:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocalli n g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content. Problems with domain -> registrant Problems with content -> Web host Best, Volker Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Volker Really? As a hosting provider I’d strongly disagree. If you’ve got a problem with content on a website you should contact the registrant first. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content. Problems with domain -> registrant Problems with content -> Web host Best, Volker Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > Counter example > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > -----Original Message----- > From: benny@nordreg.se [mailto:benny@nordreg.se] > Sent: Friday, February 17, 2017 9:41 AM > To: Mark Svancarek <marksv@microsoft.com> > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > Let us take a simple example > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > The Status Quo hammering are not productive at all. > > RDS are meant to make change to the better! > > > Sent from my iPhone > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: >> >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. >> >> >> >> -----Original Message----- >> From: gnso-rds-pdp-wg-bounces@icann.org >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of >> benny@nordreg.se >> Sent: Friday, February 17, 2017 8:25 AM >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois >> >> Another post about the problems with public whois >> >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. >> >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin >> g-based-whois-info/ >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: >>> >>> Allison >>> >>> As others have said, if you have an issue please report it to ICANN, >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. >>> >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C >>> >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. >>> >>> Regards >>> >>> Michele >>> >>> -- >>> Mr Michele Neylon >>> Blacknight Solutions >>> Hosting, Colocation & Domains >>> https://www.blacknight.com/ >>> http://blacknight.blog/ >>> Intl. +353 (0) 59 9183072 >>> Direct Dial: +353 (0)59 9183090 >>> Personal blog: https://michele.blog/ >>> Some thoughts: https://ceo.hosting/ >>> ------------------------------- >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business >>> Park,Sleaty >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar. Best, Volker Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight:
Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > Counter example > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > -----Original Message----- > From: benny@nordreg.se [mailto:benny@nordreg.se] > Sent: Friday, February 17, 2017 9:41 AM > To: Mark Svancarek <marksv@microsoft.com> > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > Let us take a simple example > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > The Status Quo hammering are not productive at all. > > RDS are meant to make change to the better! > > > Sent from my iPhone > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: >> >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. >> >> >> >> -----Original Message----- >> From: gnso-rds-pdp-wg-bounces@icann.org >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of >> benny@nordreg.se >> Sent: Friday, February 17, 2017 8:25 AM >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois >> >> Another post about the problems with public whois >> >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. >> >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin >> g-based-whois-info/ >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: >>> >>> Allison >>> >>> As others have said, if you have an issue please report it to ICANN, >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. >>> >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C >>> >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. >>> >>> Regards >>> >>> Michele >>> >>> -- >>> Mr Michele Neylon >>> Blacknight Solutions >>> Hosting, Colocation & Domains >>> https://www.blacknight.com/ >>> http://blacknight.blog/ >>> Intl. +353 (0) 59 9183072 >>> Direct Dial: +353 (0)59 9183090 >>> Personal blog: https://michele.blog/ >>> Some thoughts: https://ceo.hosting/ >>> ------------------------------- >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business >>> Park,Sleaty >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Volker The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar. Best, Volker Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > Volker > > Really? > As a hosting provider I’d strongly disagree. > > If you’ve got a problem with content on a website you should contact the registrant first. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > When you say web site, it should be taken up with the web host not the > registrar as the registrant is not necessarily the correct content. > > Problems with domain -> registrant > > Problems with content -> Web host > > Best, > > Volker > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > Counter example > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > -----Original Message----- > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > Sent: Friday, February 17, 2017 9:41 AM > > To: Mark Svancarek <marksv@microsoft.com> > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > Let us take a simple example > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > The Status Quo hammering are not productive at all. > > > > RDS are meant to make change to the better! > > > > > > Sent from my iPhone > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > >> > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > >> > >> > >> > >> -----Original Message----- > >> From: gnso-rds-pdp-wg-bounces@icann.org > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > >> benny@nordreg.se > >> Sent: Friday, February 17, 2017 8:25 AM > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > >> > >> Another post about the problems with public whois > >> > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > >> > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > >> g-based-whois-info/ > >> > >> > >> -- > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > >> > >> Benny Samuelsen > >> Registry Manager - Domainexpert > >> > >> Nordreg AB - ICANN accredited registrar > >> IANA-ID: 638 > >> Phone: +46.42197080 > >> Direct: +47.32260201 > >> Mobile: +47.40410200 > >> > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > >>> > >>> Allison > >>> > >>> As others have said, if you have an issue please report it to ICANN, > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > >>> > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > >>> > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > >>> > >>> Regards > >>> > >>> Michele > >>> > >>> -- > >>> Mr Michele Neylon > >>> Blacknight Solutions > >>> Hosting, Colocation & Domains > >>> https://www.blacknight.com/ > >>> http://blacknight.blog/ > >>> Intl. +353 (0) 59 9183072 > >>> Direct Dial: +353 (0)59 9183090 > >>> Personal blog: https://michele.blog/ > >>> Some thoughts: https://ceo.hosting/ > >>> ------------------------------- > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > >>> Park,Sleaty > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > >> _______________________________________________ > >> gnso-rds-pdp-wg mailing list > >> gnso-rds-pdp-wg@icann.org > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight:
Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > Volker > > Really? > As a hosting provider I’d strongly disagree. > > If you’ve got a problem with content on a website you should contact the registrant first. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > When you say web site, it should be taken up with the web host not the > registrar as the registrant is not necessarily the correct content. > > Problems with domain -> registrant > > Problems with content -> Web host > > Best, > > Volker > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > Counter example > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > -----Original Message----- > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > Sent: Friday, February 17, 2017 9:41 AM > > To: Mark Svancarek <marksv@microsoft.com> > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > Let us take a simple example > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > The Status Quo hammering are not productive at all. > > > > RDS are meant to make change to the better! > > > > > > Sent from my iPhone > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > >> > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > >> > >> > >> > >> -----Original Message----- > >> From: gnso-rds-pdp-wg-bounces@icann.org > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > >> benny@nordreg.se > >> Sent: Friday, February 17, 2017 8:25 AM > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > >> > >> Another post about the problems with public whois > >> > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > >> > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > >> g-based-whois-info/ > >> > >> > >> -- > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > >> > >> Benny Samuelsen > >> Registry Manager - Domainexpert > >> > >> Nordreg AB - ICANN accredited registrar > >> IANA-ID: 638 > >> Phone: +46.42197080 > >> Direct: +47.32260201 > >> Mobile: +47.40410200 > >> > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > >>> > >>> Allison > >>> > >>> As others have said, if you have an issue please report it to ICANN, > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > >>> > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > >>> > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > >>> > >>> Regards > >>> > >>> Michele > >>> > >>> -- > >>> Mr Michele Neylon > >>> Blacknight Solutions > >>> Hosting, Colocation & Domains > >>> https://www.blacknight.com/ > >>> http://blacknight.blog/ > >>> Intl. +353 (0) 59 9183072 > >>> Direct Dial: +353 (0)59 9183090 > >>> Personal blog: https://michele.blog/ > >>> Some thoughts: https://ceo.hosting/ > >>> ------------------------------- > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > >>> Park,Sleaty > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > >>> _______________________________________________ > >>> gnso-rds-pdp-wg mailing list > >>> gnso-rds-pdp-wg@icann.org > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > >> _______________________________________________ > >> gnso-rds-pdp-wg mailing list > >> gnso-rds-pdp-wg@icann.org > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > >
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Hi Volker, Just for clarity - what are the registrars responsible for?. They may be a few on this list who may be a bit confused with this latest thread. Cheers Dick Richard Leaning RIPE NCC External Relations (Sent by iPhone)
On 20 Feb 2017, at 12:24, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not.
As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar.
Best,
Volker
Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Richard, registrars are responsible for the obligations laid out in the RAA, the RRAs our own agreements and applicable policies. We also take the data provided by our customers and forward them to the registry in order to enable the functionality of the domain name registered through our service. From the registrar perspective, that's it. Everything else is supplementary services that a registrar may or may not offer, like hosting, nameservers, etc. We are certainly not responsible for content or the use of the domain name. That is hosting services, not registration services. Best, Volker Am 20.02.2017 um 12:42 schrieb Richard Leaning:
Hi Volker,
Just for clarity - what are the registrars responsible for?. They may be a few on this list who may be a bit confused with this latest thread.
Cheers
Dick
Richard Leaning RIPE NCC External Relations (Sent by iPhone)
On 20 Feb 2017, at 12:24, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not.
As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar.
Best,
Volker
Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > Allison > > As others have said, if you have an issue please report it to ICANN, > law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > Regards > > Michele > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not.
As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar.
Best,
Volker
Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > >
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" < vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek < marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017 /02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/l istinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
John I don’t think anyone was trying to push for “rules” about how reports should be made. I know I wasn’t. I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: John Horton <john.horton@legitscript.com> Date: Friday 24 February 2017 at 13:40 To: Volker Greimann <vgreimann@key-systems.net> Cc: theo geurts <gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Michele, et. al. I may be way off base here but I am thinking about the complaints issue from a researcher perspective. Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar. It might work at the ICANN level much as the following that turns up in a whois search:
Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. /Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints /Sam L. On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Sam That would involve us all agreeing on $stuff ☺ So I suspect it wouldn’t work M -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Sam Lanfranco <sam@lanfranco.net> Date: Friday 24 February 2017 at 14:17 To: Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> Cc: "gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Michele, et. al. I may be way off base here but I am thinking about the complaints issue from a researcher perspective. Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar. It might work at the ICANN level much as the following that turns up in a whois search:
Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints Sam L. On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote: John I don’t think anyone was trying to push for “rules” about how reports should be made. I know I wasn’t. I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: John Horton <john.horton@legitscript.com><mailto:john.horton@legitscript.com> Date: Friday 24 February 2017 at 13:40 To: Volker Greimann <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net> Cc: theo geurts <gtheo@xs4all.nl><mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com><mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org"<mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Michele, The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact) Sam On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote:
Sam
That would involve us all agreeing on $stuff J
So I suspect it wouldn’t work
M
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 14:17 *To: *Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele, et. al.
I may be way off base here but I am thinking about the complaints issue from a researcher perspective.
Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar.
It might work at the ICANN level much as the following that turns up in a whois search:
Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. /Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints
/Sam L.
On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl> <mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog:https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Hosting providers don’t have a relationship with ICANN . .. -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Sam Lanfranco <sam@lanfranco.net> Date: Friday 24 February 2017 at 15:25 To: Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> Cc: "gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Michele, The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact) Sam On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote: Sam That would involve us all agreeing on $stuff ☺ So I suspect it wouldn’t work M -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Sam Lanfranco <sam@lanfranco.net><mailto:sam@lanfranco.net> Date: Friday 24 February 2017 at 14:17 To: Michele Neylon <michele@blacknight.com><mailto:michele@blacknight.com>, John Horton <john.horton@legitscript.com><mailto:john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net> Cc: "gnso-rds-pdp-wg@icann.org"<mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Michele, et. al. I may be way off base here but I am thinking about the complaints issue from a researcher perspective. Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar. It might work at the ICANN level much as the following that turns up in a whois search:
Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints Sam L. On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote: John I don’t think anyone was trying to push for “rules” about how reports should be made. I know I wasn’t. I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: John Horton <john.horton@legitscript.com><mailto:john.horton@legitscript.com> Date: Friday 24 February 2017 at 13:40 To: Volker Greimann <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net> Cc: theo geurts <gtheo@xs4all.nl><mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com><mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org"<mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852 -- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Which is why everyone seems to want registrar obligations that force them to do what is actually the hosting providers' job. Best, Volker Am 24.02.2017 um 16:33 schrieb Michele Neylon - Blacknight:
Hosting providers don’t have a relationship with ICANN . ..
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 15:25 *To: *Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele,
The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact)
Sam
On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote:
Sam
That would involve us all agreeing on $stuff J
So I suspect it wouldn’t work
M
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> <mailto:sam@lanfranco.net> *Date: *Friday 24 February 2017 at 14:17 *To: *Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele, et. al.
I may be way off base here but I am thinking about the complaints issue from a researcher perspective.
Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar.
It might work at the ICANN level much as the following that turns up in a whois search:
>>> Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. /Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints
/Sam L.
On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl> <mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco
blog:https://samlanfranco.blogspot.com
Phone: +1 613-476-0429 cell: +1 416-816-2852
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog:https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Volker, Michele, et. al., I am suggesting something closer to a plain vanilla "Complainers Guide to Domain Name/Website Complaints" that lists best practice starting points. It could be worked up under the lead of any third party (crowd sourced input would be my strategy), with an open access/copy left designation. Any interest or engagement by ICANN and its constituencies would be ad hoc and based on their own self interests in reducing the burden of handling complaints. The status quo is a headache for various ICANN business constituencies (costs, time, headaches), as well as frustrating for ICANN's NCSG-centric constituencies (abuse, fraud, etc.). I only opened this line of thought as an alternative to trying to "hard bake" ways of dealing with complaints within the structure of the rds (which is a BAD idea). The suggestion was prompted by the extended discussion in the rds-pdp-wg around the problems of how complaints are handled now. I propose that we close this discussion for now. Sam On 2/24/2017 10:36 AM, Volker Greimann wrote:
Which is why everyone seems to want registrar obligations that force them to do what is actually the hosting providers' job.
Best,
Volker
Am 24.02.2017 um 16:33 schrieb Michele Neylon - Blacknight:
Hosting providers don’t have a relationship with ICANN . ..
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 15:25 *To: *Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele,
The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact)
Sam
On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote:
Sam
That would involve us all agreeing on $stuff J
So I suspect it wouldn’t work
M
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> <mailto:sam@lanfranco.net> *Date: *Friday 24 February 2017 at 14:17 *To: *Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele, et. al.
I may be way off base here but I am thinking about the complaints issue from a researcher perspective.
Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar.
It might work at the ICANN level much as the following that turns up in a whois search:
>>> Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. /Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints
/Sam L.
On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl> <mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco
blog:https://samlanfranco.blogspot.com
Phone: +1 613-476-0429 cell: +1 416-816-2852
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog:https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email:vgreimann@key-systems.net
Web:www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email:vgreimann@key-systems.net
Web:www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
There are too many variations to come up with any kind of "one size fits all" approach (much less rules) to making contact. That said, some centrally-located, easy-to-point-to *education* on what each entity in the "chain" does and some guidance (not even recommendations) on what tends to work in certain broad circumstances would be helpful to have. "Idiot's Delight" benefits no one (not even the lawyers, except to the extent some of us can plausibly claim not to be idiots, at least for this purpose). Greg *Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com On Fri, Feb 24, 2017 at 11:30 AM, Sam Lanfranco <sam@lanfranco.net> wrote:
Volker, Michele, et. al., I am suggesting something closer to a plain vanilla "Complainers Guide to Domain Name/Website Complaints" that lists best practice starting points. It could be worked up under the lead of any third party (crowd sourced input would be my strategy), with an open access/copy left designation.
Any interest or engagement by ICANN and its constituencies would be ad hoc and based on their own self interests in reducing the burden of handling complaints. The status quo is a headache for various ICANN business constituencies (costs, time, headaches), as well as frustrating for ICANN's NCSG-centric constituencies (abuse, fraud, etc.).
I only opened this line of thought as an alternative to trying to "hard bake" ways of dealing with complaints within the structure of the rds (which is a BAD idea). The suggestion was prompted by the extended discussion in the rds-pdp-wg around the problems of how complaints are handled now.
I propose that we close this discussion for now.
Sam
On 2/24/2017 10:36 AM, Volker Greimann wrote:
Which is why everyone seems to want registrar obligations that force them to do what is actually the hosting providers' job.
Best,
Volker
Am 24.02.2017 um 16:33 schrieb Michele Neylon - Blacknight:
Hosting providers don’t have a relationship with ICANN . ..
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072 <+353%2059%20918%203072>
Direct Dial: +353 (0)59 9183090 <+353%2059%20918%203090>
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 15:25 *To: *Michele Neylon <michele@blacknight.com> <michele@blacknight.com>, John Horton <john.horton@legitscript.com> <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele,
The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact)
Sam
On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote:
Sam
That would involve us all agreeing on $stuff J
So I suspect it wouldn’t work
M
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072 <+353%2059%20918%203072>
Direct Dial: +353 (0)59 9183090 <+353%2059%20918%203090>
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 14:17 *To: *Michele Neylon <michele@blacknight.com> <michele@blacknight.com>, John Horton <john.horton@legitscript.com> <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele, et. al.
I may be way off base here but I am thinking about the complaints issue from a researcher perspective.
Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar.
It might work at the ICANN level much as the following that turns up in a whois search:
Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en.
*Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints <https://www.icann.org/domain-name-complaints> *Sam L.
On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072 <+353%2059%20918%203072>
Direct Dial: +353 (0)59 9183090 <+353%2059%20918%203090>
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> <john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> <vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl> <gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com> <michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow* *Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek < marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/ 2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email: Lanfran@Yorku.ca Skype: slanfranco
blog: https://samlanfranco.blogspot.com
Phone: +1 613-476-0429 <(613)%20476-0429> cell: +1 416-816-2852 <(416)%20816-2852>
--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email: Lanfran@Yorku.ca Skype: slanfranco
blog: https://samlanfranco.blogspot.com
Phone: +1 613-476-0429 <(613)%20476-0429> cell: +1 416-816-2852 <(416)%20816-2852>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851> Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUPwww.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 <(613)%20476-0429> cell: +1 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Indeed, and for ICANN to start reaching out and prescribing protocols as to who is responsible for what, and who contacts whom....this is outside ICANN's remit in my view, and open up quite a few cans of worms. Stephanie On 2017-02-24 10:33, Michele Neylon - Blacknight wrote:
Hosting providers don’t have a relationship with ICANN . ..
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> *Date: *Friday 24 February 2017 at 15:25 *To: *Michele Neylon <michele@blacknight.com>, John Horton <john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele,
The current anarchy in complaint strategies involves $costs. Agreement on something by ICANN, as a general starting point roadmap for Complaints, should be doable. Complaints won't go away and some guidance is better than no guidance (and less costly to registrars by dulling, deflecting and re-directing initial contact)
Sam
On 2/24/2017 9:21 AM, Michele Neylon - Blacknight wrote:
Sam
That would involve us all agreeing on $stuff J
So I suspect it wouldn’t work
M
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *Sam Lanfranco <sam@lanfranco.net> <mailto:sam@lanfranco.net> *Date: *Friday 24 February 2017 at 14:17 *To: *Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com>, Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *"gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Michele, et. al.
I may be way off base here but I am thinking about the complaints issue from a researcher perspective.
Would there be any merit to simply having a link in, or at the bottom of, the public (rds/whois) data that is a link to a site (standard by registrar, by country, icann, or whatever) that has a "howto guide" for going forward with a complaint? If that existed it could be added to the "Contact Us", FAQ, and other link sites. Available at those points of inquiry it would probably redirect a lot of traffic away from the registrar.
It might work at the ICANN level much as the following that turns up in a whois search:
>>> Last update of whois database: Tue, 05 Jan 2016 11:23:29 GMT <<<
For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en. /Maybe => For complaint information please visit https://www.icann.org/domain-name-complaints
/Sam L.
On 2/24/2017 8:46 AM, Michele Neylon - Blacknight wrote:
John
I don’t think anyone was trying to push for “rules” about how reports should be made.
I know I wasn’t.
I’ll also keep telling people who complain to us about $stuff to go to our clients first .. since most of the time they’re the ones they should be dealing with.
Regards
Michele
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com> *Date: *Friday 24 February 2017 at 13:40 *To: *Volker Greimann <vgreimann@key-systems.net> <mailto:vgreimann@key-systems.net> *Cc: *theo geurts <gtheo@xs4all.nl> <mailto:gtheo@xs4all.nl>, Michele Neylon <michele@blacknight.com> <mailto:michele@blacknight.com>, "gnso-rds-pdp-wg@icann.org" <mailto:gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco
blog:https://samlanfranco.blogspot.com
Phone: +1 613-476-0429 cell: +1 416-816-2852
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog:https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
From ICANN's LinkedIn Page ... = ICANN doesn’t control content on the Internet. It cannot stop spam and it doesn’t deal with access to the Internet. =
Seems fairly clear to me that an allegation about copyright infringement on a webpage shouldn't be sent to or through icann (unless the entirety of the next Harry Potter book is a bit short and can fit inside the 63 character limits of a domain name) Rob --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus
Rob, Thankfully, that's not what's being proposed (nor is it current practice). Those of us who track down stolen, pirated, bootleg, or otherwise infringing copyrighted materials on the web don't want to send anything to or through ICANN. They just need to find and contact the registrant and/or the hosting provider and/or the registrar and/or the registry in order to deal with them directly. Since its inception, Whois has been instrumental in doing so. But nothing gets sent "to or through" ICANN. ICANN never sees infringing content, is not aware of any infringing content, is not aware that any particular copyright is being infringed, and is not aware that any possible infringement is being investigated. Greg On Fri, Feb 24, 2017 at 4:45 PM Rob Golding <rob.golding@astutium.com> wrote:
From ICANN's LinkedIn Page ... = ICANN doesn’t control content on the Internet. It cannot stop spam and it doesn’t deal with access to the Internet. =
Seems fairly clear to me that an allegation about copyright infringement on a webpage shouldn't be sent to or through icann (unless the entirety of the next Harry Potter book is a bit short and can fit inside the 63 character limits of a domain name)
Rob
--- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com
John, not suggesting we bake such rules into our work product, but it still may be helpful to have a set of recommendations that recommends where a complainant should turn first, second, etc. in order to get the best and fastest result. BTW, I notice that you forgot to include your affiliation with WHIBSE in your published statement of interest. As that company seems to rely on whois data for its product I think it is relevant to mention that. Best, Volker Am 24.02.2017 um 14:40 schrieb John Horton:
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*FollowLegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin <http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin> > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C <https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C> > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
John, Can you clarify what you want a ruling on? Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: 1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. 2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't *apropos.* If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *John Horton *Sent:* Friday, February 24, 2017 8:41 AM *To:* Volker Greimann <vgreimann@key-systems.net> *Cc:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow* *Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek < marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/ 2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: 1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. 2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: John, Can you clarify what you want a ruling on? Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive. Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote:
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
*From:*John Horton [mailto:john.horton@legitscript.com] *Sent:* Friday, February 24, 2017 11:12 AM *To:* Gomes, Chuck <cgomes@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name
, and determining "registrar obligations" in response to those abuse complaints.
2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint."
Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't /apropos./ If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com <mailto:cgomes@verisign.com>> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *John Horton *Sent:* Friday, February 24, 2017 8:41 AM *To:* Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> *Cc:* gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Stephanie, What is ICANN asking anyone to do on a voluntary basis? From my perspective, the various parties involved are just using the icann infrastructure as an opportunity to come together for mutually beneficial solutions. You and your stakeholder group oppose that? Why? Thanks, Kiran Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos. On Feb 24, 2017, at 7:23 PM, Stephanie Perrin <stephanie.perrin@mail.utoronto.ca<mailto:stephanie.perrin@mail.utoronto.ca>> wrote: I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive. Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com><mailto:cgomes@verisign.com> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: 1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. 1. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: John, Can you clarify what you want a ruling on? Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Thanks Kiran, I hope that I have adequately answered your question in my response to Chuck, just posted. Stephanie On 2017-02-25 01:46, Kiran Malancharuvil wrote:
Hi Stephanie,
What is ICANN asking anyone to do on a voluntary basis? From my perspective, the various parties involved are just using the icann infrastructure as an opportunity to come together for mutually beneficial solutions. You and your stakeholder group oppose that? Why?
Thanks,
Kiran
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 24, 2017, at 7:23 PM, Stephanie Perrin <stephanie.perrin@mail.utoronto.ca<mailto:stephanie.perrin@mail.utoronto.ca>> wrote:
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.
Stephanie Perrin
On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com><mailto:cgomes@verisign.com> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints.
1. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...]
Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: John,
Can you clarify what you want a ruling on?
Chuck
From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...]
Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>
Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>
Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Stephanie. I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Stephanie Perrin Sent: Friday, February 24, 2017 10:23 PM To: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive. Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com><mailto:cgomes@verisign.com> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: 1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. 2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: John, Can you clarify what you want a ruling on? Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
+1 Stephanie I am sympathetic to the position which Kiran argues, because in theory I can see how voluntary agreements could be a useful way to avoid heavy-handed regulation which helps no one. BUT what we have seen in practice is very different. I’m thinking here about things like the Systematic Copyright Alternative Dispute Resolution Policy which the Public Interest Registry developed with the Domain Name Association. It’s implementation has now been “paused”, but it was developed without adequate input from those stakeholders who would be most impacted by it. I know that intentions here were good, and I fully acknowledge that there are challenges involved in enforcing existing laws on copyright in online environments. But this ‘voluntary’ agreement did not provide registrants with sufficient rights in a process which could see them loose their domain name. And it’s a slippery slope — if you can loose your domain name because of copyright-infringing content (which the registrant may not have even uploaded themselves), what’s next? Loosing your domain name because it hosts “fake news”? Undesirable political speech? Had this policy been implemented, those that had the most to loose - the registrant and their domain name - would have been powerless to object. Registrants who had built their NGO or brand on their *.org domain name for many years cannot just move to another TLD or gTLD. And worst of all, entities like the Domain Name Association (who I do not intend to speak ill of, I am just using DNA here because it is a recent and relevant case study) were not looking to implement this ‘voluntary’ agreement with just one registrar, they were looking for it to affect multiple registries and registrars, thus further hindering consumer choice. Other examples that come to mind include the MPAA’s Trusted Notifier Program with Donuts. Chuck - it’s for all these reasons (inadequate consultation, little recourse, inconsistent application) that I find ‘voluntary’ agreements, be they between registrars, hosting providers, or another party, to be problematic and something that this WG shouldn’t be supporting. I would prefer that we recommend, where appropriate, the formation of new Policy Development Processes within the ICANN ecosystem where the subject can be transparently and comprehensively evaluated by all impacted and interested stakeholders prior to a decision being made. Best wishes, Ayden Férdeline [linkedin.com/in/ferdeline](http://www.linkedin.com/in/ferdeline) -------- Original Message -------- Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Local Time: 25 February 2017 12:43 PM UTC Time: 25 February 2017 12:43 From: cgomes@verisign.com To: stephanie.perrin@mail.utoronto.ca <stephanie.perrin@mail.utoronto.ca>, gnso-rds-pdp-wg@icann.org <gnso-rds-pdp-wg@icann.org> Stephanie. I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion. Chuck [ ] From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Stephanie Perrin Sent: Friday, February 24, 2017 10:23 PM To: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive. Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck [<cgomes@verisign.com>](mailto:cgomes@verisign.com) Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: - "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. - Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript Follow LegitScript: [LinkedIn](http://www.linkedin.com/company/legitscript-com) | [Facebook](https://www.facebook.com/LegitScript) | [Twitter](https://twitter.com/legitscript) | [Blog](http://blog.legitscript.com) | [Google+](https://plus.google.com/112436813474708014933/posts) On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote: John, Can you clarify what you want a ruling on? Chuck [ ] From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. - I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) - I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript Follow LegitScript: [LinkedIn](http://www.linkedin.com/company/legitscript-com) | [Facebook](https://www.facebook.com/LegitScript) | [Twitter](https://twitter.com/legitscript) | [Blog](http://blog.legitscript.com) | [Google+](https://plus.google.com/112436813474708014933/posts) On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. [+353 (0) 59 9183072](tel:%2B353%20%280%29%2059%20%209183072) Direct Dial: [+353 (0)59 9183090](tel:%2B353%20%280%2959%209183090) Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight:
Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. [+353 (0) 59 9183072](tel:%2B353%20%280%29%2059%20%209183072) Direct Dial: [+353 (0)59 9183090](tel:%2B353%20%280%2959%209183090) Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight:
Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. [ +353 (0) 59 9183072](tel:%2B353%20%280%29%2059%20%209183072) Direct Dial: [ +353 (0)59 9183090](tel:%2B353%20%280%2959%209183090) Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: [ gnso-rds-pdp-wg-bounces@icann.org](mailto:gnso-rds-pdp-wg-bounces@icann.org) [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
[ http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin](http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin) g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: [+46.42197080](tel:%2B46.42197080) Direct: [+47.32260201](tel:%2B47.32260201) Mobile: [+47.40410200](tel:%2B47.40410200)
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: [ https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C](https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C)
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. [ +353 (0) 59 9183072](tel:%2B353%20%280%29%2059%20%209183072) Direct Dial: [ +353 (0)59 9183090](tel:%2B353%20%280%2959%209183090) Personal blog: [ https://michele.blog/](https://michele.blog/) Some thoughts: [ https://ceo.hosting/](https://ceo.hosting/) ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list [ gnso-rds-pdp-wg@icann.org](mailto:gnso-rds-pdp-wg@icann.org) [ https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg](https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg)
gnso-rds-pdp-wg mailing list [ gnso-rds-pdp-wg@icann.org](mailto:gnso-rds-pdp-wg@icann.org) [ https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg](https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg)
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org [ https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg](https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg)
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: [ vgreimann@key-systems.net](mailto:vgreimann@key-systems.net)
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: [ vgreimann@key-systems.net](mailto:vgreimann@key-systems.net)
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org [ https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg](https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg)
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [ +49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [ +49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [+49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [+49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: [+49 (0) 6894 - 9396 901](tel:%2B49%20%280%29%206894%20-%209396%20901) Fax.: [+49 (0) 6894 - 9396 851](tel:%2B49%20%280%29%206894%20-%209396%20851) Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Replies inline. Greg *Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com On Sat, Feb 25, 2017 at 8:01 AM, Ayden Férdeline <icann@ferdeline.com> wrote:
+1 Stephanie
I am sympathetic to the position which Kiran argues, because in theory I can see how voluntary agreements could be a useful way to avoid heavy-handed regulation which helps no one.
I'm glad you can see how voluntary agreements can be useful. Hold onto that thought.
BUT what we have seen in practice is very different. I’m thinking here about things like the Systematic Copyright Alternative Dispute Resolution Policy which the Public Interest Registry developed with the Domain Name Association.
We've seen nothing of the SCADRP "in practice." It hasn't been put into practice. It’s implementation has now been “paused”, but it was developed without adequate input from those stakeholders who would be most impacted by it. I don't have much information on what input was received and whether it was adequate. Clearly, a number of people/entities within two groups of "stakeholders who would be most impacted by it" did participate in its development -- Contracted Parties and those victimized by systemic copyright infringement -- copyright holders. I suppose there was not "adequate input" from the other group of "stakeholders who would be most impacted by it: systemic copyright infringers -- those who engage in pervasive copyright infringement or run sites whose primary purpose is distribution of infringing material. How would you propose getting "adequate input from those stakeholders"? I know that intentions here were good, and I fully acknowledge that there are challenges involved in enforcing existing laws on copyright in online environments. Once again I'm glad to see that you recognize the positive intentions and the challenges faced by registries, registrars and others who receive complaints, and by the creative community and those who distribute the authorized copies of their creative output. Hold onto that thought as well. But this ‘voluntary’ agreement did not provide registrants with sufficient rights in a process which could see them loose their domain name. This is directly contradicted by the proposal itself. The proposal states that a key element is "ensuring that Registrants’ due process rights are observed." The "clear and convincing" evidence standard is only one element of that -- this is a higher evidentiary standard than nearly all civil litigation -- and higher than that of the UDRP. And it’s a slippery slope — if you can loose your domain name because of copyright-infringing content (which the registrant may not have even uploaded themselves), what’s next? First, the SCADRP does not apply to garden variety "copyright-infringing content"; it only applies to "pervasive" copyright infringement and sites where the "primary purpose" is distributing copyright-infringing materials. So even the case at the top of your "slippery slope" is not one that will happen. "Slippery slope" arguments , like this one, that rely on false equivalencies and a parade of horribles concocted by the maker of the argument without any basis in fact tend to leave me cold. Loosing your domain name because it hosts “fake news”? Distributing or hosting systemic copyright infringement in violation of the law is not equivalent to hosting "fake news." I don't know of any law against "fake news" as such, and I'm not sure who the complainant would be if there was one. And nobody has proposed a Fake News DRP (unless I missed something). A "fake news" site might violate the Terms of Service of the registry, registrar or hosting provider, in which case it will likely be taken down when the TOS violation becomes known to the contracted party or hosting company (assuming they agree that it's "fake news"). If so, the registrant can look for another service provider who has no problem with "fake news" sites. Undesirable political speech? Again, not equivalent to illegal copyright infringement and nobody has proposed a DRP for this. I don't know who would support such a thing, but I'm confident that potential complainants under the SCADRP are not among them -- those who create, own and distribute copyrighted creative works depend on freedom of expression -- the ability to distribute their "speech" even if it is undesirable or unpopular or unsettling. Associating efforts to control systemic copyright infringement with banning undesirable political speech is ridiculous -- copyright protects the ability of a speaker to choose when they "speak" and when they don't "speak": the exact opposite of third party efforts to silence speech. Had this policy been implemented, those that had the most to loose - the registrant and their domain name - would have been powerless to object. While I don't think we need to have a competition about who has "the most to loose [sic]." The loss of billions of dollars every year to systemic and pervasive copyright infringement seems like a heavy loss. I find it hard to be sympathetic with those who engage in systemic and pervasive distribution of thing that are not theirs to distribute -- whether they are "fences" or sellers of "hot" cars or operators of websites or domain names used for pervasive copyright infringement. The copyright infringers can always object "with their feet" and move to a different registry that did not adopt the Copyright DRP (many of those engaged in systemic and pervasive copyright infringement have a number of domain names as part of their business model anyway). Or they can object by raising a hue and cry. While I don't believe we have heard from the systemic copyright infringement stakeholder community in the current discussion, perhaps we will. Registrants who had built their NGO or brand on their *.org domain name for many years cannot just move to another TLD or gTLD. Can you provide an example of a "registrant who built their NGO or brand on their *.org domain name for many years" and who is engaged in pervasive copyright infringement or running a website with the primary purpose of distributing apparently copyright-infringing materials? If this were a Venn diagram, I think these two circles would not overlap. As such, this proposal is irrelevant to "registrants who built their NGO or brand on their *.org domain name for many years." And if there are a few of those who also engage in systemic copyright infringement, I again find it hard to be sympathetic. And worst of all, entities like the Domain Name Association (who I do not intend to speak ill of, I am just using DNA here because it is a recent and relevant case study) were not looking to implement this ‘voluntary’ agreement with just one registrar, they were looking for it to affect multiple registries and registrars, thus further hindering consumer choice. I'm not sure if you have actually read the DNA proposal, since you seem to think it applies to registrars (and you failed to note the commitment to due process, among other registrant protections). The DNA program only applies to registries. In any event, the program is voluntary (no quotes needed) and I'm sure some registries will not adopt it, perhaps seeking to cater to the systemic copyright infringement community (not a consumer group I tend to see identified as such) or for other reasons. The flip side of "consumer choice" is "provider choice," which this proposal supplies to registries. Other examples that come to mind include the MPAA’s Trusted Notifier Program with Donuts. Another example of what? A voluntary program? Something you don't like?
Chuck - it’s for all these reasons (inadequate consultation, little recourse, inconsistent application) that I find ‘voluntary’ agreements, be they between registrars, hosting providers, or another party, to be problematic and something that this WG shouldn’t be supporting.
I don't believe that anyone suggested that this WG support the HDI or PIR proposals. I don't even think anyone has asked this WG to opine on these proposals -- which makes perfect sense, since these proposals are entirely outside this WG's remit. (Also, other than "inadequate consultation" with and "little recourse" by the copyright infringement community, the "all these reasons" in your parenthetical are not really elucidated here (particularly, "inconsistent application," whatever that is intended to mean).)
I would prefer that we recommend, where appropriate, the formation of new Policy Development Processes within the ICANN ecosystem where the subject can be transparently and comprehensively evaluated by all impacted and interested stakeholders prior to a decision being made.
Again, it's entirely outside the scope of this WG to recommend anything in this situation. Also, I'm a bit surprised to see a suggestion that a GNSO PDP should be formed specifically to deal with the substance and procedures of copyright dispute resolution. I'm not sure if I object, but the clear message over the last few years has been that the details of systems to deal with copyright dispute resolution are better dealt with outside the ICANN ecosystem. I'm just surprised to see the about-face. Nonetheless, even if the ICANN community wants to get into the business of fashioning copyright dispute resolution procedures, there's nothing that prevents registries and registrars from independently doing so as well. Who knows -- maybe we will have "consumer choice" between two different models of copyright DRP! Best regards, Greg
Best wishes,
Ayden Férdeline linkedin.com/in/ferdeline <http://www.linkedin.com/in/ferdeline>
-------- Original Message -------- Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Local Time: 25 February 2017 12:43 PM UTC Time: 25 February 2017 12:43 From: cgomes@verisign.com To: stephanie.perrin@mail.utoronto.ca <stephanie.perrin@mail.utoronto.ca>, gnso-rds-pdp-wg@icann.org <gnso-rds-pdp-wg@icann.org>
Stephanie.
I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion.
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *Stephanie Perrin *Sent:* Friday, February 24, 2017 10:23 PM *To:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.
Stephanie Perrin
On 2017-02-24 18:09, Gomes, Chuck wrote:
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
*From:* John Horton [mailto:john.horton@legitscript.com <john.horton@legitscript.com>] *Sent:* Friday, February 24, 2017 11:12 AM *To:* Gomes, Chuck <cgomes@verisign.com> <cgomes@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name
, and determining "registrar obligations" in response to those abuse complaints.
1. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint."
Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't *apropos.* If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript
*Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *John Horton *Sent:* Friday, February 24, 2017 8:41 AM *To:* Volker Greimann <vgreimann@key-systems.net> *Cc:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek < marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/ 2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I was merely registering the fact that in general, the NCSG has become concerned when contracted parties, either in consultation with ICANN's compliance department, or on their own, develop best practices outside the regular PDP process. I think Ayden responded with a good example, and while I appreciate the detail into which Greg went in taking apart Ayden's argument, I think it is a wee bit misplaced at the moment. This is getting off topic. Simply put, 1. John Horton asked if it was within our remit to establish the chain of authority in cases of abuse, and whether we should develop a best practice guide in how to pursue a complaint. (given that ICANN has no authority over hosting providers, I would suggest that the answer to that is no) 2, You responded that we could make recommendations about how to pursue a complaint, for use on a voluntary basis. 3. While I don't question the relatively innocuous nature of the suggestion, and the fact that such a guide would doubtless be useful and helpful given the complexity of the chain of responsibiilty described below, I am merely giving early warning that the NCSG is concerned about "voluntary best practices". Stephanie Perrin On 2017-02-25 07:43, Gomes, Chuck wrote:
Stephanie.
I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion.
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Stephanie Perrin *Sent:* Friday, February 24, 2017 10:23 PM *To:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.
Stephanie Perrin
On 2017-02-24 18:09, Gomes, Chuck wrote:
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
*From:*John Horton [mailto:john.horton@legitscript.com] *Sent:* Friday, February 24, 2017 11:12 AM *To:* Gomes, Chuck <cgomes@verisign.com> <mailto:cgomes@verisign.com> *Cc:* vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name
, and determining "registrar obligations" in response to those abuse complaints.
2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint."
Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't /apropos./ If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com <mailto:cgomes@verisign.com>> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *John Horton *Sent:* Friday, February 24, 2017 8:41 AM *To:* Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> *Cc:* gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se <mailto:benny@nordreg.se> [mailto:benny@nordreg.se <mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com <mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se <mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 <tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ <https://michele.blog/> > > >>> Some thoughts: https://ceo.hosting/ <https://ceo.hosting/> > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu <http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> > www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> > www.twitter.com/key_systems <http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu <http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
Thanks for the good response Stephanie. Your early warning is taken. Any consideration of best practices will require us to remember it and evaluate it diligently. Chuck From: Stephanie Perrin [mailto:stephanie.perrin@mail.utoronto.ca] Sent: Sunday, February 26, 2017 12:03 AM To: Gomes, Chuck <cgomes@verisign.com>; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I was merely registering the fact that in general, the NCSG has become concerned when contracted parties, either in consultation with ICANN's compliance department, or on their own, develop best practices outside the regular PDP process. I think Ayden responded with a good example, and while I appreciate the detail into which Greg went in taking apart Ayden's argument, I think it is a wee bit misplaced at the moment. This is getting off topic. Simply put, 1. John Horton asked if it was within our remit to establish the chain of authority in cases of abuse, and whether we should develop a best practice guide in how to pursue a complaint. (given that ICANN has no authority over hosting providers, I would suggest that the answer to that is no) 2, You responded that we could make recommendations about how to pursue a complaint, for use on a voluntary basis. 3. While I don't question the relatively innocuous nature of the suggestion, and the fact that such a guide would doubtless be useful and helpful given the complexity of the chain of responsibiilty described below, I am merely giving early warning that the NCSG is concerned about "voluntary best practices". Stephanie Perrin On 2017-02-25 07:43, Gomes, Chuck wrote: Stephanie. I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion. Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Stephanie Perrin Sent: Friday, February 24, 2017 10:23 PM To: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive. Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com><mailto:cgomes@verisign.com> Cc: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: 1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. 2. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com<mailto:cgomes@verisign.com>> wrote: John, Can you clarify what you want a ruling on? Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...> Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> <https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace...> <https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&r...> On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
We don't need to get caught up as a WG in "best practices," which is just a rabbit-hole. Personally, what I think is needed is education and readily available resources, in plain English (and the other ICANN languages). Better practices will result from better-informed people on all sides of the equation. The more facts we can supply to more people, the better off we all are. How many of us have talked to generally well-informed people who consider themselves "Internet-savvy," yet they don't know where gTLDs come from (the stork?), the difference between a registry and a registrar, the difference between a registrar and a reseller, a domain name and a website and an email address, etc., etc.? Add to this people who have bad information (which can be worse than no information at all). So many people who actually interface with this "structure" need to know much more than they do (and/or correct the misinformation and misconceptions they have). Sub-optimal practices often come from ignorance, not a reasoned choice to act in a sub-optimal manner (though that happens too...). The other part of the education equation is to figure out where the target audience (people who need to be better informed) gets their information from. For most, it's not the ICANN website. It's something local to them, where the get general business or technical information -- their employer, a trade association, a blog, Facebook, etc., etc. We need to educate people where they are -- "build it and they will come" will not reach anyone other than the most enthusiastic or proactive. Anyway, this is probably off-topic at this point, but my point is that we don't need to worry about "best practices" or other voluntary or proscriptive activities. If we can better educate the average person who comes in contact with the structure behind the websites and emails they interact with, the concerns that lead to these questions will diminish greatly. Greg *Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com On Sun, Feb 26, 2017 at 8:14 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
Thanks for the good response Stephanie. Your early warning is taken. Any consideration of best practices will require us to remember it and evaluate it diligently.
Chuck
*From:* Stephanie Perrin [mailto:stephanie.perrin@mail.utoronto.ca] *Sent:* Sunday, February 26, 2017 12:03 AM *To:* Gomes, Chuck <cgomes@verisign.com>; gnso-rds-pdp-wg@icann.org
*Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I was merely registering the fact that in general, the NCSG has become concerned when contracted parties, either in consultation with ICANN's compliance department, or on their own, develop best practices outside the regular PDP process. I think Ayden responded with a good example, and while I appreciate the detail into which Greg went in taking apart Ayden's argument, I think it is a wee bit misplaced at the moment. This is getting off topic.
Simply put,
1. John Horton asked if it was within our remit to establish the chain of authority in cases of abuse, and whether we should develop a best practice guide in how to pursue a complaint. (given that ICANN has no authority over hosting providers, I would suggest that the answer to that is no)
2, You responded that we could make recommendations about how to pursue a complaint, for use on a voluntary basis.
3. While I don't question the relatively innocuous nature of the suggestion, and the fact that such a guide would doubtless be useful and helpful given the complexity of the chain of responsibiilty described below, I am merely giving early warning that the NCSG is concerned about "voluntary best practices".
Stephanie Perrin
On 2017-02-25 07:43, Gomes, Chuck wrote:
Stephanie.
I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion.
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org <gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *Stephanie Perrin *Sent:* Friday, February 24, 2017 10:23 PM *To:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.
Stephanie Perrin
On 2017-02-24 18:09, Gomes, Chuck wrote:
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
*From:* John Horton [mailto:john.horton@legitscript.com <john.horton@legitscript.com>] *Sent:* Friday, February 24, 2017 11:12 AM *To:* Gomes, Chuck <cgomes@verisign.com> <cgomes@verisign.com> *Cc:* vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
1. "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name
, and determining "registrar obligations" in response to those abuse complaints.
1. Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint."
Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't *apropos.* If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript
*Follow* *Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
*From:* gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] *On Behalf Of *John Horton *Sent:* Friday, February 24, 2017 8:41 AM *To:* Volker Greimann <vgreimann@key-systems.net> *Cc:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue).
Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
*Follow* *Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann < vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek < marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/ 2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I absolutely agree with Greg on this one. Education is key - but we need to begin with where people go for information. A Chamber of Commerce, a small business association, legal aid centres, consumer groups? Yes, off point, but at some point, an important piece of the puzzle Holly On 27 Feb 2017, at 6:31 am, Greg Shatan <gregshatanipc@gmail.com> wrote:
We don't need to get caught up as a WG in "best practices," which is just a rabbit-hole.
Personally, what I think is needed is education and readily available resources, in plain English (and the other ICANN languages).
Better practices will result from better-informed people on all sides of the equation. The more facts we can supply to more people, the better off we all are.
How many of us have talked to generally well-informed people who consider themselves "Internet-savvy," yet they don't know where gTLDs come from (the stork?), the difference between a registry and a registrar, the difference between a registrar and a reseller, a domain name and a website and an email address, etc., etc.? Add to this people who have bad information (which can be worse than no information at all).
So many people who actually interface with this "structure" need to know much more than they do (and/or correct the misinformation and misconceptions they have). Sub-optimal practices often come from ignorance, not a reasoned choice to act in a sub-optimal manner (though that happens too...).
The other part of the education equation is to figure out where the target audience (people who need to be better informed) gets their information from. For most, it's not the ICANN website. It's something local to them, where the get general business or technical information -- their employer, a trade association, a blog, Facebook, etc., etc. We need to educate people where they are -- "build it and they will come" will not reach anyone other than the most enthusiastic or proactive.
Anyway, this is probably off-topic at this point, but my point is that we don't need to worry about "best practices" or other voluntary or proscriptive activities. If we can better educate the average person who comes in contact with the structure behind the websites and emails they interact with, the concerns that lead to these questions will diminish greatly.
Greg
Greg Shatan C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com
On Sun, Feb 26, 2017 at 8:14 AM, Gomes, Chuck <cgomes@verisign.com> wrote: Thanks for the good response Stephanie. Your early warning is taken. Any consideration of best practices will require us to remember it and evaluate it diligently.
Chuck
From: Stephanie Perrin [mailto:stephanie.perrin@mail.utoronto.ca] Sent: Sunday, February 26, 2017 12:03 AM To: Gomes, Chuck <cgomes@verisign.com>; gnso-rds-pdp-wg@icann.org
Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I was merely registering the fact that in general, the NCSG has become concerned when contracted parties, either in consultation with ICANN's compliance department, or on their own, develop best practices outside the regular PDP process. I think Ayden responded with a good example, and while I appreciate the detail into which Greg went in taking apart Ayden's argument, I think it is a wee bit misplaced at the moment. This is getting off topic.
Simply put,
1. John Horton asked if it was within our remit to establish the chain of authority in cases of abuse, and whether we should develop a best practice guide in how to pursue a complaint. (given that ICANN has no authority over hosting providers, I would suggest that the answer to that is no)
2, You responded that we could make recommendations about how to pursue a complaint, for use on a voluntary basis.
3. While I don't question the relatively innocuous nature of the suggestion, and the fact that such a guide would doubtless be useful and helpful given the complexity of the chain of responsibiilty described below, I am merely giving early warning that the NCSG is concerned about "voluntary best practices".
Stephanie Perrin
On 2017-02-25 07:43, Gomes, Chuck wrote:
Stephanie.
I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion.
Chuck
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Stephanie Perrin Sent: Friday, February 24, 2017 10:23 PM To: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.
Stephanie Perrin
On 2017-02-24 18:09, Gomes, Chuck wrote:
Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’
As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis.
I ask staff and others to correct me if they think I am wrong on this.
Chuck
From: John Horton [mailto:john.horton@legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com> Cc: vgreimann@key-systems.net; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Chuck,
Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following:
"Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints.
Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar.
What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope.
Let me know if I'm not clearly summarizing what I'm asking you to rule on.
Thanks,
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote:
John,
Can you clarify what you want a ruling on?
Chuck
From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me provide a few comments on that.
I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data.
Am 20.02.2017 um 14:20 schrieb theo geurts:
Good point Michele,
RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts.
Theo
On 20-2-2017 12:24, Michele Neylon - Blacknight wrote:
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
FYIThe U.K. privacy office will issue guidance the first week of March for companies on obtaining consent from consumers to use their data, Information Commissioner Elizabeth Denham announced Feb. 24.The Information Commissioner’s Office guidance on preparing for the European Union’s new General Data Protection Regulation (GDPR) privacy regime will represent “a toughening up on the rules around consent,” Denham said.In order to be legally sufficient, consent “will need to be freely given, specific, informed and unambiguous, and businesses will need to be able to prove they have it if they rely on it for processing data,” she said. A check the box approach won’t be sufficient to show valid consent, Denham said. Nathalie On Sunday, February 26, 2017 5:17 PM, Holly Raiche <h.raiche@internode.on.net> wrote: I absolutely agree with Greg on this one. Education is key - but we need to begin with where people go for information. A Chamber of Commerce, a small business association, legal aid centres, consumer groups? Yes, off point, but at some point, an important piece of the puzzle Holly On 27 Feb 2017, at 6:31 am, Greg Shatan <gregshatanipc@gmail.com> wrote: We don't need to get caught up as a WG in "best practices," which is just a rabbit-hole. Personally, what I think is needed is education and readily available resources, in plain English (and the other ICANN languages). Better practices will result from better-informed people on all sides of the equation. The more facts we can supply to more people, the better off we all are. How many of us have talked to generally well-informed people who consider themselves "Internet-savvy," yet they don't know where gTLDs come from (the stork?), the difference between a registry and a registrar, the difference between a registrar and a reseller, a domain name and a website and an email address, etc., etc.? Add to this people who have bad information (which can be worse than no information at all). So many people who actually interface with this "structure" need to know much more than they do (and/or correct the misinformation and misconceptions they have). Sub-optimal practices often come from ignorance, not a reasoned choice to act in a sub-optimal manner (though that happens too...). The other part of the education equation is to figure out where the target audience (people who need to be better informed) gets their information from. For most, it's not the ICANN website. It's something local to them, where the get general business or technical information -- their employer, a trade association, a blog, Facebook, etc., etc. We need to educate people where they are -- "build it and they will come" will not reach anyone other than the most enthusiastic or proactive. Anyway, this is probably off-topic at this point, but my point is that we don't need to worry about "best practices" or other voluntary or proscriptive activities. If we can better educate the average person who comes in contact with the structure behind the websites and emails they interact with, the concerns that lead to these questions will diminish greatly. Greg GregShatan C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com On Sun, Feb 26, 2017 at 8:14 AM, Gomes, Chuck <cgomes@verisign.com> wrote: Thanks for the good response Stephanie. Your early warning is taken. Any consideration of best practices will require us to remember it and evaluate it diligently. Chuck From: Stephanie Perrin [mailto:stephanie.perrin@mail. utoronto.ca] Sent: Sunday, February 26, 2017 12:03 AM To: Gomes, Chuck <cgomes@verisign.com>; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I was merely registering the fact that in general, the NCSG has become concerned when contracted parties, either in consultation with ICANN's compliance department, or on their own, develop best practices outside the regular PDP process. I think Ayden responded with a good example, and while I appreciate the detail into which Greg went in taking apart Ayden's argument, I think it is a wee bit misplaced at the moment. This is getting off topic.Simply put, 1. John Horton asked if it was within our remit to establish the chain of authority in cases of abuse, and whether we should develop a best practice guide in how to pursue a complaint. (given that ICANN has no authority over hosting providers, I would suggest that the answer to that is no)2, You responded that we could make recommendations about how to pursue a complaint, for use on a voluntary basis.3. While I don't question the relatively innocuous nature of the suggestion, and the fact that such a guide would doubtless be useful and helpful given the complexity of the chain of responsibiilty described below, I am merely giving early warning that the NCSG is concerned about "voluntary best practices". Stephanie Perrin On 2017-02-25 07:43, Gomes, Chuck wrote: Stephanie. I am not at all clear about what you are concerned about here. I was simply responding to a question John asked about WG scope. ICANN org nor ICANN community has not asked or suggested that various contracted parties do anything in this regard. Various WG members have simply been sharing some ideas about education of users that might be helpful. I personally think it is pretty early to get concerned and that it would be better to wait until we see if this discussion goes anywhere. In the meantime I think it is important for WG members to float ideas for possible future consideration or not. We will filter them to make sure they are in scope; some will be pursued further and some not and the ones we pursue further will be vetted by the full WG so there will be plenty of opportunity to everyone to contribute. In particular, if and when the WG decides to consider any possible best practices, we will have to evaluate whether there might be risk of coercion. Chuck From:gnso-rds-pdp-wg-bounces@icann. org [mailto:gnso-rds-pdp-wg- bounces@icann.org]On Behalf Of Stephanie Perrin Sent: Friday, February 24, 2017 10:23 PM To: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I have not consulted my SG yet, but I think I can safely say that we are getting quite concerned about what ICANN is asking/suggesting its various contracted parties do on a voluntary basis. Best practice, particularly in an unregulated environment, becomes coercive.Stephanie Perrin On 2017-02-24 18:09, Gomes, Chuck wrote: Thanks for explaining John. Below is my opinion on ‘on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work.’ As someone else has already pointed out, ICANN has no relationship with hosting providers so it would be out of scope for consensus policy. But I don’t think that that would prevent the WG from making some recommendations along the lines that are being discussed that could be implemented on a voluntary basis. I ask staff and others to correct me if they think I am wrong on this. Chuck From: John Horton [mailto:john.horton@ legitscript.com] Sent: Friday, February 24, 2017 11:12 AM To: Gomes, Chuck <cgomes@verisign.com> Cc: vgreimann@key-systems.net;gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chuck, Sure. What I'm asking you to determine is whether it is within the ambit of this group's mission to do, or come to a consensus on, the following: - "Establish(ing) chains of responsibility in the data," in the context of submitting complaints or resolving issues with a website or domain name , and determining "registrar obligations" in response to those abuse complaints. - Either alternatively or simultaneously, developing or providing a "how to guide" or "guidance" "for going forward with a complaint." Concretely, I think the point is to formalize the notion that "registrars" shouldn't have to do the "hosting provider's job" and to "direct a lot of traffic away from the registrar." For example, one "chain of responsibility" that this group might seek to establish would be to direct, suggest or advise that a registrant should be contacted first, then the hosting provider, and only then the registrar. What I'm asking for is a determination on whether it's appropriate for this group to make a determination about this "chain of responsibility" as part of our work. From my perspective, it is outside the scope of our mission, so trying to discuss it, persuade each other or come to a consensus on it in this group isn't apropos. If this is something that is requested by the ICANN board as part of the RDS's group and any report we issue, or if it's appropriately within the ambit, it would be helpful to clarify that and also the scope. Let me know if I'm not clearly summarizing what I'm asking you to rule on. Thanks, John Horton President and CEO, LegitScript FollowLegitScript:LinkedIn | Facebook | Twitter | Blog | Google+ On Fri, Feb 24, 2017 at 6:53 AM, Gomes, Chuck <cgomes@verisign.com> wrote: John, Can you clarify what you want a ruling on? Chuck From:gnso-rds-pdp-wg-bounces@icann. org [mailto:gnso-rds-pdp-wg- bounces@icann.org]On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. - I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) - I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript FollowLegitScript:LinkedIn | Facebook | Twitter | Blog | Google+ On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------ - Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------ - > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------ - > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@ icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@ icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann. org > > >> [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/ 2017/02/16/control-block-sms- spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/ CompanyDetails.aspx?id=480317& type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------ - > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> ______________________________ _________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > >> ______________________________ _________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > ______________________________ _________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net /www.RRPproxy.net > > www.domaindiscount24.com /www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > ------------------------------ -------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net /www.RRPproxy.net > > www.domaindiscount24.com /www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > ______________________________ _________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net /www.RRPproxy.net > www.domaindiscount24.com /www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > ------------------------------ -------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net /www.RRPproxy.net > www.domaindiscount24.com /www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. ------------------------------ -------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. ------------------------------ -------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net /www.RRPproxy.net www.domaindiscount24.com /www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg ______________________________ _________________gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
+1 From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Friday, February 24, 2017 8:41 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Let me provide a few comments on that. 1. I like Volker's idea of including hosting details in the ultimate RDS. It's additional information, which may be useful to the viewer. From a concrete use-case perspective, when I or one of my analysts is evaluating whether a merchant should be boarded with a bank or rejected based on risk, it's certainly one of the details we look it. (I'm not sure it's technically "registration data," but not sure if that matters.) 2. I object to using the RDS (or this group) to establish chains or a hierarchy of responsibility as being outside of our scope and mandate. (Chuck, maybe we can get a ruling on that?) I realize that there are members of this group who believe that a complainant should always go to the registrant first, then the host, and only the registrar as a last resort (some believe never). But that's not how everyone feels. Others believe it should be the payment processor first. Still others believe the registrar should be the first point of contact for a complaint. Still others believe there is no hierarchy and it's a case-by-case solution and all facilitators are equally valid points of contact. My point is not to get into an argument about who is right there (I and I'm sure many others don't have the time, and many of us have discussed this elsewhere); I simply don't think we should be using this group to try and resolve that particular issue, or impose some sort of a structure on internet users, because I think it's probably outside the scope of our mandate (and I will strongly note that I don't think there's consensus on that issue). Chuck, if I'm wrong and it's inside the scope of our mandate to use the RDS to establish a structure about who a complainant should approach first, second, third, fourth, etc. let us know, but if it's in scope, that's going to be a somewhat different discussion. Again, my objective here isn't to launch another 100-email debate about who is right or wrong; my objective is to argue that a) the idea of including hosting information in the RDS seems like a pretty reasonable one, but b) doing that in order to impose rules on internet users on what complaint hierarchy they should follow is out of scope for our mandate. John Horton President and CEO, LegitScript [Image removed by sender.] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [Image removed by sender.][Image removed by sender.] On Fri, Feb 24, 2017 at 4:35 AM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: So should we maybe include hosting details in the ultimate RDS? These would have to be supplied differently, but it would make sense if we want to establish chains of responsibility in the data. Am 20.02.2017 um 14:20 schrieb theo geurts: Good point Michele, RDS should be a facilitating here in the sense that reports end up at the correct party and yet give the reporter a logical natural flow in creating the report without creating confusion with different set of contacts. Theo On 20-2-2017 12:24, Michele Neylon - Blacknight wrote: Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se<mailto:benny@nordreg.se>] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080<tel:%2B46.42197080> > > >> Direct: +47.32260201<tel:%2B47.32260201> > > >> Mobile: +47.40410200<tel:%2B47.40410200> > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> > > >>> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> > Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901<tel:%2B49%20%280%29%206894%20-%209396%20901> Fax.: +49 (0) 6894 - 9396 851<tel:%2B49%20%280%29%206894%20-%209396%20851> Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris From: "Michele Neylon" <michele@blacknight.com> To: "Volker Greimann" <vgreimann@key-systems.net>, "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 11:24:53 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight:
Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight:
Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [mailto:benny@nordreg.se] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
THanks Chris, this is a very useful summary for those of us who are not dealing with such requests on a daily basis as you guys are. Very helpful. Stephanie Perrin On 2017-02-20 08:32, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------ *From: *"Michele Neylon" <michele@blacknight.com> *To: *"Volker Greimann" <vgreimann@key-systems.net>, "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> *Sent: *Monday, 20 February, 2017 11:24:53 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not.
As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar.
Best,
Volker
Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > >
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*/due diligence/*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a */DumbOne’s Guide to DNS Complaints/* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------ < rest deleted >
Policies recommending education are possible as long as they are within ICANN's mission and our charter so let's keep that in mind when we get to Phase 2. In the meantime, we might consider requirements for education. There is probably no way to force education on users and registrants but it is probably reasonable to make educational materials easily available and encourage their usage. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Sam Lanfranco Sent: Monday, February 20, 2017 9:39 AM To: Chris Pelling <chris@netearth.net>; Michele Neylon <michele@blacknight.com> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say "The problem is from the takedown / infringement requests we see, 1, 2 and 3 [due diligence] are not even thought of, so part of this is education." Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the "good works" area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more "financier" who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the "good works" people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne's Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris _____ < rest deleted >
Chuck, Just a quick follow up. The "education" call here goes well beyond ICANN's mission, its scope of remit, or our rds-pdp-wg charter. It needs to be done somewhere beyond ICANN. But ICANN can flag that it is something that needs to be done for good citizenship in the Internet ecosystem. Back to the car analogy, ICANN is designing the roads, access points, the lanes, and the signage, but someone else has to educate domain name owners and complainants about how to properly drive to their destinations. Sam L. On 2/20/2017 9:57 AM, Gomes, Chuck wrote:
Policies recommending education are possible as long as they are within ICANN’s mission and our charter so let’s keep that in mind when we get to Phase 2. In the meantime, we might consider requirements for education. There is probably no way to force education on users and registrants but it is probably reasonable to make educational materials easily available and encourage their usage.
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Sam Lanfranco *Sent:* Monday, February 20, 2017 9:39 AM *To:* Chris Pelling <chris@netearth.net>; Michele Neylon <michele@blacknight.com> *Cc:* gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*/due diligence/*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a */DumbOne’s Guide to DNS Complaints/* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------
< rest deleted >
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Well said Sam. Chuck From: Sam Lanfranco [mailto:sam@lanfranco.net] Sent: Monday, February 20, 2017 10:14 AM To: Gomes, Chuck <cgomes@verisign.com>; chris@netearth.net; michele@blacknight.com Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Chuck, Just a quick follow up. The "education" call here goes well beyond ICANN's mission, its scope of remit, or our rds-pdp-wg charter. It needs to be done somewhere beyond ICANN. But ICANN can flag that it is something that needs to be done for good citizenship in the Internet ecosystem. Back to the car analogy, ICANN is designing the roads, access points, the lanes, and the signage, but someone else has to educate domain name owners and complainants about how to properly drive to their destinations. Sam L. On 2/20/2017 9:57 AM, Gomes, Chuck wrote: Policies recommending education are possible as long as they are within ICANN’s mission and our charter so let’s keep that in mind when we get to Phase 2. In the meantime, we might consider requirements for education. There is probably no way to force education on users and registrants but it is probably reasonable to make educational materials easily available and encourage their usage. Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Sam Lanfranco Sent: Monday, February 20, 2017 9:39 AM To: Chris Pelling <chris@netearth.net><mailto:chris@netearth.net>; Michele Neylon <michele@blacknight.com><mailto:michele@blacknight.com> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [due diligence] are not even thought of, so part of this is education.” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne’s Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris _____ < rest deleted > -- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
HI Sam, Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success. IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ? I appreciate this is a totally different situation and requirement, but, its just a thought :) Kind regards, Chris From: "Sam Lanfranco" <sam@lanfranco.net> To: "chris" <chris@netearth.net>, "Michele Neylon" <michele@blacknight.com> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 14:38:40 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [ due diligence ] are not even thought of, so part of this is education .” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne’s Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris < rest deleted >
That *was* a good event (the Dublin public safety/registrars event). John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net> wrote:
HI Sam,
Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success.
IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ?
I appreciate this is a totally different situation and requirement, but, its just a thought :)
Kind regards,
Chris
------------------------------ *From: *"Sam Lanfranco" <sam@lanfranco.net> *To: *"chris" <chris@netearth.net>, "Michele Neylon" < michele@blacknight.com> *Cc: *"gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> *Sent: *Monday, 20 February, 2017 14:38:40 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*due diligence*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a *DumbOne’s Guide to DNS Complaints* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------
< rest deleted >
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Maybe punt until we’re somewhere a bit more affordable? Copenhagen is going to be pricey ☺ -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: <gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> Date: Monday 20 February 2017 at 16:43 To: Chris Pelling <chris@netearth.net> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois That was a good event (the Dublin public safety/registrars event). John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net<mailto:chris@netearth.net>> wrote: HI Sam, Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success. IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ? I appreciate this is a totally different situation and requirement, but, its just a thought :) Kind regards, Chris ________________________________ From: "Sam Lanfranco" <sam@lanfranco.net<mailto:sam@lanfranco.net>> To: "chris" <chris@netearth.net<mailto:chris@netearth.net>>, "Michele Neylon" <michele@blacknight.com<mailto:michele@blacknight.com>> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Sent: Monday, 20 February, 2017 14:38:40 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [due diligence] are not even thought of, so part of this is education.” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne’s Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris ________________________________ < rest deleted > _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
If whoever came stuck their hand in their pocket for say 10 or 20 bucks, we could see if we could do a deal with a pub. It was only a thought :) Kind regards, Chris From: "Michele Neylon" <michele@blacknight.com> To: "John Horton" <john.horton@legitscript.com>, "chris" <chris@netearth.net> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 16:52:18 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Maybe punt until we’re somewhere a bit more affordable? Copenhagen is going to be pricey J -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: <gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> Date: Monday 20 February 2017 at 16:43 To: Chris Pelling <chris@netearth.net> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois That was a good event (the Dublin public safety/registrars event). John Horton President and CEO, LegitScript Follow Legit Script : LinkedIn | Facebook | Twitter | Blog | Google+ On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling < chris@netearth.net > wrote: HI Sam, Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success. IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ? I appreciate this is a totally different situation and requirement, but, its just a thought :) Kind regards, Chris From: "Sam Lanfranco" < sam@lanfranco.net > To: "chris" < chris@netearth.net >, "Michele Neylon" < michele@blacknight.com > Cc: "gnso-rds-pdp-wg" < gnso-rds-pdp-wg@icann.org > Sent: Monday, 20 February, 2017 14:38:40 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [ due diligence ] are not even thought of, so part of this is education .” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne’s Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: BQ_BEGIN I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris < rest deleted > _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END
Lets shoot for Johannesburg. Theo On 20-2-2017 17:52, Michele Neylon - Blacknight wrote:
Maybe punt until we’re somewhere a bit more affordable?
Copenhagen is going to be pricey J
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *<gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> *Date: *Monday 20 February 2017 at 16:43 *To: *Chris Pelling <chris@netearth.net> *Cc: *gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
That /was/ a good event (the Dublin public safety/registrars event).
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net <mailto:chris@netearth.net>> wrote:
HI Sam,
Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success.
IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ?
I appreciate this is a totally different situation and requirement, but, its just a thought :)
Kind regards,
Chris
------------------------------------------------------------------------
*From: *"Sam Lanfranco" <sam@lanfranco.net <mailto:sam@lanfranco.net>> *To: *"chris" <chris@netearth.net <mailto:chris@netearth.net>>, "Michele Neylon" <michele@blacknight.com <mailto:michele@blacknight.com>> *Cc: *"gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> *Sent: *Monday, 20 February, 2017 14:38:40 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*/due diligence/*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a */DumbOne’s Guide to DNS Complaints/* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------
< rest deleted >
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
If / when this is set up. I'm happy to share with you how we approach these issues at RIAA. Sent from my iPhone On Feb 20, 2017, at 11:43 AM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote: Lets shoot for Johannesburg. Theo On 20-2-2017 17:52, Michele Neylon - Blacknight wrote: Maybe punt until we’re somewhere a bit more affordable? Copenhagen is going to be pricey ☺ -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: <gnso-rds-pdp-wg-bounces@icann.org><mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com><mailto:john.horton@legitscript.com> Date: Monday 20 February 2017 at 16:43 To: Chris Pelling <chris@netearth.net><mailto:chris@netearth.net> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois That was a good event (the Dublin public safety/registrars event). John Horton President and CEO, LegitScript [https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&r...] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> [https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png][https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ] On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net<mailto:chris@netearth.net>> wrote: HI Sam, Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success. IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ? I appreciate this is a totally different situation and requirement, but, its just a thought :) Kind regards, Chris ________________________________ From: "Sam Lanfranco" <sam@lanfranco.net<mailto:sam@lanfranco.net>> To: "chris" <chris@netearth.net<mailto:chris@netearth.net>>, "Michele Neylon" <michele@blacknight.com<mailto:michele@blacknight.com>> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Sent: Monday, 20 February, 2017 14:38:40 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Chris, Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [due diligence] are not even thought of, so part of this is education.” Good idea. How do we get there from here? As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook. An effective educational strategy is clearly needed here. That may include a DumbOne’s Guide to DNS Complaints (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining. Sam L. On 2/20/2017 8:32 AM, Chris Pelling wrote: I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris ________________________________ < rest deleted > _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Sounds good Victoria, thanks! Theo On 20-2-2017 20:48, Victoria Sheckler wrote:
If / when this is set up. I'm happy to share with you how we approach these issues at RIAA.
Sent from my iPhone
On Feb 20, 2017, at 11:43 AM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote:
Lets shoot for Johannesburg.
Theo
On 20-2-2017 17:52, Michele Neylon - Blacknight wrote:
Maybe punt until we’re somewhere a bit more affordable?
Copenhagen is going to be pricey J
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *<gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> *Date: *Monday 20 February 2017 at 16:43 *To: *Chris Pelling <chris@netearth.net> *Cc: *gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
That /was/ a good event (the Dublin public safety/registrars event).
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net <mailto:chris@netearth.net>> wrote:
HI Sam,
Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success.
IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ?
I appreciate this is a totally different situation and requirement, but, its just a thought :)
Kind regards,
Chris
------------------------------------------------------------------------
*From: *"Sam Lanfranco" <sam@lanfranco.net <mailto:sam@lanfranco.net>> *To: *"chris" <chris@netearth.net <mailto:chris@netearth.net>>, "Michele Neylon" <michele@blacknight.com <mailto:michele@blacknight.com>> *Cc: *"gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> *Sent: *Monday, 20 February, 2017 14:38:40 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*/due diligence/*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a */DumbOne’s Guide to DNS Complaints/* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------
< rest deleted >
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
As someone who does a fair amount of infringement/takedown work, Chris's chain is pretty much like what I was going to type in before I saw his email, at least for the usual IP infringement matters. When it comes to phishing/spam/fraud domains and sites (often siteless domains being used to support a typosquatted email account), there's not much point in contacting the registrant (but there I will often contact LEA). The registrar is rarely, if ever, the first call or even the second (if the registrant is not, e.g., Donald Duck at 123 Fake Street) (maybe for a siteless typosquat supporting phishing/fraud emails, and even there one needs to get to the email provider first (although I've had one case where the sender and the email provider were both buried behind various anonymizing methods, beyond my ability to penetrate)). A reasonably well-documented complaint is a must, of course. I think this is true of the colleagues I know (attorney and non-attorneys) and have worked with, as well. Unfortunately, there are plenty of non-specialists (attorneys and others) who will take care of these kinds of matters and they will go to the bright shiny object of the registrar with the abuse contact number. It looks easy, and why give away work you think you can do yourself. Training and education could come out of the IP or other relevant communities, or out of non-ICANN cooperative measures akin to the Healthy Domains Initiative. Of course, there's already a fair amount of education out there for anyone who wants to know how to pursue these matters appropriately, but the problem is there's no one place that all of us on both sides of the complainant/recipient dyad can point to and say "read this and do what it says before you send another [adjective] complaint to a [adjective] registrar." (Of course, there are plenty of nuances, exceptions and tricks of the trade, but the basics are pretty ... basic.) Greg Shatan *Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com On Mon, Feb 20, 2017 at 2:59 PM, theo geurts <gtheo@xs4all.nl> wrote:
Sounds good Victoria, thanks!
Theo On 20-2-2017 20:48, Victoria Sheckler wrote:
If / when this is set up. I'm happy to share with you how we approach these issues at RIAA.
Sent from my iPhone
On Feb 20, 2017, at 11:43 AM, theo geurts <gtheo@xs4all.nl> wrote:
Lets shoot for Johannesburg.
Theo
On 20-2-2017 17:52, Michele Neylon - Blacknight wrote:
Maybe punt until we’re somewhere a bit more affordable?
Copenhagen is going to be pricey J
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072 <+353%2059%20918%203072>
Direct Dial: +353 (0)59 9183090 <+353%2059%20918%203090>
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *<gnso-rds-pdp-wg-bounces@icann.org> <gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> <john.horton@legitscript.com> *Date: *Monday 20 February 2017 at 16:43 *To: *Chris Pelling <chris@netearth.net> <chris@netearth.net> *Cc: *gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> <gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
That *was* a good event (the Dublin public safety/registrars event).
John Horton President and CEO, LegitScript
*Follow* *Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts>
On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net> wrote:
HI Sam,
Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success.
IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ?
I appreciate this is a totally different situation and requirement, but, its just a thought :)
Kind regards,
Chris
------------------------------
*From: *"Sam Lanfranco" <sam@lanfranco.net> *To: *"chris" <chris@netearth.net>, "Michele Neylon" < michele@blacknight.com> *Cc: *"gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> *Sent: *Monday, 20 February, 2017 14:38:40 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*due diligence*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a *DumbOne’s Guide to DNS Complaints* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------
< rest deleted >
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Greg, Good comment. I agree on the educational part. But lets not stop there, how cool would it be if you could surf to the RDS, look up the domain and the select copyright issues, and it would have the option to send a message to the correct parties for copyright issues? And this is just one of the many ideas based on Chris his use case, I just framed one solution here. Again, and I am going to sound like a broken record here, we are not even close to the solution phase, this is just an example on how you can make the RDS work for you. Best regards, Theo On 20-2-2017 23:39, Greg Shatan wrote:
As someone who does a fair amount of infringement/takedown work, Chris's chain is pretty much like what I was going to type in before I saw his email, at least for the usual IP infringement matters. When it comes to phishing/spam/fraud domains and sites (often siteless domains being used to support a typosquatted email account), there's not much point in contacting the registrant (but there I will often contact LEA). The registrar is rarely, if ever, the first call or even the second (if the registrant is not, e.g., Donald Duck at 123 Fake Street) (maybe for a siteless typosquat supporting phishing/fraud emails, and even there one needs to get to the email provider first (although I've had one case where the sender and the email provider were both buried behind various anonymizing methods, beyond my ability to penetrate)). A reasonably well-documented complaint is a must, of course. I think this is true of the colleagues I know (attorney and non-attorneys) and have worked with, as well.
Unfortunately, there are plenty of non-specialists (attorneys and others) who will take care of these kinds of matters and they will go to the bright shiny object of the registrar with the abuse contact number. It looks easy, and why give away work you think you can do yourself. Training and education could come out of the IP or other relevant communities, or out of non-ICANN cooperative measures akin to the Healthy Domains Initiative. Of course, there's already a fair amount of education out there for anyone who wants to know how to pursue these matters appropriately, but the problem is there's no one place that all of us on both sides of the complainant/recipient dyad can point to and say "read this and do what it says before you send another [adjective] complaint to a [adjective] registrar." (Of course, there are plenty of nuances, exceptions and tricks of the trade, but the basics are pretty ... basic.)
Greg Shatan
*Greg Shatan *C: 917-816-6428 S: gsshatan Phone-to-Skype: 646-845-9428 gregshatanipc@gmail.com <mailto:gregshatanipc@gmail.com>
On Mon, Feb 20, 2017 at 2:59 PM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote:
Sounds good Victoria, thanks!
Theo
On 20-2-2017 20:48, Victoria Sheckler wrote:
If / when this is set up. I'm happy to share with you how we approach these issues at RIAA.
Sent from my iPhone
On Feb 20, 2017, at 11:43 AM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote:
Lets shoot for Johannesburg.
Theo
On 20-2-2017 17:52, Michele Neylon - Blacknight wrote:
Maybe punt until we’re somewhere a bit more affordable?
Copenhagen is going to be pricey J
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072 <tel:+353%2059%20918%203072>
Direct Dial: +353 (0)59 9183090 <tel:+353%2059%20918%203090>
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *<gnso-rds-pdp-wg-bounces@icann.org> <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of John Horton <john.horton@legitscript.com> <mailto:john.horton@legitscript.com> *Date: *Monday 20 February 2017 at 16:43 *To: *Chris Pelling <chris@netearth.net> <mailto:chris@netearth.net> *Cc: *gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> <mailto:gnso-rds-pdp-wg@icann.org> *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
That /was/ a good event (the Dublin public safety/registrars event).
John Horton President and CEO, LegitScript
*Follow****Legit**Script*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | _Blog <http://blog.legitscript.com>_ |Google+ <https://plus.google.com/112436813474708014933/posts>
On Mon, Feb 20, 2017 at 8:29 AM, Chris Pelling <chris@netearth.net <mailto:chris@netearth.net>> wrote:
HI Sam,
Well, we have ICANN 58 coming up with a very tight schedule looking at the draft. Something the registrars took on was at the Dublin meeting, we booked a room above a pub, got some drinks and munchies together, to get the "LEA/Public safety" and registrars together - the night was a success.
IF we could find somewhere, and get something sorted, would there be any interest from the group, and if so, how many ?
I appreciate this is a totally different situation and requirement, but, its just a thought :)
Kind regards,
Chris
------------------------------------------------------------------------
*From: *"Sam Lanfranco" <sam@lanfranco.net <mailto:sam@lanfranco.net>> *To: *"chris" <chris@netearth.net <mailto:chris@netearth.net>>, "Michele Neylon" <michele@blacknight.com <mailto:michele@blacknight.com>> *Cc: *"gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> *Sent: *Monday, 20 February, 2017 14:38:40 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Chris,
Your comment yanked my chain. I agree with you 100% when you say “The problem is from the takedown / infringement requests we see, 1, 2 and 3 [*/due diligence/*] are not even thought of, *so part of this is education*.” Good idea. How do we get there from here?
As an economist I get pulled into very large project proposals that are being clobbered together by well meaning, well educated, people with their own personal PICs (Public Interest Commitments) and who just want to do good. In the “good works” area there are just as many crooks, frauds, and sociopaths as can be found trolling in the DNS system. However, over and over again it takes me less than two hours of due diligence to uncover yet one more “financier” who is a fraud, a crook, or simply trolling for a big hit, and has the financial resources of a raccoon, information the “good works” people have managed to overlook.
An effective educational strategy is clearly needed here. That may include a */DumbOne’s Guide to DNS Complaints/* (avoided a trademark there) and maybe even generic semi-standard forms for initiating complaints. To do that, it would be useful to know the data on types of complaints by type of complainant (e.g. how many and what types come from lawyers, from individuals, etc.) as background for better education here. Access to that "How to" guide should at least be flagged in the domain name registration process, the web hosting process and in queries about complaining.
Sam L.
On 2/20/2017 8:32 AM, Chris Pelling wrote:
I'll weigh in here for a registrar who does not host content that is not owned by him.
My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) :
1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away)
2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive.
3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education.
Kind regards,
Chris
------------------------------------------------------------------------
< rest deleted >
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
Hi, On Tue, Feb 21, 2017 at 09:49:17PM +0100, theo geurts wrote:
I agree on the educational part. But lets not stop there, how cool would it be if you could surf to the RDS, look up the domain and the select copyright issues, and it would have the option to send a message to the correct parties for copyright issues? And this is just one of the many ideas based on Chris his use case, I just framed one solution here.
Again, and I am going to sound like a broken record here, we are not even close to the solution phase, this is just an example on how you can make the RDS work for you.
While we're not close to the solution phase, I suspect that the more technically-inclined among us are getting a little frustrated with the tendency to work only on requirements and so on without gaming out what realistic options there are in the solutions. Happily, everything in the above description is entirely consistent with the facilities we could get from the combination of EPP and RDAP. That's important to note, because if our effort is to end up producing anything useful it needs to produce something that is possible. One of the things I've found difficult about the discussion of "data collection" vs "data access" is that we seem sometimes (pronounced "too often") to talk as though the collection itself automatically entails disclosure to anyone. It need not. I continue to think that the criterion for "legitimate collection" boils down to "does that aid the operation of the network?" I construe "operation of the network" broadly. So, for instance, if collection of some bit of data ensures that other, much more invasive network-operation events don't happen, that seems to me to be a good thing. I think it is better, for example, that law enforcement can get data about who is nominally operating the services at a given domain to the extent that that does not cause every country to make odious laws about national registration of permitted domain names, only because it means that network operation is made better. I really do think that would be an excellent principle to embrace: if a given datum is on balance helpful to the operation of the network and its absence is likely to cause worse operational conditions (especially long term), then its collection is acceptable. Access is a separate question. Best regards, A -- Andrew Sullivan ajs@anvilwalrusden.com
Should we add this to our list of principles? Chuck Sent from my iPhone
On Feb 21, 2017, at 4:37 PM, Andrew Sullivan <ajs@anvilwalrusden.com> wrote:
Hi,
On Tue, Feb 21, 2017 at 09:49:17PM +0100, theo geurts wrote: I agree on the educational part. But lets not stop there, how cool would it be if you could surf to the RDS, look up the domain and the select copyright issues, and it would have the option to send a message to the correct parties for copyright issues? And this is just one of the many ideas based on Chris his use case, I just framed one solution here.
Again, and I am going to sound like a broken record here, we are not even>> close to the solution phase, this is just an example on how you can make>> the RDS work for you.
While we're not close to the solution phase, I suspect that the more technically-inclined among us are getting a little frustrated with the tendency to work only on requirements and so on without gaming out what realistic options there are in the solutions. Happily, everything in the above description is entirely consistent with the facilities we could get from the combination of EPP and RDAP. That's important to note, because if our effort is to end up producing anything useful it needs to produce something that is possible.
One of the things I've found difficult about the discussion of "data collection" vs "data access" is that we seem sometimes (pronounced "too often") to talk as though the collection itself automatically entails disclosure to anyone. It need not.
I continue to think that the criterion for "legitimate collection" boils down to "does that aid the operation of the network?" I construe "operation of the network" broadly. So, for instance, if collection of some bit of data ensures that other, much more invasive network-operation events don't happen, that seems to me to be a good thing. I think it is better, for example, that law enforcement can get data about who is nominally operating the services at a given domain to the extent that that does not cause every country to make odious laws about national registration of permitted domain names, only because it means that network operation is made better.
I really do think that would be an excellent principle to embrace: if a given datum is on balance helpful to the operation of the network and its absence is likely to cause worse operational conditions (especially long term), then its collection is acceptable. Access is a separate question.
Best regards,
A
-- Andrew Sullivan ajs@anvilwalrusden.com _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I had thought the first part was already implicit in our discussions, as a sort of technical benefit/cost decision. As for second part w/r to access, which is the big issue here, something like the///Precautionary Principle /might be of help. Sam L. On 2/21/2017 4:57 PM, Gomes, Chuck wrote: Should we add this to our list of principles? Andrew Sullivan<ajs@anvilwalrusden.com> wrote:
I really do think that would be an excellent principle to embrace: if a given datum is on balance helpful to the operation of the network and its absence is likely to cause worse operational conditions (especially long term), then its collection is acceptable. Access is a separate question. <rest deleted for brevity>
Hi Chris,
4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar.
4) is not necessarily true due to reseller chains, which are actually quite common. What the ultimate registrar puts in the whois under the reseller field may be their reseller, but not the ultimate reseller where the order was placed. Best, Volker
------------------------------------------------------------------------ *From: *"Michele Neylon" <michele@blacknight.com> *To: *"Volker Greimann" <vgreimann@key-systems.net>, "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> *Sent: *Monday, 20 February, 2017 11:24:53 *Subject: *Re: [gnso-rds-pdp-wg] Dangers of public whois
Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not.
As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar.
Best,
Volker
Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > >
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
It’s still a better lead than the registrar of record, who wouldn’t have visibility beyond their reseller -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Volker Greimann <vgreimann@key-systems.net> Date: Monday 20 February 2017 at 14:50 To: Chris Pelling <chris@netearth.net>, Michele Neylon <michele@blacknight.com> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chris, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. 4) is not necessarily true due to reseller chains, which are actually quite common. What the ultimate registrar puts in the whois under the reseller field may be their reseller, but not the ultimate reseller where the order was placed. Best, Volker ________________________________ From: "Michele Neylon" <michele@blacknight.com><mailto:michele@blacknight.com> To: "Volker Greimann" <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net>, "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 11:24:53 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net><mailto:vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann"<mailto:gnso-rds-pdp-wg-bounces@icann.orgonbehalfofVolkerGreimann> <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net><mailto:gnso-rds-pdp-wg-bounces@icann.orgonbehalfofvgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com><mailto:marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com><mailto:marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org><mailto:gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com><mailto:michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Hi Volker, We put the parent reseller, but you are right, in that it could be anyone in the chain, however, in the example, the registrar might not know the ultimate reseller in a chain as per your example. Hence 1 and 2 being the first place to start. Ultimately it might come back to the registrar, and this is where it then is pass the parcel to their reseller, the reseller then says "oh you want X" etc. It could be endless, hence the hosting company and IP owner could resolve things a lot quicker. Kind regards, Chris From: "Volker Greimann" <vgreimann@key-systems.net> To: "chris" <chris@netearth.net>, "Michele Neylon" <michele@blacknight.com> Cc: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 14:50:04 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Chris, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. 4) is not necessarily true due to reseller chains, which are actually quite common. What the ultimate registrar puts in the whois under the reseller field may be their reseller, but not the ultimate reseller where the order was placed. Best, Volker BQ_BEGIN From: "Michele Neylon" <michele@blacknight.com> To: "Volker Greimann" <vgreimann@key-systems.net> , "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Monday, 20 February, 2017 11:24:53 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to
Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight:
Volker
The key thing is the sequence. If the contact’s details are available either via whois OR on the website then they’re the first port of call.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote:
Well, the registrant may not be the right contact in all cases, especially if it comes down to subdomains. But yes, if the registrant is known, then he should probably be contacted right after a known website operator. But if the registrant is unknown, the next contact should be the host as he is closer to the alleged violation than the registrar.
Best,
Volker
Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight:
Volker
Really? As a hosting provider I’d strongly disagree.
If you’ve got a problem with content on a website you should contact the registrant first.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote:
When you say web site, it should be taken up with the web host not the registrar as the registrant is not necessarily the correct content.
Problems with domain -> registrant
Problems with content -> Web host
Best,
Volker
Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg:
Counter example "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered.
In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues.
In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion.
-----Original Message----- From: benny@nordreg.se [ mailto:benny@nordreg.se ] Sent: Friday, February 17, 2017 9:41 AM To: Mark Svancarek <marksv@microsoft.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Let us take a simple example
A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort.
So why on earth are we forcing registrants to give up this right to choose to whom they share that info?
Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here.
The Status Quo hammering are not productive at all.
RDS are meant to make change to the better!
Sent from my iPhone
On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [ mailto:gnso-rds-pdp-wg-bounces@icann.org ] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Chris and all, This email thread seems to have lead us to not only an exchange of differing viewpoints, but a very informative description of the role played by WHOIS data when investigating incidents involving website content. I think it would be good to capture this detailed description as a use case for future reference during WG deliberation on possible purposes and related contact data. Chris, would you be willing to pull out your description below and combine it with a use case introduction for posting on this WG's use case list? If you wish, you can start from the template Word document posted on our use case wiki page: https://community.icann.org/display/NGRDSTRWMO/RDS+PDP+WG+Example+Use+Cases While this may be related to other cases already posted there, your description goes further in showing how WHOIS data fits into a broader scenario, so I think it would make a useful addition to our use case inventory. As we move forward in our deliberation on purposes, data, and privacy, examples such as these will be very helpful. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Chris Pelling Sent: Monday, February 20, 2017 8:33 AM To: Michele Neylon <michele@blacknight.com> Cc: gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois I'll weigh in here for a registrar who does not host content that is not owned by him. My views and points on this are, for content based issues, in priority order, top being the highest (and first port of call) : 1. Registrant if available or any contact that is identifiable on the website in question, if a sub-domain, check the main domain by removing the subdomain and adding www or leaving it off. (some free hosting sites give subdomains away free, but the main site is always only 1 click away) 2. Hosting company, look at the nameservers and this sometimes gives the hosting company name, put the nameserver name into google and more often than not, the hosting company will pop up - contact them alerting them to the fact that there is potentially infringing information on a website that is hosted on servers under their control. Good hosting companies are very responsive. 3. If you cannot work out 2 above, whois the IP address of the website (including any subdomain), this will give you the IP address owner, they will surely know whom that have given / rented / leased the IPs too and this gives you 2 above. If you from doing this get the registrar and they are not the hosting company, this would lend to it be a forwarding service, 4. If they are a "reseller centric/wholesale" registrar (eNom, Tucows. Realtime, NEO), then WHOIS will often have a "Registration service provided by" or "Reseller" in the whois output, this gives you the registering party who took the order, if not at the very least the registrar. The problem is from the takedown / infringement requests we see, 1, 2 and 3 are not even thought of, so part of this is education. Kind regards, Chris _____ From: "Michele Neylon" <michele@blacknight.com<mailto:michele@blacknight.com>> To: "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>>, "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Sent: Monday, 20 February, 2017 11:24:53 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Volker
From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we'll know who the IPs are assigned to
Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact's details are available either via whois OR on the website then they're the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I'd strongly disagree. > > > > If you've got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann<mailto:gnso-rds-pdp-wg-bounces@icann.org%20on%20behalf%20of%20Volker%20Greimann>" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net<mailto:gnso-rds-pdp-wg-bounces@icann.org%20on%20behalf%20of%20vgreimann@key-systems.net>> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se<mailto:benny@nordreg.se> [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com<mailto:marksv@microsoft.com>> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se<mailto:benny@nordreg.se> > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu<http://www.keydrive.lu> > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> > > Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> > www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> > www.twitter.com/key_systems<http://www.twitter.com/key_systems> > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu<http://www.keydrive.lu> > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Assuming we decide that these types of concerns are within our remit and ICANN's mission, we may want to consider and educational requirement for law enforcement and courts. Like I said in response to Chris's suggestion a few minutes ago, it is not possible to force feed education but we could make it readily available and encourage it. Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Michele Neylon - Blacknight Sent: Monday, February 20, 2017 6:25 AM To: Volker Greimann <vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Volker From our perspective the frustration is when the client (registrant) has their details in whois and / or on the website and the complainant makes zero attempt to contact them. The first we hear about the alleged issues is when I get a 100 page takedown notice on my desk. So if they can at least attempt to contact the website operator then it makes our lives a lot easier. As the hosting provider we *should* have details of how to reach the site owner, but not always, as we also offer dedicated servers, colo etc., but we’ll know who the IPs are assigned to Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 20/02/2017, 11:21, "Volker Greimann" <vgreimann@key-systems.net> wrote: Agreed. The question is who is next if the details are not available. If it is content, the next port of call should be the host as the host has the ability to remove said content and also bears certain legal obligations in case of obvious violations while the registrar does not. As the registrar may not even know the actual registrant, for example for registrations under third party privacy services, it does not even make sense to contact the registrar. Best, Volker Am 20.02.2017 um 12:08 schrieb Michele Neylon - Blacknight: > Volker > > The key thing is the sequence. > If the contact’s details are available either via whois OR on the website then they’re the first port of call. > > Regards > > Michele > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > On 20/02/2017, 10:46, "Volker Greimann" <vgreimann@key-systems.net> wrote: > > Well, the registrant may not be the right contact in all cases, > especially if it comes down to subdomains. But yes, if the registrant is > known, then he should probably be contacted right after a known website > operator. But if the registrant is unknown, the next contact should be > the host as he is closer to the alleged violation than the registrar. > > Best, > > Volker > > > > > Am 20.02.2017 um 11:28 schrieb Michele Neylon - Blacknight: > > Volker > > > > Really? > > As a hosting provider I’d strongly disagree. > > > > If you’ve got a problem with content on a website you should contact the registrant first. > > > > Regards > > > > Michele > > > > > > -- > > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com/ > > http://blacknight.blog/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > Personal blog: https://michele.blog/ > > Some thoughts: https://ceo.hosting/ > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > > > On 20/02/2017, 09:54, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Volker Greimann" <gnso-rds-pdp-wg-bounces@icann.org on behalf of vgreimann@key-systems.net> wrote: > > > > When you say web site, it should be taken up with the web host not the > > registrar as the registrant is not necessarily the correct content. > > > > Problems with domain -> registrant > > > > Problems with content -> Web host > > > > Best, > > > > Volker > > > > > > Am 17.02.2017 um 20:49 schrieb Mark Svancarek via gnso-rds-pdp-wg: > > > Counter example > > > "Joe" has a web site which is used to abuse my trademark. I can't contact Joe because his thin data is incorrect or hidden (I don't know that Joe is actually Joe.). I then contact the registrar. They follow up with the privacy proxy service if needed. Hopefully all this happens quickly and the cease and desist message is actually delivered. > > > > > > In actual practice, there is a noteworthy difference in effectiveness if we have to go through the registrar, compared to us contacting directly. If the registrar isn't responsive, then I may have to pressure ICANN to enforce the registrar contract, which has its own issues. > > > > > > In either case, your abuse of my trademark is probably a civil issue, so starting with law enforcement isn't a great option, even if they had the inclination and bandwidth to help out in a timely fashion. > > > > > > -----Original Message----- > > > From: benny@nordreg.se [mailto:benny@nordreg.se] > > > Sent: Friday, February 17, 2017 9:41 AM > > > To: Mark Svancarek <marksv@microsoft.com> > > > Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > > Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > > > > > Let us take a simple example > > > > > > A phone number can you as the one it's registered on choose by yourself if it shall be published in the phone book, if you give the number to someone it's your choice as an individual! If the police want your number they will get without to much effort. > > > > > > So why on earth are we forcing registrants to give up this right to choose to whom they share that info? > > > > > > Forget what Whois are as we know it and come up with ideas how we can make a new system which takes reasonable interest of all sides here. > > > > > > The Status Quo hammering are not productive at all. > > > > > > RDS are meant to make change to the better! > > > > > > > > > Sent from my iPhone > > > > > >> On 17 Feb 2017, at 18:28, Mark Svancarek <marksv@microsoft.com> wrote: > > >> > > >> Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me. > > >> > > >> > > >> > > >> -----Original Message----- > > >> From: gnso-rds-pdp-wg-bounces@icann.org > > >> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of > > >> benny@nordreg.se > > >> Sent: Friday, February 17, 2017 8:25 AM > > >> To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> > > >> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois > > >> > > >> Another post about the problems with public whois > > >> > > >> How anyone here can still defend this abuse of info as a the best system I have serious problems understanding. > > >> > > >> http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin > > >> g-based-whois-info/ > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 > > >> Direct: +47.32260201 > > >> Mobile: +47.40410200 > > >> > > >>> On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote: > > >>> > > >>> Allison > > >>> > > >>> As others have said, if you have an issue please report it to ICANN, > > >>> law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn't very helpful for constructive dialogue. > > >>> We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it's very obvious that the details provided are bogus, but in others it's not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits. > > >>> > > >>> We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: > > >>> https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C > > >>> > > >>> Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that's a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don't live at any of them, but you can send me physical mail and I will get it. You could argue that the address is "fake", but as I can get mail to it I'd suspect that in many cases it'd be considered valid. > > >>> > > >>> Regards > > >>> > > >>> Michele > > >>> > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Personal blog: https://michele.blog/ > > >>> Some thoughts: https://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > > >>> Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > _______________________________________________ > > > gnso-rds-pdp-wg mailing list > > > gnso-rds-pdp-wg@icann.org > > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > > > Mit freundlichen Grüßen, > > > > Volker A. Greimann > > - Rechtsabteilung - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > Geschäftsführer: Alexander Siffrin > > Handelsregister Nr.: HR B 18835 - Saarbruecken > > Umsatzsteuer ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > > > -------------------------------------------- > > > > Should you have any further questions, please do not hesitate to contact us. > > > > Best regards, > > > > Volker A. Greimann > > - legal department - > > > > Key-Systems GmbH > > Im Oberen Werk 1 > > 66386 St. Ingbert > > Tel.: +49 (0) 6894 - 9396 901 > > Fax.: +49 (0) 6894 - 9396 851 > > Email: vgreimann@key-systems.net > > > > Web: www.key-systems.net / www.RRPproxy.net > > www.domaindiscount24.com / www.BrandShelter.com > > > > Follow us on Twitter or join our fan community on Facebook and stay updated: > > www.facebook.com/KeySystems > > www.twitter.com/key_systems > > > > CEO: Alexander Siffrin > > Registration No.: HR B 18835 - Saarbruecken > > V.A.T. ID.: DE211006534 > > > > Member of the KEYDRIVE GROUP > > www.keydrive.lu > > > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > > > > _______________________________________________ > > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > > -- > Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. > > Mit freundlichen Grüßen, > > Volker A. Greimann > - Rechtsabteilung - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > Geschäftsführer: Alexander Siffrin > Handelsregister Nr.: HR B 18835 - Saarbruecken > Umsatzsteuer ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. > > -------------------------------------------- > > Should you have any further questions, please do not hesitate to contact us. > > Best regards, > > Volker A. Greimann > - legal department - > > Key-Systems GmbH > Im Oberen Werk 1 > 66386 St. Ingbert > Tel.: +49 (0) 6894 - 9396 901 > Fax.: +49 (0) 6894 - 9396 851 > Email: vgreimann@key-systems.net > > Web: www.key-systems.net / www.RRPproxy.net > www.domaindiscount24.com / www.BrandShelter.com > > Follow us on Twitter or join our fan community on Facebook and stay updated: > www.facebook.com/KeySystems > www.twitter.com/key_systems > > CEO: Alexander Siffrin > Registration No.: HR B 18835 - Saarbruecken > V.A.T. ID.: DE211006534 > > Member of the KEYDRIVE GROUP > www.keydrive.lu > > This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. > > > > > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Mark, Thank you for your comment. I think you are nailing the problem here; this is very good IMO. "and the need to mitigate them does not eliminate the need to have public data." This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law. So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse. Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets. So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another. So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS. Thank you for making it this far. Have a good weekend, Theo Registrar On 17-2-2017 18:27, Mark Svancarek via gnso-rds-pdp-wg wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocalling-base...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Well said Theo. Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of theo geurts Sent: Friday, February 17, 2017 4:10 PM To: gnso-rds-pdp-wg@icann.org; marksv@microsoft.com Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Mark, Thank you for your comment. I think you are nailing the problem here; this is very good IMO. "and the need to mitigate them does not eliminate the need to have public data." This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law. So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse. Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets. So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another. So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS. Thank you for making it this far. Have a good weekend, Theo Registrar On 17-2-2017 18:27, Mark Svancarek via gnso-rds-pdp-wg wrote:
Spam and DDOS will always be with us, and the need to mitigate them does not eliminate the need to have public data. It seems orthogonal to me.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 17, 2017 8:25 AM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Another post about the problems with public whois
How anyone here can still defend this abuse of info as a the best system I have serious problems understanding.
http://domainnamewire.com/2017/02/16/control-block-sms-spam-robocallin g-based-whois-info/
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 17 Feb 2017, at 14:55, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Allison
As others have said, if you have an issue please report it to ICANN, law enforcement, consumer protection etc., Some of us take our obligations very seriously and lumping all registrars and providers into one big bucket isn’t very helpful for constructive dialogue. We get a number of whois complaints from ICANN every year and we investigate each and every one of them. In some cases it’s very obvious that the details provided are bogus, but in others it’s not and we have to spend time energy and effort going back and forth with our client and ICANN to resolve it. Sometimes this leads to domains being suspended or deleted, sometimes the whois gets updated, sometimes the complaint is denied. But each complaint is handled on its merits.
We also have a whois privacy service. It is NOT a fake address. You can check it in the Irish company office: https://search.cro.ie/company/CompanyDetails.aspx?id=480317&type=C
Now you may not like that people and organisations choose to obfuscate their contact details via services like that one, but that’s a different issue entirely. I also personally have correspondence addresses in the US, mainland UK and a couple in Northern Ireland. I don’t live at any of them, but you can send me physical mail and I will get it. You could argue that the address is “fake”, but as I can get mail to it I’d suspect that in many cases it’d be considered valid.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I cannot PLUS ONE this comment enough - thank you Theo! One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability. Cheers, Rod Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
I was holding my breath to see what the reaction would be. +2 to Theo! Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Rod, Thanks, Nathalie, @Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us. And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet... Have a good weekend or what is left of it. Theo On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Let me offer a +3/4 to the chain below. The following are my personal views. I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently. But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them. So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system. And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing. [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of theo geurts Sent: Saturday, February 18, 2017 4:24 PM To: nathalie coupet; gnso-rds-pdp-wg@icann.org; rrasmussen@infoblox.com Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Rod, Thanks, Nathalie, @Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us. And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet... Have a good weekend or what is left of it. Theo On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com>> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
Steve, I hope you will contribute some good questions for the data commissioners in Copenhagen so that we as a WG can assess their input and factor it in as we deliberate. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Sunday, February 19, 2017 4:41 PM To: 'theo geurts' <gtheo@xs4all.nl>; nathalie coupet <nathaliecoupet@yahoo.com>; gnso-rds-pdp-wg@icann.org; rrasmussen@infoblox.com Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me offer a +3/4 to the chain below. The following are my personal views. I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently. But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them. So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system. And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing. Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of theo geurts Sent: Saturday, February 18, 2017 4:24 PM To: nathalie coupet; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Rod, Thanks, Nathalie, @Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us. And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet... Have a good weekend or what is left of it. Theo On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com>> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
/Chuck, Steve, et. al.,/ /As I understand it the purpose of this meeting is to understand their views from their context, and not to engage them on our views. / /Given the long history of both whois and the data protection authorities, might we first simple ask them: (a) What do they see as problematic with the existing whois? and (b) What would be their recommendations to be considered as we develop a new RDS? While the remaining list of questions (and questioners) will be worked out in advance, I would suggest that the sequence of questions be re-ordered by Chuck, on the fly, in response to the content of the opening comments by the data protection authorities. my two cents... Sam L./ On 2/19/2017 6:10 PM, Gomes, Chuck wrote:
Steve,
I hope you will contribute some good questions for the data commissioners in Copenhagen so that we as a WG can assess their input and factor it in as we deliberate.
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Metalitz, Steven *Sent:* Sunday, February 19, 2017 4:41 PM *To:* 'theo geurts' <gtheo@xs4all.nl>; nathalie coupet <nathaliecoupet@yahoo.com>; gnso-rds-pdp-wg@icann.org; rrasmussen@infoblox.com *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me offer a +3/4 to the chain below. The following are my personal views.
I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently.
But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them.
So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system.
And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing.
*image001*
*Steven J. Metalitz *|***Partner, through his professional corporation*
T: 202.355.7902 | met@msk.com <mailto:met@msk.com>**
*Mitchell Silberberg & Knupp**LLP*|*www.msk.com <http://www.msk.com/>*
1818 N Street NW, 8th Floor, Washington, DC 20036
*_THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS._**THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.*
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *theo geurts *Sent:* Saturday, February 18, 2017 4:24 PM *To:* nathalie coupet; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com <mailto:rrasmussen@infoblox.com> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Rod, Thanks, Nathalie,
@Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us.
And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet...
Have a good weekend or what is left of it.
Theo
On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com <mailto:rrasmussen@infoblox.com>> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
Sam, Although I provided some input regarding the public session to Peter and Stephanie in the early stages of planning, I do not have any direct influence over the planning for the cross community session. My personal hope was that the cross community session panel would be mainly data protection commissioners so that we can take full advantage of having them with us in-person and so that the community and especially the RDS PDP WG could ask clarifying questions. Here are some of my reasons in no particular order: •••••••• 90 minutes is not very much time for a subject like this. •••••••• It may be unlikely that we will have another opportunity in the near future where we can talk with European Data Commissioners in person. •••••••• The WG is deliberating on Data Protection now. •••••••• A cross community session is not the venue for deliberation; the WG is tasked with that. •••••••• It will be easy for us to get experts from law enforcement, IP holders, etc. in the near future (and we will). •••••••• My goal would be to improve our understanding of the European Data Protection requirements as much as possible, not to make any decisions though; we cannot fully deliberate until we have looked at all sides of the issues. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Sam Lanfranco Sent: Sunday, February 19, 2017 6:28 PM To: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Chuck, Steve, et. al., As I understand it the purpose of this meeting is to understand their views from their context, and not to engage them on our views. Given the long history of both whois and the data protection authorities, might we first simple ask them: (a) What do they see as problematic with the existing whois? and (b) What would be their recommendations to be considered as we develop a new RDS? While the remaining list of questions (and questioners) will be worked out in advance, I would suggest that the sequence of questions be re-ordered by Chuck, on the fly, in response to the content of the opening comments by the data protection authorities. my two cents... Sam L. On 2/19/2017 6:10 PM, Gomes, Chuck wrote: Steve, I hope you will contribute some good questions for the data commissioners in Copenhagen so that we as a WG can assess their input and factor it in as we deliberate. Chuck From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Sunday, February 19, 2017 4:41 PM To: 'theo geurts' <gtheo@xs4all.nl><mailto:gtheo@xs4all.nl>; nathalie coupet <nathaliecoupet@yahoo.com><mailto:nathaliecoupet@yahoo.com>; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Let me offer a +3/4 to the chain below. The following are my personal views. I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently. But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them. So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system. And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing. Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & KnuppLLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of theo geurts Sent: Saturday, February 18, 2017 4:24 PM To: nathalie coupet; gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Rod, Thanks, Nathalie, @Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us. And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet... Have a good weekend or what is left of it. Theo On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com<mailto:rrasmussen@infoblox.com>> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl<mailto:gtheo@xs4all.nl>> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
/Chuck, // / /I am in complete agreement here with regard to your personal hopes about this session. // //It is for us to hear from them with regard to their concerns, and hopefully some with regard to our questions.// //If my statement of hopes look to be at cross purposes to that, I clearly failed to make my comments clear enough./ /Sam / On 2/19/2017 7:52 PM, Gomes, Chuck wrote:
Sam,
Although I provided some input regarding the public session to Peter and Stephanie in the early stages of planning, I do not have any direct influence over the planning for the cross community session.
My personal hope was that the cross community session panel would be mainly data protection commissioners so that we can take full advantage of having them with us in-person and so that the community and especially the RDS PDP WG could ask clarifying questions. Here are some of my reasons in no particular order:
·90 minutes is not very much time for a subject like this.
·It may be unlikely that we will have another opportunity in the near future where we can talk with European Data Commissioners in person.
·The WG is deliberating on Data Protection now.
·A cross community session is not the venue for deliberation; the WG is tasked with that.
·It will be easy for us to get experts from law enforcement, IP holders, etc. in the near future (and we will).
·My goal would be to improve our understanding of the European Data Protection requirements as much as possible, not to make any decisions though; we cannot fully deliberate until we have looked at all sides of the issues.
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Sam Lanfranco *Sent:* Sunday, February 19, 2017 6:28 PM *To:* gnso-rds-pdp-wg@icann.org *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
/Chuck, Steve, et. al.,/
/As I understand it the purpose of this meeting is to understand their views from their context, and not to engage them on our views. /
/Given the long history of both whois and the data protection authorities, might we first simple ask them: (a) What do they see as problematic with the existing whois? and (b) What would be their recommendations to be considered as we develop a new RDS?
While the remaining list of questions (and questioners) will be worked out in advance, I would suggest that the sequence of questions be re-ordered by Chuck, on the fly, in response to the content of the opening comments by the data protection authorities.
my two cents...
Sam L./
On 2/19/2017 6:10 PM, Gomes, Chuck wrote:
Steve,
I hope you will contribute some good questions for the data commissioners in Copenhagen so that we as a WG can assess their input and factor it in as we deliberate.
Chuck
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>[mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *Metalitz, Steven *Sent:* Sunday, February 19, 2017 4:41 PM *To:* 'theo geurts' <gtheo@xs4all.nl> <mailto:gtheo@xs4all.nl>; nathalie coupet <nathaliecoupet@yahoo.com> <mailto:nathaliecoupet@yahoo.com>; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com <mailto:rrasmussen@infoblox.com> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
Let me offer a +3/4 to the chain below. The following are my personal views.
I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently.
But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them.
So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system.
And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing.
*image001*
*Steven J. Metalitz *|** *Partner, through his professional corporation*
T: 202.355.7902 | met@msk.com <mailto:met@msk.com>
*Mitchell Silberberg & Knupp**LLP*|*www.msk.com* <http://www.msk.com/>
1818 N Street NW, 8th Floor, Washington, DC 20036
*_THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS._**THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.*
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>[mailto:gnso-rds-pdp-wg-bounces@icann.org] *On Behalf Of *theo geurts *Sent:* Saturday, February 18, 2017 4:24 PM *To:* nathalie coupet; gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>; rrasmussen@infoblox.com <mailto:rrasmussen@infoblox.com> *Subject:* Re: [gnso-rds-pdp-wg] Dangers of public whois
Hi Rod, Thanks, Nathalie,
@Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us.
And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet...
Have a good weekend or what is left of it.
Theo
On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote: > I was holding my breath to see what the reaction would be. +2 to Theo! > > Sent from my iPhone > >> On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com <mailto:rrasmussen@infoblox.com>> wrote: >> >> I cannot PLUS ONE this comment enough - thank you Theo! >> >> One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability. >> >> Cheers, >> >> Rod >> >> >> Rod Rasmussen >> VP, Cybersecurity >> Infoblox >> >>> On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl <mailto:gtheo@xs4all.nl>> wrote: >>> >>> Mark, >>> >>> Thank you for your comment. I think you are nailing the problem here; this is very good IMO. >>> >>> "and the need to mitigate them does not eliminate the need to have public data." >>> >>> This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law. >>> >>> So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse. >>> >>> Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. >>> As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets. >>> >>> So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. >>> We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another. >>> >>> So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS. >>> >>> Thank you for making it this far. >>> >>> Have a good weekend, >>> >>> Theo >>> Registrar >>> >>> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email:Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco blog:https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
-- ------------------------------------------------ "It is a disgrace to be rich and honoured in an unjust state" -Confucius 邦有道,贫且贱焉,耻也。邦无道,富且贵焉,耻也 ------------------------------------------------ Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 email: Lanfran@Yorku.ca Skype: slanfranco blog: https://samlanfranco.blogspot.com Phone: +1 613-476-0429 cell: +1 416-816-2852
This email chain has become overwhelming in length, so my apologies if I am misinterpreting the recent direction of the discussion. From what you describe, Steve, of “settled expectations” over 15-20 years, WHOIS is a classic case of path dependency; it was a feature of the Internet that was designed in different conditions for different purposes and has been misappropriated by other parties because it was the closest thing to a form of global identification of website owners that could be offered in an Internet that lacked other tools to answer such a question. I think we both understand how this came to be; what I do not understand (or, rather, find difficult to accept) is the argument for why it must continue. I accept that open-access WHOIS may, to a limited extent, facilitate accountability online. My understanding of the concern of trademark holders is that they need a mechanism of enforcing their trademark rights against parties who register domain names which in their view infringe upon their mark(s). Without WHOIS there is a perception that there is no means of initiating a process against the party which is perceived as misusing a trademark. Please correct me if I am mistaken or the concern is broader. There are also arguments that law enforcement and private investigators use WHOIS in their investigations. At the same time, in order to have such a system in place to facilitate contact with the very, very small minority of domain name registrants whose domain names infringe upon the trademark/IP rights of others, or engage in abusive activities, we expose the sensitive personal data of all domain name registrants to three categories of real and significant abuse. These categories include: 1) unsolicited mass communication, 2) individual solicitation and harassment, and 3) the suppression of free speech. To the first point, we already know that entities are harvesting WHOIS records and using this information to spam others with marketing literature. To the second point, WHOIS has been used to dox and swat vulnerable persons, and to commit identify fraud, among other nefarious activities. To the third point, the lack of anonymity in the WHOIS service quashes the free expression of thought, because speakers have no protection from retaliation. These are all very significant privacy issues which need to be addressed, and should have been addressed long ago, so I take strong objection to the comment, Steve, that privacy advocates “have been crying wolf on this issue for more than a decade”. The entire burden of ending the problematic, pre-existing default of open access to WHOIS records has been placed on privacy advocates, while proponents of open access have the luxury of reaping the benefits of inertia from our lack of consensus for change. Best wishes, Ayden Férdeline [linkedin.com/in/ferdeline](http://www.linkedin.com/in/ferdeline) -------- Original Message -------- Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Local Time: 19 February 2017 9:40 PM UTC Time: 19 February 2017 21:40 From: met@msk.com To: 'theo geurts' <gtheo@xs4all.nl>, nathalie coupet <nathaliecoupet@yahoo.com>, gnso-rds-pdp-wg@icann.org <gnso-rds-pdp-wg@icann.org>, rrasmussen@infoblox.com <rrasmussen@infoblox.com> Let me offer a +3/4 to the chain below. The following are my personal views. I don’ t have any fundamental disagreement with Theo’s take on this. Yes, if we (or the original designers of the current RDS) had ready access to time machines, it would certainly have been designed quite differently. But over 15-20 years, settled expectations have been built up that contact data for domain name registrants will be available to the public without significant restrictions. People in many fields have come to rely on this as an element that promotes transparency, and thus accountability, for activities on the Internet. Everyone recognizes that it is a highly flawed tool for advancing this goal, but nonetheless it is a tool many people rely on, and many of them would be very unhappy if an organization like ICANN --- still unknown to the vast majority of Internet users – were somehow to take it away for them. So if we are to move to a new system that will deprive people (entirely or to a great extent) of this tool, then this needs to be accompanied by some clear explanations of why it is absolutely necessary to do so, and how what will replace it will give members of the general public – not just anti-abuse specialists, law enforcement and yes even intellectual property interests --- at least some part of the transparency they have come to associate with the existing system. And personally, I don’t think that enactment of the GDPR comes close – by itself – to providing that explanation. The new regulation does not strike me as a quantum leap beyond the EU data protection framework that has been in place for more than 20 years, almost as long as Whois itself. Ever since at least 2002 in Shanghai and 2003 in Montreal we have been hearing at ICANN about the impending train wreck when Whois collides with the data protection authorities. Those who have been crying wolf on this issue for more than a decade will have to take that into account in crafting the narrative that will be needed to explain a change of the magnitude we are discussing. image001 Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com Mitchell Silberberg & Knupp LLP | [www.msk.com](http://www.msk.com/) 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of theo geurts Sent: Saturday, February 18, 2017 4:24 PM To: nathalie coupet; gnso-rds-pdp-wg@icann.org; rrasmussen@infoblox.com Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Hi Rod, Thanks, Nathalie, @Rod That is good info, and I agree this is something we need to keep in mind when we get to that stage, but yes as a WG that should compass us. And even though we should not get ahead of ourselves, but regarding solutions, having front row seats assisting LEA's and Intelligence agencies as a Registrar in several high-profile investigations like terrorism, IS, bounty kill lists and a lot more, I am pretty sure we as a WG can honor the principle that privacy is a human right as laid out by the UN, and yet make sure, we have the technical solutions. I think creating the technical solutions is the least of our worries. Engineers can code a solution for everything; we just need lawyers and privacy guidelines to help us out. So perhaps we cannot show you X as it is personal data we can show you A and how A is involved in tons of criminal activities and map out an entire botnet... Have a good weekend or what is left of it. Theo On 18-2-2017 21:44, nathalie coupet via gnso-rds-pdp-wg wrote:
I was holding my breath to see what the reaction would be. +2 to Theo!
Sent from my iPhone
On Feb 18, 2017, at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com> wrote:
I cannot PLUS ONE this comment enough - thank you Theo!
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution. For example, there are different requirements under privacy law for business entities vs. private individuals, there are different amounts of information people and businesses may want to provide to various parties both publicly and privately, and those of us who deal with abuse and domain reputation can make different decisions on actions (blocking, take-down, LE involvement, etc.) based on what is occurring and what is published in an RDS. Everyone in the ecosystem already does this with the current whois system, but inconsistently, with varying degrees of knowledge, and without formal “rules of the road”. I think it would be helpful for everyone, no matter what your primary issues are to keep this in mind, as it allows you to better conceive solutions to the myriad issues we have to address. Make the system flexible to accommodate different kinds of use cases and desires for “transparency” around domain ownership, contactabilty, and accountability.
Cheers,
Rod
Rod Rasmussen VP, Cybersecurity Infoblox
On Feb 17, 2017, at 1:09 PM, theo geurts <gtheo@xs4all.nl> wrote:
Mark,
Thank you for your comment. I think you are nailing the problem here; this is very good IMO.
"and the need to mitigate them does not eliminate the need to have public data."
This is the issue here. That data should have never been public if we look at the EU GDPR and many other data privacy laws around the globe, and this is what causes Registries and Registrars having massive problems regarding complying with the law.
So we with the RDS we are starting from scratch. So and I think this is KEY here, how do we ensure privacy and yet make sure we can still effectively combat abuse.
Speaking personally, I think privacy is very important, and I do not like the fact my personal data is being processed all over the place by shady folks. As a Registrar, I find it very important that we should not go backward in fighting abuse. For the simple reason, abuse costs us money, and we should never be in a situation that it becomes harder to battle child porn, or taking down terrorists, or sinkhole botnets.
So what we cannot do is ignore all these privacy laws. That would be insane as we would be piling up in tons of fines here. We do not want to reduce effectiveness regarding abuse because that is costing money also. And to be clear here, the registrants will be soaking it all up one way or another.
So my take on this is, we make sure that we move on and address BOTH issues and this is our task as a WG. Our task is to solve these problems as we start from scratch with RDS. We learned our lessons from the current WHOIS, now we need to make sure that we can avoid all these pitfalls within RDS.
Thank you for making it this far.
Have a good weekend,
Theo Registrar
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Regarding "misappropriation"... If you wish to live in a cave, feel free to do so. Don't expect all of society to bring the cave to you. WHOIS data is used by spam harvesting sure, but it's by no means even a significant piece of the problem. If you want to solve the spam problem, by all means, many of my investigations need help and I'm sure the non-profit anti-spam outfits have volunteer opportunities. If you want to stop online harassment, let's stop that problem. If you are worried about suppression of free speech (and by this I assume you mean repressive regimes), don't ever register a domain. If your own government is in your risk profile, the absolute worst thing you can do is create paper trails. There are options that don't require a domain (or you could use any number of proxy registration options). I encourage you also to check out security without borders. What this does NOT require is to treat all use of WHOIS in the prism of these remarkably small number of edge cases. j On 02/19/2017 04:51 PM, Ayden Férdeline wrote:
These categories include: 1) unsolicited mass communication, 2) individual solicitation and harassment, and 3) the suppression of free speech.
On Sat, Feb 18, 2017 at 2:10 PM, Rod Rasmussen <rrasmussen@infoblox.com> wrote:
One thing that I would like to point out that we covered in the EWG and I think is one of many keys to solving many of the issues exposed here but is missing from this current debate is the concept that we do not have to come up with a “one size fits all” solution.
Its like - as Yogi Berra is alleged to have remarked - de ja vu all over again. We've been down this road before. The findings and guide to this place was published it in, what, 8 languages. I'm figuring wait it out with a little rope-a-dope. To be fair, I posted the article that birthed this round intended as a gentle reminder of what could happen, even to an agent provocateur like Spicer. -Carlton -Carlton -Carlton ============================== *Carlton A Samuels* *Mobile: 876-818-1799Strategy, Planning, Governance, Assessment & Turnaround* =============================
I am sorry you had that experience. Normally, if evidence is provided by the complainant that the whois is incorrect, most registrars will require that the registrant provides evidence that the updated data is correct, if only to avoid a follow-on complaint. If evidence suggests that the address is obviously and intentionally fake and the domain likely used in abuse, we may not even wait for the feedback of the customer before deactivating. Best, Volker Am 14.02.2017 um 19:34 schrieb allison nixon:
[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
On Tue, Feb 14, 2017 at 1:31 PM, Hollenbeck, Scott <shollenbeck@verisign.com <mailto:shollenbeck@verisign.com>> wrote:
*From:*gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] *On Behalf Of *allison nixon *Sent:* Tuesday, February 14, 2017 1:21 PM *To:* Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> *Cc:* RDS PDP WG <gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org>> *Subject:* [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
>>to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
[SAH] Actually, there **are** requirements to provide valid data and for registrars to perform validation processing:
https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whoi... <https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whoi...>
Scott
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this… I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured > in an unjust state" -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I'm sure you can find that information. You won't even need my WHOIS data to find it! On Tue, Feb 14, 2017 at 1:35 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann < vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se < benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek < jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: > > So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > > Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >> >> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >> >> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >> >> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >> >> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >> >> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >> >> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >> >> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >> >> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >> >> >> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco < sam@lanfranco.net> wrote: >> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >> >> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >> >> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >> >> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >> >> Sam L >> >> >> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >> All, >> >> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) >> >> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >> >> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >> >> Alex >> >> >> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >> >> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >> It’s definitely not an “edge case”. >> Regards >> Michele >> -- >> Mr Michele Neylon >> Blacknight Solutions >> Hosting, Colocation & Domains >> https://www.blacknight.com/ >> http://blacknight.blog/ >> Intl. +353 (0) 59 9183072 >> Direct Dial: +353 (0)59 9183090 >> Social: http://mneylon.social >> Some thoughts: http://ceo.hosting/ >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> -- >> *--------------------------------------------* >> "It is a disgrace to be rich and honoured >> in an unjust state" -Confucius >> ---------------------------------------------- >> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) >> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 >> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >> blog: http://samlanfranco.blogspot.com >> Phone: 613 476-0429 cell: 416-816-2852 >> >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> -- >> _________________________________ >> Note to self: Pillage BEFORE burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Benny, All WG members have submitted Statements of Interest. A link is provided for each one on the membership list on the WG wiki: https://community.icann.org/pages/viewpage.action?pageId=56986659 Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 1:35 PM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this… I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to > “thick data” (i.e. data that includes email). I know we are > all super excited to talk about “thick data” but I don’t > think we are there yet (are we? Hopefully I didn’t miss the > party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured in an unjust state" > -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York > U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ Note to self: Pillage > BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Benny, Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information. Thanks, Kiran Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this… I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to > “thick data” (i.e. data that includes email). I know we are > all super excited to talk about “thick data” but I don’t > think we are there yet (are we? Hopefully I didn’t miss the > party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured in an unjust state" > -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York > U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ Note to self: Pillage > BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I will admit that stupid was a bad choice of word. But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis. That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted. If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want? I doubt it.... Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: > > So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > How can anyone defend that we have data published to get > abused just because some bad guys registrer domains? And those > of you who does will still have access to the date just not in > the same easy way… > > Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >> >> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >> >> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >> >> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >> >> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >> >> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >> >> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >> >> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >> >> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >> >> >> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >> >> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >> >> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >> >> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >> >> Sam L >> >> >> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >> All, >> >> So it seems the debate has progressed from “thin data” to >> “thick data” (i.e. data that includes email). I know we are >> all super excited to talk about “thick data” but I don’t >> think we are there yet (are we? Hopefully I didn’t miss the >> party…) >> >> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >> >> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >> >> Alex >> >> >> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >> >> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >> It’s definitely not an “edge case”. >> Regards >> Michele >> -- >> Mr Michele Neylon >> Blacknight Solutions >> Hosting, Colocation & Domains >> https://www.blacknight.com/ >> http://blacknight.blog/ >> Intl. +353 (0) 59 9183072 >> Direct Dial: +353 (0)59 9183090 >> Social: http://mneylon.social >> Some thoughts: http://ceo.hosting/ >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> -- >> *--------------------------------------------* >> "It is a disgrace to be rich and honoured in an unjust state" >> -Confucius >> ---------------------------------------------- >> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >> U., Toronto, Ontario, CANADA - M3J 1P3 >> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >> blog: http://samlanfranco.blogspot.com >> Phone: 613 476-0429 cell: 416-816-2852 >> >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> -- >> _________________________________ Note to self: Pillage >> BEFORE burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Why would the cost of owning a domain name be giving up sensitive private information when there are so many alternatives? Contactable information does not mean information that makes you vulnerable. Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 1:41 PM, "benny@nordreg.se" <benny@nordreg.se> wrote:
I will admit that stupid was a bad choice of word.
But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis.
That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted.
If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want?
I doubt it....
Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote: > > Let me translate Allison's comments in the light of your mockery. > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > Sent from my iPhone > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >> >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >> How can anyone defend that we have data published to get >> abused just because some bad guys registrer domains? And those >> of you who does will still have access to the date just not in >> the same easy way… >> >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>> >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>> >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>> >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>> >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>> >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>> >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>> >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>> >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>> >>> >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>> >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>> >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>> >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>> >>> Sam L >>> >>> >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>> All, >>> >>> So it seems the debate has progressed from “thin data” to >>> “thick data” (i.e. data that includes email). I know we are >>> all super excited to talk about “thick data” but I don’t >>> think we are there yet (are we? Hopefully I didn’t miss the >>> party…) >>> >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>> >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>> >>> Alex >>> >>> >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>> >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>> It’s definitely not an “edge case”. >>> Regards >>> Michele >>> -- >>> Mr Michele Neylon >>> Blacknight Solutions >>> Hosting, Colocation & Domains >>> https://www.blacknight.com/ >>> http://blacknight.blog/ >>> Intl. +353 (0) 59 9183072 >>> Direct Dial: +353 (0)59 9183090 >>> Social: http://mneylon.social >>> Some thoughts: http://ceo.hosting/ >>> ------------------------------- >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> -- >>> *--------------------------------------------* >>> "It is a disgrace to be rich and honoured in an unjust state" >>> -Confucius >>> ---------------------------------------------- >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >>> U., Toronto, Ontario, CANADA - M3J 1P3 >>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>> blog: http://samlanfranco.blogspot.com >>> Phone: 613 476-0429 cell: 416-816-2852 >>> >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> >>> >>> -- >>> _________________________________ Note to self: Pillage >>> BEFORE burning. >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Oh sorry I forgot that it was stated that just give fake info and you are safe... That's in my opinion a sign of a sick system which badly need to be fixed! I will point to a previous post with .SE which have a build in protection of private registered domains, people gives correct data because they can trust the system for not leaking data. Are there abuse cases, yes but they are solvable even with the non public data But if you have a good example of a cost free alternative solution which will work in any jurisdiction I will be happy to hear about it. It will probably educate others too with knowledge... Sent from my iPhone
On 14 Feb 2017, at 22:48, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com> wrote:
Why would the cost of owning a domain name be giving up sensitive private information when there are so many alternatives? Contactable information does not mean information that makes you vulnerable.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 1:41 PM, "benny@nordreg.se" <benny@nordreg.se> wrote:
I will admit that stupid was a bad choice of word.
But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis.
That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted.
If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want?
I doubt it....
Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
> Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
> Well it might be so, but every singel person “claiming” they use > whois for investigation seems to lack the understanding that they > will get the access it will just be a little harder to get the > normal misuse of whois info can be prevented but looks like noen of > you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
> I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote: > > Benny, dude, you just wrote "Buhu my work will get harder", so > please don't complain about adult and mature answers > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: > A very adult and mature answer… with some nice baked in threats, > funny its only your kind of crimes which matter apparantly… oh > and the final on which always are been draged out when there are > no more arguments, think about the one child we can save… > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > In you ignorance you completely miss the point that by have all > these data public there are commited crimes every minut by using > those data nut hey what does that matter as long as you business > can roll on… I guess those people will thank you for you helpful > insights… > > Welcome to the discussion > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote: >> >> Let me translate Allison's comments in the light of your mockery. >> >> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >> >> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >> >> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >> >> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >> >> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >> >> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >> >> Sent from my iPhone >> >>> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >>> >>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>> How can anyone defend that we have data published to get >>> abused just because some bad guys registrer domains? And those >>> of you who does will still have access to the date just not in >>> the same easy way… >>> >>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>> >>> >>> -- >>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>> >>> Benny Samuelsen >>> Registry Manager - Domainexpert >>> >>> Nordreg AB - ICANN accredited registrar >>> IANA-ID: 638 >>> Phone: +46.42197080 >>> Direct: +47.32260201 >>> Mobile: +47.40410200 >>> >>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>>> >>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>> >>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>> >>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>> >>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>> >>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>> >>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>> >>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>> >>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>> >>>> >>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>> >>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>> >>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>> >>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>> >>>> Sam L >>>> >>>> >>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>> All, >>>> >>>> So it seems the debate has progressed from “thin data” to >>>> “thick data” (i.e. data that includes email). I know we are >>>> all super excited to talk about “thick data” but I don’t >>>> think we are there yet (are we? Hopefully I didn’t miss the >>>> party…) >>>> >>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>> >>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>> >>>> Alex >>>> >>>> >>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>>> >>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>> It’s definitely not an “edge case”. >>>> Regards >>>> Michele >>>> -- >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting, Colocation & Domains >>>> https://www.blacknight.com/ >>>> http://blacknight.blog/ >>>> Intl. +353 (0) 59 9183072 >>>> Direct Dial: +353 (0)59 9183090 >>>> Social: http://mneylon.social >>>> Some thoughts: http://ceo.hosting/ >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> -- >>>> *--------------------------------------------* >>>> "It is a disgrace to be rich and honoured in an unjust state" >>>> -Confucius >>>> ---------------------------------------------- >>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >>>> U., Toronto, Ontario, CANADA - M3J 1P3 >>>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>>> blog: http://samlanfranco.blogspot.com >>>> Phone: 613 476-0429 cell: 416-816-2852 >>>> >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> >>>> >>>> -- >>>> _________________________________ Note to self: Pillage >>>> BEFORE burning. >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > -- > _________________________________ Note to self: Pillage BEFORE > burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
What would the WHOIS data be used for once it is made private? Why would people want to supply correct, or any, data? If it isn't used for financial transactions with the registrar, and can no longer be used as a public contact "phone book", then aside from criminal investigations what is the point of this? On Tue, Feb 14, 2017 at 5:02 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Oh sorry I forgot that it was stated that just give fake info and you are safe...
That's in my opinion a sign of a sick system which badly need to be fixed!
I will point to a previous post with .SE which have a build in protection of private registered domains, people gives correct data because they can trust the system for not leaking data. Are there abuse cases, yes but they are solvable even with the non public data
But if you have a good example of a cost free alternative solution which will work in any jurisdiction I will be happy to hear about it. It will probably educate others too with knowledge...
Sent from my iPhone
On 14 Feb 2017, at 22:48, Kiran Malancharuvil <Kiran.Malancharuvil@ markmonitor.com> wrote:
Why would the cost of owning a domain name be giving up sensitive private information when there are so many alternatives? Contactable information does not mean information that makes you vulnerable.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 1:41 PM, "benny@nordreg.se" <benny@nordreg.se> wrote:
I will admit that stupid was a bad choice of word.
But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis.
That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted.
If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want?
I doubt it....
Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil <Kiran.Malancharuvil@ markmonitor.com> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg- bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
> to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
> to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
> And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
> Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann < vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
>> Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
>> Well it might be so, but every singel person “claiming” they use >> whois for investigation seems to lack the understanding that they >> will get the access it will just be a little harder to get the >> normal misuse of whois info can be prevented but looks like noen of >> you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
>> I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <benny@nordreg.se> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote: > > Hi Benny, > > Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts. > > John Horton > President and CEO, LegitScript > > > Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | > Google+ > > > > On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <benny@nordreg.se> wrote: > Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote: >> >> Benny, dude, you just wrote "Buhu my work will get harder", so >> please don't complain about adult and mature answers >> >> On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se < benny@nordreg.se> wrote: >> A very adult and mature answer… with some nice baked in threats, >> funny its only your kind of crimes which matter apparantly… oh >> and the final on which always are been draged out when there are >> no more arguments, think about the one child we can save… >> >> To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. >> In you ignorance you completely miss the point that by have all >> these data public there are commited crimes every minut by using >> those data nut hey what does that matter as long as you business >> can roll on… I guess those people will thank you for you helpful >> insights… >> >> Welcome to the discussion >> >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 14 Feb 2017, at 17:29, John Bambenek < jcb@bambenekconsulting.com> wrote: >>> >>> Let me translate Allison's comments in the light of your mockery. >>> >>> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >>> >>> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >>> >>> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >>> >>> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >>> >>> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >>> >>> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >>> >>> Sent from my iPhone >>> >>>> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >>>> >>>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>>> How can anyone defend that we have data published to get >>>> abused just because some bad guys registrer domains? And those >>>> of you who does will still have access to the date just not in >>>> the same easy way… >>>> >>>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>>> >>>> >>>> -- >>>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>>> >>>> Benny Samuelsen >>>> Registry Manager - Domainexpert >>>> >>>> Nordreg AB - ICANN accredited registrar >>>> IANA-ID: 638 >>>> Phone: +46.42197080 >>>> Direct: +47.32260201 >>>> Mobile: +47.40410200 >>>> >>>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>>>> >>>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>>> >>>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>>> >>>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>>> >>>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>>> >>>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>>> >>>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>>> >>>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>>> >>>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>>> >>>>> >>>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco < sam@lanfranco.net> wrote: >>>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>>> >>>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>>> >>>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>>> >>>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>>> >>>>> Sam L >>>>> >>>>> >>>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>>> All, >>>>> >>>>> So it seems the debate has progressed from “thin data” to >>>>> “thick data” (i.e. data that includes email). I know we are >>>>> all super excited to talk about “thick data” but I don’t >>>>> think we are there yet (are we? Hopefully I didn’t miss the >>>>> party…) >>>>> >>>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>>> >>>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>>> >>>>> Alex >>>>> >>>>> >>>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>>>> >>>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>>> It’s definitely not an “edge case”. >>>>> Regards >>>>> Michele >>>>> -- >>>>> Mr Michele Neylon >>>>> Blacknight Solutions >>>>> Hosting, Colocation & Domains >>>>> https://www.blacknight.com/ >>>>> http://blacknight.blog/ >>>>> Intl. +353 (0) 59 9183072 >>>>> Direct Dial: +353 (0)59 9183090 >>>>> Social: http://mneylon.social >>>>> Some thoughts: http://ceo.hosting/ >>>>> ------------------------------- >>>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> -- >>>>> *--------------------------------------------* >>>>> "It is a disgrace to be rich and honoured in an unjust state" >>>>> -Confucius >>>>> ---------------------------------------------- >>>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >>>>> U., Toronto, Ontario, CANADA - M3J 1P3 >>>>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>>>> blog: http://samlanfranco.blogspot.com >>>>> Phone: 613 476-0429 cell: 416-816-2852 >>>>> >>>>> >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> >>>>> >>>>> -- >>>>> _________________________________ Note to self: Pillage >>>>> BEFORE burning. >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> >> -- >> _________________________________ Note to self: Pillage BEFORE >> burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Proof of ownership of the registration for example The hidden data can be turned public for getting a ssl certificate and then hidden again I am not saying it's a perfect solution but a start to think different from what we have today in the gTLD world Sent from my iPhone On 14 Feb 2017, at 23:11, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: What would the WHOIS data be used for once it is made private? Why would people want to supply correct, or any, data? If it isn't used for financial transactions with the registrar, and can no longer be used as a public contact "phone book", then aside from criminal investigations what is the point of this? On Tue, Feb 14, 2017 at 5:02 PM, benny@nordreg.se<mailto:benny@nordreg.se> <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Oh sorry I forgot that it was stated that just give fake info and you are safe... That's in my opinion a sign of a sick system which badly need to be fixed! I will point to a previous post with .SE which have a build in protection of private registered domains, people gives correct data because they can trust the system for not leaking data. Are there abuse cases, yes but they are solvable even with the non public data But if you have a good example of a cost free alternative solution which will work in any jurisdiction I will be happy to hear about it. It will probably educate others too with knowledge... Sent from my iPhone
On 14 Feb 2017, at 22:48, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com<mailto:Kiran.Malancharuvil@markmonitor.com>> wrote:
Why would the cost of owning a domain name be giving up sensitive private information when there are so many alternatives? Contactable information does not mean information that makes you vulnerable.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138<tel:415-419-9138> (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 1:41 PM, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote:
I will admit that stupid was a bad choice of word.
But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis.
That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted.
If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want?
I doubt it....
Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil <Kiran.Malancharuvil@markmonitor.com<mailto:Kiran.Malancharuvil@markmonitor.com>> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318<tel:415.222.8318> (t) 415.419.9138<tel:415.419.9138> (m) www.markmonitor.com<http://www.markmonitor.com>
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of benny@nordreg.se<mailto:benny@nordreg.se> Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org>> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080<tel:%2B46.42197080> Direct: +47.32260201<tel:%2B47.32260201> Mobile: +47.40410200<tel:%2B47.40410200>
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote:
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
> Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
> Well it might be so, but every singel person “claiming” they use > whois for investigation seems to lack the understanding that they > will get the access it will just be a little harder to get the > normal misuse of whois info can be prevented but looks like noen of > you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
> I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se<mailto:benny@nordreg.se> <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080<tel:%2B46.42197080> Direct: +47.32260201<tel:%2B47.32260201> Mobile: +47.40410200<tel:%2B47.40410200>
On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com<mailto:john.horton@legitscript.com>> wrote:
Hi Benny,
Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts.
John Horton President and CEO, LegitScript
Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+
On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se<mailto:benny@nordreg.se> <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080<tel:%2B46.42197080> Direct: +47.32260201<tel:%2B47.32260201> Mobile: +47.40410200<tel:%2B47.40410200>
> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: > > Benny, dude, you just wrote "Buhu my work will get harder", so > please don't complain about adult and mature answers > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se<mailto:benny@nordreg.se> <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: > A very adult and mature answer… with some nice baked in threats, > funny its only your kind of crimes which matter apparantly… oh > and the final on which always are been draged out when there are > no more arguments, think about the one child we can save… > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > In you ignorance you completely miss the point that by have all > these data public there are commited crimes every minut by using > those data nut hey what does that matter as long as you business > can roll on… I guess those people will thank you for you helpful > insights… > > Welcome to the discussion > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com<mailto:jcb@bambenekconsulting.com>> wrote: >> >> Let me translate Allison's comments in the light of your mockery. >> >> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >> >> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >> >> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >> >> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >> >> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >> >> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >> >> Sent from my iPhone >> >>> On Feb 14, 2017, at 05:28, "benny@nordreg.se<mailto:benny@nordreg.se>" <benny@nordreg.se<mailto:benny@nordreg.se>> wrote: >>> >>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>> How can anyone defend that we have data published to get >>> abused just because some bad guys registrer domains? And those >>> of you who does will still have access to the date just not in >>> the same easy way… >>> >>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>> >>> >>> -- >>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>> >>> Benny Samuelsen >>> Registry Manager - Domainexpert >>> >>> Nordreg AB - ICANN accredited registrar >>> IANA-ID: 638 >>> Phone: +46.42197080 >>> Direct: +47.32260201 >>> Mobile: +47.40410200 >>> >>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com<mailto:elsakoo@gmail.com>> wrote: >>>> >>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>> >>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>> >>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>> >>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>> >>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>> >>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>> >>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>> >>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>> >>>> >>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net<mailto:sam@lanfranco.net>> wrote: >>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>> >>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>> >>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>> >>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>> >>>> Sam L >>>> >>>> >>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>> All, >>>> >>>> So it seems the debate has progressed from “thin data” to >>>> “thick data” (i.e. data that includes email). I know we are >>>> all super excited to talk about “thick data” but I don’t >>>> think we are there yet (are we? Hopefully I didn’t miss the >>>> party…) >>>> >>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>> >>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>> >>>> Alex >>>> >>>> >>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com<mailto:michele@blacknight.com>> wrote: >>>> >>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>> It’s definitely not an “edge case”. >>>> Regards >>>> Michele >>>> -- >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting, Colocation & Domains >>>> https://www.blacknight.com/ >>>> http://blacknight.blog/ >>>> Intl. +353 (0) 59 9183072 >>>> Direct Dial: +353 (0)59 9183090 >>>> Social: http://mneylon.social >>>> Some thoughts: http://ceo.hosting/ >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> -- >>>> *--------------------------------------------* >>>> "It is a disgrace to be rich and honoured in an unjust state" >>>> -Confucius >>>> ---------------------------------------------- >>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >>>> U., Toronto, Ontario, CANADA - M3J 1P3 >>>> YorkU email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco >>>> blog: http://samlanfranco.blogspot.com >>>> Phone: 613 476-0429 cell: 416-816-2852 >>>> >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> >>>> >>>> -- >>>> _________________________________ Note to self: Pillage >>>> BEFORE burning. >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > -- > _________________________________ Note to self: Pillage BEFORE > burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
______________________________ _________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>
Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu<http://www.keydrive.lu>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901
Fax.: +49 (0) 6894 - 9396 851
Email: vgreimann@key-systems.net<mailto:vgreimann@key-systems.net>
Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net> www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com>
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems>
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu<http://www.keydrive.lu>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
One of many domain ownership verification schemes (adding a TXT record is another one) Is that going to be the only use? Seriously? Has there been any consideration for the actual use cases of a private WHOIS system? On Tue, Feb 14, 2017 at 5:21 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Proof of ownership of the registration for example The hidden data can be turned public for getting a ssl certificate and then hidden again
I am not saying it's a perfect solution but a start to think different from what we have today in the gTLD world
Sent from my iPhone
On 14 Feb 2017, at 23:11, allison nixon <elsakoo@gmail.com> wrote:
What would the WHOIS data be used for once it is made private? Why would people want to supply correct, or any, data? If it isn't used for financial transactions with the registrar, and can no longer be used as a public contact "phone book", then aside from criminal investigations what is the point of this?
On Tue, Feb 14, 2017 at 5:02 PM, benny@nordreg.se <benny@nordreg.se> wrote:
Oh sorry I forgot that it was stated that just give fake info and you are safe...
That's in my opinion a sign of a sick system which badly need to be fixed!
I will point to a previous post with .SE which have a build in protection of private registered domains, people gives correct data because they can trust the system for not leaking data. Are there abuse cases, yes but they are solvable even with the non public data
But if you have a good example of a cost free alternative solution which will work in any jurisdiction I will be happy to hear about it. It will probably educate others too with knowledge...
Sent from my iPhone
On 14 Feb 2017, at 22:48, Kiran Malancharuvil < Kiran.Malancharuvil@markmonitor.com> wrote:
Why would the cost of owning a domain name be giving up sensitive private information when there are so many alternatives? Contactable information does not mean information that makes you vulnerable.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 1:41 PM, "benny@nordreg.se" <benny@nordreg.se> wrote:
I will admit that stupid was a bad choice of word.
But we all know that most people don't read the info about privacy and what they agree too by accepting conditions and so on. I will still argue that that is not an excuse for not making a better system which prevent public data in Whois to be abused on a daily basis.
That can't be all put on the registrars responsibility it must be anchored through policy and community support through a system that provide the best possible solution for all parts. If that is realistic is another question which only time will show what we can deliver as a united group were compromises from all must be admitted.
If owning a domain are a privilege and the cost are giving up you private info receiving spam and your date being used for fraud and ID theft then we can just conclude that personal domains are only for the elite who pay the extra costs of privacy and the rest can sell their souls to Google, Microsoft or some of the others with so-called free services. But is that what we really want?
I doubt it....
Sent from my iPhone
On 14 Feb 2017, at 22:10, Kiran Malancharuvil < Kiran.Malancharuvil@markmonitor.com> wrote:
Benny,
Perhaps you recall in the article that sparked this discussion that even the author acknowledges that education about Whois and who has access to the data may be key to avoid disclosure of sensitive data, and perhaps that is the responsibility of the Registrar. I don't think anyone suggested that only "stupid people" put in real addresses. Lack of education about something doesn't mean you're stupid, it may mean you weren't given the proper education and resources. With the proper education and resources, perhaps people will do what they do whenever they have to give an address for public records (such as business incorporation documents), e.g.: create a d/b/a. After all, it's not as if everyone is forced to own a domain name and forced to put in home contact information. Like owning a business, owning a domain name is a privilege that should (of course) be afforded to as many people as possible, according to desire and (perhaps) comes with some responsibilities such as providing contactable information.
Thanks,
Kiran
Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto: gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 10:35 AM To: allison nixon <elsakoo@gmail.com> Cc: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
Can you please reveal where you work and you job title? I would love to put these advices forward to ICANN compliance when we will be held up for allowing this…
I would be very helpful to have a good reference saying that only stupid people put in there real adress -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:20, allison nixon <elsakoo@gmail.com> wrote:
>> to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
>> to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions.
>> And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. You should thank the people defending your networks, and the people defending the networks of companies you do business with.
>> Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group.
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann < vgreimann@key-systems.net> wrote: Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has. Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results. Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon: >>> Here you go with the edge cases again. > > The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them. > > Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue. > >>> Well it might be so, but every singel person “claiming” they use >>> whois for investigation seems to lack the understanding that they >>> will get the access it will just be a little harder to get the >>> normal misuse of whois info can be prevented but looks like noen of >>> you want that to happen > > Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse. > >>> I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something. > > You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed. > > How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience. > > > > On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se < benny@nordreg.se> wrote: > Hi John > > None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. > But the attitude which I see where the Status Quo are the driver for > the discussions are not really productive… > > Everything can be changed with new privacy laws coming in to force > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com> wrote: >> >> Hi Benny, >> >> Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts. >> >> John Horton >> President and CEO, LegitScript >> >> >> Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | >> Google+ >> >> >> >> On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se < benny@nordreg.se> wrote: >> Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote: >>> >>> Benny, dude, you just wrote "Buhu my work will get harder", so >>> please don't complain about adult and mature answers >>> >>> On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se < benny@nordreg.se> wrote: >>> A very adult and mature answer… with some nice baked in threats, >>> funny its only your kind of crimes which matter apparantly… oh >>> and the final on which always are been draged out when there are >>> no more arguments, think about the one child we can save… >>> >>> To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. >>> In you ignorance you completely miss the point that by have all >>> these data public there are commited crimes every minut by using >>> those data nut hey what does that matter as long as you business >>> can roll on… I guess those people will thank you for you helpful >>> insights… >>> >>> Welcome to the discussion >>> >>> >>> >>> -- >>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>> >>> Benny Samuelsen >>> Registry Manager - Domainexpert >>> >>> Nordreg AB - ICANN accredited registrar >>> IANA-ID: 638 >>> Phone: +46.42197080 <+46%2042%2019%2070%2080> >>> Direct: +47.32260201 <+47%2032%2026%2002%2001> >>> Mobile: +47.40410200 <+47%20404%2010%20200> >>> >>>> On 14 Feb 2017, at 17:29, John Bambenek < jcb@bambenekconsulting.com> wrote: >>>> >>>> Let me translate Allison's comments in the light of your mockery. >>>> >>>> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >>>> >>>> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >>>> >>>> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >>>> >>>> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >>>> >>>> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >>>> >>>> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >>>> >>>> Sent from my iPhone >>>> >>>>> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >>>>> >>>>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>>>> How can anyone defend that we have data published to get >>>>> abused just because some bad guys registrer domains? And those >>>>> of you who does will still have access to the date just not in >>>>> the same easy way… >>>>> >>>>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>>>> >>>>> >>>>> -- >>>>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>>>> >>>>> Benny Samuelsen >>>>> Registry Manager - Domainexpert >>>>> >>>>> Nordreg AB - ICANN accredited registrar >>>>> IANA-ID: 638 >>>>> Phone: +46.42197080 <+46%2042%2019%2070%2080> >>>>> Direct: +47.32260201 <+47%2032%2026%2002%2001> >>>>> Mobile: +47.40410200 <+47%20404%2010%20200> >>>>> >>>>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>>>>> >>>>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>>>> >>>>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>>>> >>>>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>>>> >>>>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>>>> >>>>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>>>> >>>>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>>>> >>>>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>>>> >>>>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>>>> >>>>>> >>>>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco < sam@lanfranco.net> wrote: >>>>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>>>> >>>>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>>>> >>>>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>>>> >>>>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>>>> >>>>>> Sam L >>>>>> >>>>>> >>>>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>>>> All, >>>>>> >>>>>> So it seems the debate has progressed from “thin data” to >>>>>> “thick data” (i.e. data that includes email). I know we are >>>>>> all super excited to talk about “thick data” but I don’t >>>>>> think we are there yet (are we? Hopefully I didn’t miss the >>>>>> party…) >>>>>> >>>>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>>>> >>>>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>>>> >>>>>> Alex >>>>>> >>>>>> >>>>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>>>>> >>>>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>>>> It’s definitely not an “edge case”. >>>>>> Regards >>>>>> Michele >>>>>> -- >>>>>> Mr Michele Neylon >>>>>> Blacknight Solutions >>>>>> Hosting, Colocation & Domains >>>>>> https://www.blacknight.com/ >>>>>> http://blacknight.blog/ >>>>>> Intl. +353 (0) 59 9183072 <+353%2059%20918%203072> >>>>>> Direct Dial: +353 (0)59 9183090 <+353%2059%20918%203090> >>>>>> Social: http://mneylon.social >>>>>> Some thoughts: http://ceo.hosting/ >>>>>> ------------------------------- >>>>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>>>> _______________________________________________ >>>>>> gnso-rds-pdp-wg mailing list >>>>>> gnso-rds-pdp-wg@icann.org >>>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>>> >>>>>> _______________________________________________ >>>>>> gnso-rds-pdp-wg mailing list >>>>>> gnso-rds-pdp-wg@icann.org >>>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>>> >>>>>> -- >>>>>> *--------------------------------------------* >>>>>> "It is a disgrace to be rich and honoured in an unjust state" >>>>>> -Confucius >>>>>> ---------------------------------------------- >>>>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >>>>>> U., Toronto, Ontario, CANADA - M3J 1P3 >>>>>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>>>>> blog: http://samlanfranco.blogspot.com >>>>>> Phone: 613 476-0429 <(613)%20476-0429> cell: 416-816-2852 <(416)%20816-2852> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> gnso-rds-pdp-wg mailing list >>>>>> gnso-rds-pdp-wg@icann.org >>>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> _________________________________ Note to self: Pillage >>>>>> BEFORE burning. >>>>> >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> >>> >>> >>> -- >>> _________________________________ Note to self: Pillage BEFORE >>> burning. >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> > > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning. > > > ______________________________ > _________________ > gnso-rds-pdp-wg mailing list > > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901>
Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851>
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
------------------------------ --------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <+49%206894%209396901>
Fax.: +49 (0) 6894 - 9396 851 <+49%206894%209396851>
Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
-- _________________________________ Note to self: Pillage BEFORE burning.
Hi Allison,
So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a fake email. No one is forcing you to disclose more than you want to. And the only people who disclose too much are doing so by mistake, not by coercion.
That would be providing incorrect whois data and can trigger an investigation by ICANN and the registrar, if noticed. Not a good idea. Let's not make the option to violate registration policy an argument against protection of private data.
Because when I purchase something from Amazon, I need to give my credit card number, address, zip, etc. Similarly, we do not get payment details from the registrar, even though they require billing address and zip code, which is a completely different dataset than the zip codes in WHOIS data. WHOIS data is completely arbitrary and not required to complete any transactions. Ah, you misunderstood me. I meant that when I, a customer, get ripped off by an Amazon marketplace seller, Amazon will in all likelyhood not provide me with all data they have on the culprit. Even the police may need a subpoena. Your comparisons between anti-abuse and rent-a-cops further demonstrates your disrespect. Does it? Is that not the established term for all forms of security services that is not empowered by the state? I am happy to allow law enforcement to fully take over this work, but this field has not matured enough yet, and the literacy just isn't there. Sad, but true. My experience confirms this as well. The skills, experience, and power rests almost fully in the private sector. This isn't some mall cop operation. Don't knock on mall cops. They do important work too and are most likely specialists for their limited area as well. It's the last line of defense between you and all manner of bad things happening to you. You might not like that, and you probably don't want to recognize that as legitimate, but it's reality. I consider their work as legitimate, but they operate without any official authority. The only authority they have is voluntarily given based on their past work and their conduct. I think that this is the important distinction to make: legitimate vs authorized. And it shows how bad the situation is when an operation of this quality is still the best and most used blocklist out there. When the volume of abuse is so high that "due process" is, literally, a mathematically impossible order. And despite all of those flaws, their actions do more to protect privacy than anything discussed in this working group. There has to be some form of due process, anything else is anarchy.
Best, Volker
On Tue, Feb 14, 2017 at 1:03 PM, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Hi Allion,
to your first point: the right to privacy of ones own data may be different where I live and where you live. Suffice it to say that in our day-to-day business we get eough complaints from customers who feel their rivacy has been violated either by our putting their data out for everyone to see or by customers of ours who provide services that do the same. And we both agree that whois privacy will not protect you 100%.
to your second point: why is requiring the same legal standard for accessing data of customers of hosting service providers, of ebay account holders, of Amazon sellers and many other areas where the data is not public suddenly not feasible for customers of domain name registrars? Our privacy service gets regular subpoenas for data of customers. Why is making that the standard suddenly the end of the world?
And while I appreciate the good work that many like John are doing on a private level, ultimately they are not law enforcement and are not entitled to the same level of access as law enforcement has just like a rent-a-cop does not have the same law enforcement powers a real cop has.
Re:Spamhaus: I have worked with them and while they provide a valuable anti-spam service, some of their methods or publications leave a lot to be desired. The fact that they ofter outright refuse to provide evidence of their claims, the fact that they outright lie to ICANN compliance, and the fact that they bend numbers anyway they need to fit their narrative do not help to build trust and work with them as partners. I think they provide a good service but ultimately they are vigilantes and often overshoot their mark. This "study" is one such instance where they present a result without allowing the reader to look at the work that led to the result. And that makes it worthless for peer review or for basing anything on their results.
Best,
Volker
Am 14.02.2017 um 18:39 schrieb allison nixon:
>>Here you go with the edge cases again.
The mother of all edge cases is the main contention of this entire working group. The theory that an innocent domain registrant's privacy is either "violated" or "not violated" and that this somehow hinges on the privacy status of the WHOIS data. This is absolutely a false premise. If I want to find someone, and they frequently use the Internet and aren't extremely OPSEC-aware, I'm going to find them. WHOIS privacy absolutely will not protect them.
Does anyone believe this premise that also has experience in investigations? I do not believe any such person exists, because when you are experienced in tracking people down, you will know that this premise is factually untrue.
>>Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen
Is this an assurance? Because the talk I see here is about requiring paperwork like subpeonas and search warrants and that isn't feasible both from an investigation or automation standpoint as well as the fact that the vast majority of the anti-abuse community are not cops. There's no sign whatsoever that there is consideration towards anti-abuse.
>>I trust these statistics by spamhaus less than anything coming out of the mouth of the orange menace. And that is saying something.
You stand alone in that opinion. Spamhaus is not perfect but they are the most widely used blocklists among network operators. The amount of harm prevented by Spamhaus's block lists eclipses the harm prevented by registrants receiving WHOIS spam. It is like comparing the size of the sun to the size of an ant. If you have ever tried to operate from infrastructure that's on Spamhaus's block lists, your access to the Internet at large will be very poor indeed.
How many of you people actually have day to day experience in fighting spam and preventing the massive privacy invasions that happen on a daily basis to innocent people? I am getting the feeling that this group badly needs to gain some perspective. WHOIS spam is a problem and is an annoyance, privacy is important, but this group keeps talking about WHOIS privacy and completely ignoring the fact that by volume such a scheme would cause great harms for mostly imaginary gain. To me this shows a sign that many of the arguments here are about idealism without practical experience.
On Tue, Feb 14, 2017 at 12:24 PM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Hi John
None in the group can do that, just as little as the opposite if we dont work together on the needs, give and take on it, we will not move forward. But the attitude which I see where the Status Quo are the driver for the discussions are not really productive…
Everything can be changed with new privacy laws coming in to force
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 <tel:%2B46.42197080> Direct: +47.32260201 <tel:%2B47.32260201> Mobile: +47.40410200 <tel:%2B47.40410200>
> On 14 Feb 2017, at 18:18, John Horton <john.horton@legitscript.com <mailto:john.horton@legitscript.com>> wrote: > > Hi Benny, > > Let me try to dig into that a little bit with a serious question. What assurance do those of us engaged in cybercrime investigation -- or not yet created organizations that are legitimate -- have that we would have the same level of access in the future? Is it possible for this group to make that assurance? To be sure, this isn't my only concern or objection, but part of what I'm trying to get at is: even if those of us on this working group were to agree that cybercrime-mitigation entities should have the same access we have today, what's to prevent a stricter regime from changing the rules in the future? In other words, if we create a system that empowers one central organization to say that Allison's reasons (for example) are valid now, there's nothing to prevent that organization from deciding to block her in the future because they don't believe her reasons for investigating cybercrime are valid. Put another way, my concern isn't that you personally or anyone on this group wants to block cybercrime mitigation from happening -- rather, I'm wondering how this group could bind a future RDS 1, 5 or 10 years down the road not to change the goalposts. > > John Horton > President and CEO, LegitScript > > > Follow LegitScript: LinkedIn | Facebook | Twitter | Blog | Google+ > > > > On Tue, Feb 14, 2017 at 9:05 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 <tel:%2B46.42197080> > Direct: +47.32260201 <tel:%2B47.32260201> > Mobile: +47.40410200 <tel:%2B47.40410200> > > > On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > > > Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers > > > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > > A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… > > > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > > In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… > > > > Welcome to the discussion > > > > > > > > -- > > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > > > Benny Samuelsen > > Registry Manager - Domainexpert > > > > Nordreg AB - ICANN accredited registrar > > IANA-ID: 638 > > Phone: +46.42197080 <tel:%2B46.42197080> > > Direct: +47.32260201 <tel:%2B47.32260201> > > Mobile: +47.40410200 <tel:%2B47.40410200> > > > > > On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com <mailto:jcb@bambenekconsulting.com>> wrote: > > > > > > Let me translate Allison's comments in the light of your mockery. > > > > > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > > > > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > > > > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > > > > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > > > > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > > > > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > > > > > Sent from my iPhone > > > > > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote: > > >> > > >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > > >> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > > >> > > >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > >> > > >> > > >> -- > > >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > >> > > >> Benny Samuelsen > > >> Registry Manager - Domainexpert > > >> > > >> Nordreg AB - ICANN accredited registrar > > >> IANA-ID: 638 > > >> Phone: +46.42197080 <tel:%2B46.42197080> > > >> Direct: +47.32260201 <tel:%2B47.32260201> > > >> Mobile: +47.40410200 <tel:%2B47.40410200> > > >> > > >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com <mailto:elsakoo@gmail.com>> wrote: > > >>> > > >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > >>> > > >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > >>> > > >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > >>> > > >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > >>> > > >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > >>> > > >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > >>> > > >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > >>> > > >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > >>> > > >>> > > >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net <mailto:sam@lanfranco.net>> wrote: > > >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > >>> > > >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > >>> > > >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > >>> > > >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > >>> > > >>> Sam L > > >>> > > >>> > > >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: > > >>> All, > > >>> > > >>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > >>> > > >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > >>> > > >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > >>> > > >>> Alex > > >>> > > >>> > > >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com <mailto:michele@blacknight.com>> wrote: > > >>> > > >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > > >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) > > >>> It’s definitely not an “edge case”. > > >>> Regards > > >>> Michele > > >>> -- > > >>> Mr Michele Neylon > > >>> Blacknight Solutions > > >>> Hosting, Colocation & Domains > > >>> https://www.blacknight.com/ > > >>> http://blacknight.blog/ > > >>> Intl. +353 (0) 59 9183072 <tel:+353%2059%20918%203072> > > >>> Direct Dial: +353 (0)59 9183090 > > >>> Social: http://mneylon.social > > >>> Some thoughts: http://ceo.hosting/ > > >>> ------------------------------- > > >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > > >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> -- > > >>> *--------------------------------------------* > > >>> "It is a disgrace to be rich and honoured > > >>> in an unjust state" -Confucius > > >>> ---------------------------------------------- > > >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > > >>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > > >>> YorkU email: Lanfran@Yorku.ca <mailto:Lanfran@Yorku.ca> Skype: slanfranco > > >>> blog: http://samlanfranco.blogspot.com <http://samlanfranco.blogspot.com> > > >>> Phone: 613 476-0429 <tel:%28613%29%20476-0429> cell: 416-816-2852 <tel:%28416%29%20816-2852> > > >>> > > >>> > > >>> _______________________________________________ > > >>> gnso-rds-pdp-wg mailing list > > >>> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > >>> > > >>> > > >>> > > >>> -- > > >>> _________________________________ > > >>> Note to self: Pillage BEFORE burning. > > >> > > >> _______________________________________________ > > >> gnso-rds-pdp-wg mailing list > > >> gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > > >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> > > > > > > > > > > -- > > _________________________________ > > Note to self: Pillage BEFORE burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> >
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 <tel:+49%206894%209396901> Fax.: +49 (0) 6894 - 9396 851 <tel:+49%206894%209396851> Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net> Web: www.key-systems.net <http://www.key-systems.net> / www.RRPproxy.net <http://www.RRPproxy.net> www.domaindiscount24.com <http://www.domaindiscount24.com> / www.BrandShelter.com <http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems <http://www.facebook.com/KeySystems> www.twitter.com/key_systems <http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu <http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
-- _________________________________ Note to self: Pillage BEFORE burning.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault. And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone. Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
I am currently working from our Wilmington office (GMT -5) and there may be some delay in email response. If you deem the matter urgent please contact me on +45.27536331 for immediate assistance. I will respond to all mail as soon as possible. Kind regards Ben
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough! I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
In a word, yes. Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured > in an unjust state" -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
in a word, ignorant -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:58, John Bambenek <jcb@bambenekconsulting.com> wrote:
In a word, yes.
Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: > > So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… > > Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >> >> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >> >> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >> >> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >> >> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >> >> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >> >> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >> >> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >> >> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >> >> >> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >> >> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >> >> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >> >> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >> >> Sam L >> >> >> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >> All, >> >> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) >> >> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >> >> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >> >> Alex >> >> >> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >> >> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >> It’s definitely not an “edge case”. >> Regards >> Michele >> -- >> Mr Michele Neylon >> Blacknight Solutions >> Hosting, Colocation & Domains >> https://www.blacknight.com/ >> http://blacknight.blog/ >> Intl. +353 (0) 59 9183072 >> Direct Dial: +353 (0)59 9183090 >> Social: http://mneylon.social >> Some thoughts: http://ceo.hosting/ >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> -- >> *--------------------------------------------* >> "It is a disgrace to be rich and honoured >> in an unjust state" -Confucius >> ---------------------------------------------- >> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) >> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 >> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >> blog: http://samlanfranco.blogspot.com >> Phone: 613 476-0429 cell: 416-816-2852 >> >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> -- >> _________________________________ >> Note to self: Pillage BEFORE burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
I want you to know I give your opinion the full due it is deserved. Sent from my iPhone
On Feb 14, 2017, at 11:04, "benny@nordreg.se" <benny@nordreg.se> wrote:
in a word, ignorant -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:58, John Bambenek <jcb@bambenekconsulting.com> wrote:
In a word, yes.
Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote: > > Let me translate Allison's comments in the light of your mockery. > > You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? > > If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. > > That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. > > But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. > > Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. > > And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. > > Sent from my iPhone > >> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >> >> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… >> >> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>> >>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>> >>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>> >>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>> >>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>> >>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>> >>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>> >>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>> >>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>> >>> >>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>> >>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>> >>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>> >>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>> >>> Sam L >>> >>> >>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>> All, >>> >>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) >>> >>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>> >>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>> >>> Alex >>> >>> >>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>> >>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>> It’s definitely not an “edge case”. >>> Regards >>> Michele >>> -- >>> Mr Michele Neylon >>> Blacknight Solutions >>> Hosting, Colocation & Domains >>> https://www.blacknight.com/ >>> http://blacknight.blog/ >>> Intl. +353 (0) 59 9183072 >>> Direct Dial: +353 (0)59 9183090 >>> Social: http://mneylon.social >>> Some thoughts: http://ceo.hosting/ >>> ------------------------------- >>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> -- >>> *--------------------------------------------* >>> "It is a disgrace to be rich and honoured >>> in an unjust state" -Confucius >>> ---------------------------------------------- >>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) >>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 >>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>> blog: http://samlanfranco.blogspot.com >>> Phone: 613 476-0429 cell: 416-816-2852 >>> >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>> >>> >>> >>> -- >>> _________________________________ >>> Note to self: Pillage BEFORE burning. >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
Didn’t expect anything else we disagree and I respect that fact I would however look forward to hear you arguments F2F in Copenhagen over a beer or coffee, we might not be that far from from each other in opinions after all, even if we disagree on the path to the goal. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 20:55, John Bambenek <jcb@bambenekconsulting.com> wrote:
I want you to know I give your opinion the full due it is deserved.
Sent from my iPhone
On Feb 14, 2017, at 11:04, "benny@nordreg.se" <benny@nordreg.se> wrote:
in a word, ignorant -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:58, John Bambenek <jcb@bambenekconsulting.com> wrote:
In a word, yes.
Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote: > > Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers > > On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: > A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… > > To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. > In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… > > Welcome to the discussion > > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote: >> >> Let me translate Allison's comments in the light of your mockery. >> >> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >> >> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >> >> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >> >> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >> >> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >> >> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >> >> Sent from my iPhone >> >>> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >>> >>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… >>> >>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>> >>> >>> -- >>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>> >>> Benny Samuelsen >>> Registry Manager - Domainexpert >>> >>> Nordreg AB - ICANN accredited registrar >>> IANA-ID: 638 >>> Phone: +46.42197080 >>> Direct: +47.32260201 >>> Mobile: +47.40410200 >>> >>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>>> >>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>> >>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>> >>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>> >>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>> >>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>> >>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>> >>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>> >>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>> >>>> >>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>> >>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>> >>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>> >>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>> >>>> Sam L >>>> >>>> >>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>> All, >>>> >>>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) >>>> >>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>> >>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>> >>>> Alex >>>> >>>> >>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>>> >>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>> It’s definitely not an “edge case”. >>>> Regards >>>> Michele >>>> -- >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting, Colocation & Domains >>>> https://www.blacknight.com/ >>>> http://blacknight.blog/ >>>> Intl. +353 (0) 59 9183072 >>>> Direct Dial: +353 (0)59 9183090 >>>> Social: http://mneylon.social >>>> Some thoughts: http://ceo.hosting/ >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> -- >>>> *--------------------------------------------* >>>> "It is a disgrace to be rich and honoured >>>> in an unjust state" -Confucius >>>> ---------------------------------------------- >>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) >>>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 >>>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>>> blog: http://samlanfranco.blogspot.com >>>> Phone: 613 476-0429 cell: 416-816-2852 >>>> >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>> >>>> >>>> >>>> -- >>>> _________________________________ >>>> Note to self: Pillage BEFORE burning. >>> >>> _______________________________________________ >>> gnso-rds-pdp-wg mailing list >>> gnso-rds-pdp-wg@icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning.
I am pro-beer but can't make that trip. Travel will be light for me this year but will endeavor to be around when I can. Sent from my iPhone
On Feb 14, 2017, at 12:11, "benny@nordreg.se" <benny@nordreg.se> wrote:
Didn’t expect anything else we disagree and I respect that fact
I would however look forward to hear you arguments F2F in Copenhagen over a beer or coffee, we might not be that far from from each other in opinions after all, even if we disagree on the path to the goal. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 20:55, John Bambenek <jcb@bambenekconsulting.com> wrote:
I want you to know I give your opinion the full due it is deserved.
Sent from my iPhone
On Feb 14, 2017, at 11:04, "benny@nordreg.se" <benny@nordreg.se> wrote:
in a word, ignorant -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:58, John Bambenek <jcb@bambenekconsulting.com> wrote:
In a word, yes.
Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
> On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote: > > Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen... > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote: >> >> Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers >> >> On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: >> A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save… >> >> To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. >> In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights… >> >> Welcome to the discussion >> >> >> >> -- >> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >> >> Benny Samuelsen >> Registry Manager - Domainexpert >> >> Nordreg AB - ICANN accredited registrar >> IANA-ID: 638 >> Phone: +46.42197080 >> Direct: +47.32260201 >> Mobile: +47.40410200 >> >>> On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote: >>> >>> Let me translate Allison's comments in the light of your mockery. >>> >>> You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? >>> >>> If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. >>> >>> That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. >>> >>> But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. >>> >>> Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. >>> >>> And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help. >>> >>> Sent from my iPhone >>> >>>> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: >>>> >>>> So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? >>>> How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way… >>>> >>>> Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. >>>> >>>> >>>> -- >>>> Med vänliga hälsningar / Kind Regards / Med vennlig hilsen >>>> >>>> Benny Samuelsen >>>> Registry Manager - Domainexpert >>>> >>>> Nordreg AB - ICANN accredited registrar >>>> IANA-ID: 638 >>>> Phone: +46.42197080 >>>> Direct: +47.32260201 >>>> Mobile: +47.40410200 >>>> >>>>> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >>>>> >>>>> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >>>>> >>>>> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >>>>> >>>>> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >>>>> >>>>> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >>>>> >>>>> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >>>>> >>>>> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >>>>> >>>>> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >>>>> >>>>> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >>>>> >>>>> >>>>> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >>>>> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >>>>> >>>>> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >>>>> >>>>> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >>>>> >>>>> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >>>>> >>>>> Sam L >>>>> >>>>> >>>>> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >>>>> All, >>>>> >>>>> So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) >>>>> >>>>> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >>>>> >>>>> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >>>>> >>>>> Alex >>>>> >>>>> >>>>> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >>>>> >>>>> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >>>>> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >>>>> It’s definitely not an “edge case”. >>>>> Regards >>>>> Michele >>>>> -- >>>>> Mr Michele Neylon >>>>> Blacknight Solutions >>>>> Hosting, Colocation & Domains >>>>> https://www.blacknight.com/ >>>>> http://blacknight.blog/ >>>>> Intl. +353 (0) 59 9183072 >>>>> Direct Dial: +353 (0)59 9183090 >>>>> Social: http://mneylon.social >>>>> Some thoughts: http://ceo.hosting/ >>>>> ------------------------------- >>>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> -- >>>>> *--------------------------------------------* >>>>> "It is a disgrace to be rich and honoured >>>>> in an unjust state" -Confucius >>>>> ---------------------------------------------- >>>>> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) >>>>> Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 >>>>> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >>>>> blog: http://samlanfranco.blogspot.com >>>>> Phone: 613 476-0429 cell: 416-816-2852 >>>>> >>>>> >>>>> _______________________________________________ >>>>> gnso-rds-pdp-wg mailing list >>>>> gnso-rds-pdp-wg@icann.org >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >>>>> >>>>> >>>>> >>>>> -- >>>>> _________________________________ >>>>> Note to self: Pillage BEFORE burning. >>>> >>>> _______________________________________________ >>>> gnso-rds-pdp-wg mailing list >>>> gnso-rds-pdp-wg@icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> >> -- >> _________________________________ >> Note to self: Pillage BEFORE burning. >
Benny, Please keep the discourse respectful. Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Tuesday, February 14, 2017 2:04 PM To: John Bambenek <jcb@bambenekconsulting.com> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois in a word, ignorant -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 19:58, John Bambenek <jcb@bambenekconsulting.com> wrote:
In a word, yes.
Sent from my iPhone
On Feb 14, 2017, at 09:34, "benny@nordreg.se" <benny@nordreg.se> wrote:
It was not a math argument at all… As I said when there are nothing else to argue with that card are always used… So your “crime” investigation are far more important? Is that the point? Interesting that when others raise issues which are a everyday problem it’s always shown a side by “investigators” as not important enough!
I am arguing that there are systems in use already which are effective and we could maybe learn from them instead of putting on the sunglasses with the mirror inside and only admire our own glory.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 18:20, John Bambenek <jcb@bambenekconsulting.com> wrote:
No, I assure you, one way or the other I will get access. But the constant mockery of investigators and the virtue signaling nonsense that you are fighting a very small piece of the spam ecosystem (a war that WE are waging and you merely talk about) really has worn my patience. Yes SEO spam / domain renewal spam is harmful but do you really want to have a math argument the child sexual exploitation is at all in the same realm of moral harm? You can't push the delete button on sexual assault.
And yes people so use online service to engage in human trafficking. I am unclear as to how that should surprise anyone.
Sent from my iPhone
On Feb 14, 2017, at 09:05, "benny@nordreg.se" <benny@nordreg.se> wrote:
Well it might be so, but every singel person “claiming” they use whois for investigation seems to lack the understanding that they will get the access it will just be a little harder to get the normal misuse of whois info can be prevented but looks like noen of you want that to happen...
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:58, allison nixon <elsakoo@gmail.com> wrote:
Benny, dude, you just wrote "Buhu my work will get harder", so please don't complain about adult and mature answers
On Tue, Feb 14, 2017 at 11:56 AM, benny@nordreg.se <benny@nordreg.se> wrote: A very adult and mature answer… with some nice baked in threats, funny its only your kind of crimes which matter apparantly… oh and the final on which always are been draged out when there are no more arguments, think about the one child we can save…
To answer your questions hidden in the threats, yes you are part of the better for all but that also means everyone have to give and take to come to a better solution. In you ignorance you completely miss the point that by have all these data public there are commited crimes every minut by using those data nut hey what does that matter as long as you business can roll on… I guess those people will thank you for you helpful insights…
Welcome to the discussion
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 17:29, John Bambenek <jcb@bambenekconsulting.com> wrote:
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online?
If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously.
That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains.
But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had.
Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call.
And if you are really concerned about spammers, I help run investigations against them too (using whois data, in part) and could totally use the help.
Sent from my iPhone
> On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: > > So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? > How can anyone defend that we have data published to get abused > just because some bad guys registrer domains? And those of you > who does will still have access to the date just not in the same > easy way… > > Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all.. > > > -- > Med vänliga hälsningar / Kind Regards / Med vennlig hilsen > > Benny Samuelsen > Registry Manager - Domainexpert > > Nordreg AB - ICANN accredited registrar > IANA-ID: 638 > Phone: +46.42197080 > Direct: +47.32260201 > Mobile: +47.40410200 > >> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: >> >> This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! >> >> Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. >> >> This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. >> >> I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. >> >> With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. >> >> Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? >> >> From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. >> >> I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. >> >> >> On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: >> I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. >> >> Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: >> >> There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). >> >> More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. >> >> Sam L >> >> >> On 2017-02-14 1:23 AM, Deacon, Alex wrote: >> All, >> >> So it seems the debate has progressed from “thin data” to >> “thick data” (i.e. data that includes email). I know we are >> all super excited to talk about “thick data” but I don’t think >> we are there yet (are we? Hopefully I didn’t miss the party…) >> >> Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. >> >> I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. >> >> Alex >> >> >> On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: >> >> I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. >> Also it’s one of the biggest sources of complaints we get from our clients (registrants) >> It’s definitely not an “edge case”. >> Regards >> Michele >> -- >> Mr Michele Neylon >> Blacknight Solutions >> Hosting, Colocation & Domains >> https://www.blacknight.com/ >> http://blacknight.blog/ >> Intl. +353 (0) 59 9183072 >> Direct Dial: +353 (0)59 9183090 >> Social: http://mneylon.social >> Some thoughts: http://ceo.hosting/ >> ------------------------------- Blacknight Internet Solutions >> Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> -- >> *--------------------------------------------* >> "It is a disgrace to be rich and honoured in an unjust state" >> -Confucius >> ---------------------------------------------- >> Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York >> U., Toronto, Ontario, CANADA - M3J 1P3 >> YorkU email: Lanfran@Yorku.ca Skype: slanfranco >> blog: http://samlanfranco.blogspot.com >> Phone: 613 476-0429 cell: 416-816-2852 >> >> >> _______________________________________________ >> gnso-rds-pdp-wg mailing list >> gnso-rds-pdp-wg@icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg >> >> >> >> -- >> _________________________________ Note to self: Pillage BEFORE >> burning. > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Wow, way to go off the rails here, John. I thought redefining whois in the light of the work of the EWG and data protection requirements is why we are here.
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? How does one traffick a human being online? Bit by bit, I assume? Can we please move back to serious discussion of real-world requirements instead of law-enforcement (and similar) wish lists? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That is the state of affairs today, but it need not be like that in the future, hence our work. Everyone has a right to privacy of their own data, regardless of whether they use a domain o not. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. It may not be enough however. There are very concerning isues with whois privacy today that will not go away even when PPSAI goes live. Even though we registrars sell it as a product, I personally would rather replace it with private registration data similar to the way many ccTLDs are handling the data of their customers. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Here you go with the edge cases again. If one innocent is harmed in the process of catching two criminals, that is already too high a price to pay. But that is not the case. Public whois is harming 99% of registrants in order to catch, say 0.000001% (not a real statistic) of registrants who use their domains for crime. Should this crime be prevented? Yes, but not at the cost of everyone elses privacy. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. I suggest you do the same!
Best, Volker
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote:
So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Johns the one going off the rails Volker? Really? This group is really out of hand, and it's an important issue. Really sad. Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 8:58 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Wow, way to go off the rails here, John. I thought redefining whois in the light of the work of the EWG and data protection requirements is why we are here.
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? How does one traffick a human being online? Bit by bit, I assume? Can we please move back to serious discussion of real-world requirements instead of law-enforcement (and similar) wish lists? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That is the state of affairs today, but it need not be like that in the future, hence our work. Everyone has a right to privacy of their own data, regardless of whether they use a domain o not. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. It may not be enough however. There are very concerning isues with whois privacy today that will not go away even when PPSAI goes live. Even though we registrars sell it as a product, I personally would rather replace it with private registration data similar to the way many ccTLDs are handling the data of their customers. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Here you go with the edge cases again. If one innocent is harmed in the process of catching two criminals, that is already too high a price to pay. But that is not the case. Public whois is harming 99% of registrants in order to catch, say 0.000001% (not a real statistic) of registrants who use their domains for crime. Should this crime be prevented? Yes, but not at the cost of everyone elses privacy. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. I suggest you do the same!
Best, Volker
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Warning! Attempt at humor the clear the air: "@vgreimann Working group out of hand despite important issue. Sad!" ;-) Am 14.02.2017 um 17:59 schrieb Kiran Malancharuvil:
Johns the one going off the rails Volker? Really?
This group is really out of hand, and it's an important issue. Really sad.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 8:58 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Wow, way to go off the rails here, John. I thought redefining whois in the light of the work of the EWG and data protection requirements is why we are here.
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? How does one traffick a human being online? Bit by bit, I assume? Can we please move back to serious discussion of real-world requirements instead of law-enforcement (and similar) wish lists? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That is the state of affairs today, but it need not be like that in the future, hence our work. Everyone has a right to privacy of their own data, regardless of whether they use a domain o not. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. It may not be enough however. There are very concerning isues with whois privacy today that will not go away even when PPSAI goes live. Even though we registrars sell it as a product, I personally would rather replace it with private registration data similar to the way many ccTLDs are handling the data of their customers. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Here you go with the edge cases again. If one innocent is harmed in the process of catching two criminals, that is already too high a price to pay. But that is not the case. Public whois is harming 99% of registrants in order to catch, say 0.000001% (not a real statistic) of registrants who use their domains for crime. Should this crime be prevented? Yes, but not at the cost of everyone elses privacy. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. I suggest you do the same!
Best, Volker
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
I don't think comparing me to Donald Trump is a good attempt to clear the air. I'll let others continue this "discussion" but will say that I wish we could be adults in this working group and reasonably discuss both sides of this and be ready to come to compromise. It is sad and ultimately harmful that we act like this when entrusted with such an important issue. Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m) Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 9:18 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Warning! Attempt at humor the clear the air:
"@vgreimann Working group out of hand despite important issue. Sad!"
;-)
Am 14.02.2017 um 17:59 schrieb Kiran Malancharuvil: Johns the one going off the rails Volker? Really?
This group is really out of hand, and it's an important issue. Really sad.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 8:58 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Wow, way to go off the rails here, John. I thought redefining whois in the light of the work of the EWG and data protection requirements is why we are here.
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? How does one traffick a human being online? Bit by bit, I assume? Can we please move back to serious discussion of real-world requirements instead of law-enforcement (and similar) wish lists? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That is the state of affairs today, but it need not be like that in the future, hence our work. Everyone has a right to privacy of their own data, regardless of whether they use a domain o not. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. It may not be enough however. There are very concerning isues with whois privacy today that will not go away even when PPSAI goes live. Even though we registrars sell it as a product, I personally would rather replace it with private registration data similar to the way many ccTLDs are handling the data of their customers. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Here you go with the edge cases again. If one innocent is harmed in the process of catching two criminals, that is already too high a price to pay. But that is not the case. Public whois is harming 99% of registrants in order to catch, say 0.000001% (not a real statistic) of registrants who use their domains for crime. Should this crime be prevented? Yes, but not at the cost of everyone elses privacy. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. I suggest you do the same!
Best, Volker
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote:
This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people!
Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it.
This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now.
I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations.
With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing.
Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse?
From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry.
I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers.
On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner.
Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-:
There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side).
More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task.
Sam L
On 2017-02-14 1:23 AM, Deacon, Alex wrote: All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429 cell: 416-816-2852
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Must we do this again? I did not compare you personally to the orange menace, I merely pointed out a similarity in the style of your response and his usual oevre. I found humor in that. I am weird that way. Other than that post, there are no similarities. Can we just leave it at that? Am 14.02.2017 um 18:32 schrieb Kiran Malancharuvil:
I don't think comparing me to Donald Trump is a good attempt to clear the air.
I'll let others continue this "discussion" but will say that I wish we could be adults in this working group and reasonably discuss both sides of this and be ready to come to compromise. It is sad and ultimately harmful that we act like this when entrusted with such an important issue.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 9:18 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Warning! Attempt at humor the clear the air:
"@vgreimann Working group out of hand despite important issue. Sad!"
;-)
Am 14.02.2017 um 17:59 schrieb Kiran Malancharuvil: Johns the one going off the rails Volker? Really?
This group is really out of hand, and it's an important issue. Really sad.
Kiran Malancharuvil Policy Counselor MarkMonitor 415-419-9138 (m)
Sent from my mobile, please excuse any typos.
On Feb 14, 2017, at 8:58 AM, Volker Greimann <vgreimann@key-systems.net> wrote:
Wow, way to go off the rails here, John. I thought redefining whois in the light of the work of the EWG and data protection requirements is why we are here.
Let me translate Allison's comments in the light of your mockery.
You're ideas of privacy are patently absurd and your arrogance that entire industries need to rewrite how they do things to suit your effete and fantastical notions is breathtaking. Your mockery of people who investigate crime is just icing on the cake. Its not a question of looking past your own walls, its a question of whether you religious fanatics can acknowledge that other use cases are valid (or are we not part of the "all" in "better for all"). Are you really suggesting preventing spam is a higher priority than stopping human trafficking online? How does one traffick a human being online? Bit by bit, I assume? Can we please move back to serious discussion of real-world requirements instead of law-enforcement (and similar) wish lists? If someone who had need of privacy came to me for advice on registering a domain name I would tell them absolutely not to do it. Use blogspot or any other mechanism that doesn't involve a financial transaction to shield your privacy. Creating paper trails is always a poor life decision when OPSEC matters. Anything less and I would stop taking your concerns seriously. That is the state of affairs today, but it need not be like that in the future, hence our work. Everyone has a right to privacy of their own data, regardless of whether they use a domain o not. That said, we have a viable compromise, its called whois privacy protection. And it allows me to use risk based decisions on how I treat traffic to such domains. It may not be enough however. There are very concerning isues with whois privacy today that will not go away even when PPSAI goes live. Even though we registrars sell it as a product, I personally would rather replace it with private registration data similar to the way many ccTLDs are handling the data of their customers. But if you wish to enable criminals to better hide so they can steal people's life savings, so they can anonymously traffic in child exploitation or to engage in sextortion against teenage girls all because you can't handle a spam filter, you can count me one that will line up against you and very publicly label you an enabler of child sexual exploitation. Then I will go to Congress, drag ICANN back under the Department of Commerce and ensure some adult supervision is had. Here you go with the edge cases again. If one innocent is harmed in the process of catching two criminals, that is already too high a price to pay. But that is not the case. Public whois is harming 99% of registrants in order to catch, say 0.000001% (not a real statistic) of registrants who use their domains for crime. Should this crime be prevented? Yes, but not at the cost of everyone elses privacy. Or you can calm the hell down and knock it off with your attitude and we can find a viable middle ground. Totally your call. I suggest you do the same!
Best, Volker
On Feb 14, 2017, at 05:28, "benny@nordreg.se" <benny@nordreg.se> wrote: So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans? How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…
Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
> On 14 Feb 2017, at 06:38, allison nixon <elsakoo@gmail.com> wrote: > > This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! > > Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. > > This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. > > I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. > > With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. > > Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? > > From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. > > I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. > > > On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net> wrote: > I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. > > Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: > > There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). > > More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. > > Sam L > > > On 2017-02-14 1:23 AM, Deacon, Alex wrote: > All, > > So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) > > Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. > > I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. > > Alex > > > On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: > > I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. > Also it’s one of the biggest sources of complaints we get from our clients (registrants) > It’s definitely not an “edge case”. > Regards > Michele > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > http://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Some thoughts: http://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > -- > *--------------------------------------------* > "It is a disgrace to be rich and honoured > in an unjust state" -Confucius > ---------------------------------------------- > Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) > Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 > YorkU email: Lanfran@Yorku.ca Skype: slanfranco > blog: http://samlanfranco.blogspot.com > Phone: 613 476-0429 cell: 416-816-2852 > > > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg@icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg > > > > -- > _________________________________ > Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Thanks for your input Allison. It’s good to see a lurker become more active. Chuck From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of allison nixon Sent: Tuesday, February 14, 2017 12:38 AM To: Sam Lanfranco <sam@lanfranco.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois This car metaphor isn't complete without also stating that some car owners purchase them for the sole purpose of running over people! Some car owners purchase fleets of cars to run over as many people as possible. Even though they re-use their name on every single vehicle registration, the subpeona takes so long that the city can no longer automatically block the cars as they enter, and need to wait for them to run over a few people before they can do anything about it. This metaphor has obviously been tortured past the point of absurdity, I'll leave it alone now. I've mostly been lurking for the whole duration of this group, and please forgive me if I'm missing something massive here, but I get the impression that most people here don't spend a lot of time doing investigations. But this is my life. If I needed a subpeona for every single historical lookup, pivot, and reverse search, I would get zero done due to a lack of legal authority. Many if not most of the people doing the heavy lifting in anti-cybercrime efforts are private citizens with no government issued authority. It seems that the general expectation here is that limiting access to people with badges is OK, but I'm telling you there is a severe lack of those skillsets and it will be years before we see widespread technical literacy among the police. Whatever system results, private citizens need a path for unrestricted and automated access. And if we want to talk protecting privacy, I think criminally motivated violations of privacy are far more likely to affect everyone's day to day life right now, and automated WHOIS lookups are used heavily especially in anti-phishing and anti-spam operations. With the status quo, I can go on fishing expeditions through the WHOIS data and turn up hundreds of domains used for the same type of malicious activity, and predict with a high accuracy which domains will be malicious before they are used for anything. It sometimes turns up domains owned by innocent people, and I doubt privacy minded people would like that, but the reality is I rarely ever encounter WHOIS data that is convincing PII. It's almost all fake. And if it's not fake, it's a company's public contact info, or it's a foolish person who turned down WHOIS privacy protection, and will change their WHOIS as soon as the spam starts flowing. Have there been any studies on what percentage of WHOIS data is real and correct? Can we ever expect to have meaningful data when registrars are allowed to take Bitcoins over Tor as payment? At what point does "privacy" become an empty argument when some of these Internet hosting/registrar companies clearly profit from facilitating abuse, and network defenders block entire TLDs due to the saturation of abuse? From my vantage point, I see great benefit from seeing patterns in the fake data submitted by fraudsters, and I see few harms from the privacy side of things, because people seem to generally realize that "123 fake st" is a perfectly acceptable WHOIS entry. I also recognize this situation is completely absurd. Every aspect of this is surely an abuse of the original system. But it seems like building a pyramid from the top down, restricting access to supposed "PII" that is unlikely to contain PII, to the detriment of legitimate efforts that also seek to enhance privacy by preventing criminal theft of private data like bank account numbers. On Mon, Feb 13, 2017 at 9:14 PM, Sam Lanfranco <sam@lanfranco.net<mailto:sam@lanfranco.net>> wrote: I have to strongly agree with Alex that whatever the criteria are for thin data, they cannot include that thin data "is transitive" in some sort of bread crumb trail manner. Everything is potentially transitive in that sense. I observe a vehicle but all I get is make, model and license plate, and in most jurisdictions that is all I get. It is the vehicle owner's "thin data". Of course I can hang around, see that the car has a baby seat, witness a woman or man putting a child in the car, assume that she/he has legitimate access to the car, follow the car and assemble more personal information (lives at; works at; shops at; visits;) The license plate didn't facilitate that crumb train discovery, but no license plate would hamper legitimate seeking of information about who owns the car (issuing a parking ticket, LEA investigation, etc.) . License plate is part of thin data with no gated access. Of course, this will change in the era of the digital vehicle. Depending on security, and authorization, one will be able to just ask the car, and ask about a lot of things...like whose cell phone was in the passenger's seat last night, when I was supposed to be alone )-: There needs to be a similar balance (license plate but no owner's name unless wanted, like Sam's Curry Pizza Barn logo, phone number and website URL painted on the side). More Important, have we made progress (convergence) on the working principles that should be brought to bear in building a thin data set. A lot of time has been spent looking at good case and bad case scenarios. What operational principles have been distilled from all these examples? What is the balance between thin data inclusion and exclusion, and design and technical solutions that can be used to prevent (for example) robotic harvesting? There is another frontier here, and that is what governments will do to restrain or enable certain uses of thin data? While ICANN needs to be aware of what is going on there, that part is beyond ICANN's remit, but those policies will help shape some of the context within which ICANN deals with the thin data task. Sam L On 2017-02-14 1:23 AM, Deacon, Alex wrote: All, So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org<mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of michele@blacknight.com<mailto:michele@blacknight.com>> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%20%209183072> Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- *--------------------------------------------* "It is a disgrace to be rich and honoured in an unjust state" -Confucius ---------------------------------------------- Dr Sam Lanfranco (Prof Emeritus & Senior Scholar) Econ, York U., Toronto, Ontario, CANADA - M3J 1P3 YorkU email: Lanfran@Yorku.ca<mailto:Lanfran@Yorku.ca> Skype: slanfranco blog: http://samlanfranco.blogspot.com Phone: 613 476-0429<tel:613%20476-0429> cell: 416-816-2852<tel:416-816-2852> _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- _________________________________ Note to self: Pillage BEFORE burning.
I am not quite sure which arguments Alex is labelling obstructive, but I feel compelled (at the risk of being called obstructive) to clarify a couple of things. As a non lawyer, I would add. 1. Proportionality is a pretty well known concept in EU law, as is the reasonable person test I talked about last week, in common law. It does not mean that by introducing those concepts into the law, we are punching a hole in the bottom of the bucket. It does not mean that all a party has to claim is "I need that data" "I have a business that was founded on harvesting that data" or "if I don't get that data my auto bots will not be able to send out letters automatically, I will have to hire people to do work", and a data commissioner is supposed to fold and say "why shucks, you need that data you just go right ahead and take it. Chances are the individuals will never know". Not saying that doesn't happen, of course, humanity being what it is.... 2. We are supposed to be finding out what the right thing to do is. I do not expect anyone on the IP/BC to stop arguing that they need the data, (although I do pray for conversions on a biblical scale in my private moments) and I will not label you or John Horton or anyone else, I hope, obstructive for continuing to insist on the same arguments. Happy to have it pointed out if I am getting shrill, sometimes we all get short tempered. But repeating the same argument and refusing to fold is not obstructive. (I believe the BC or the IPC even added similar language into their comments on the recent draft anti-harassment policy, for which I congratulate them.) 3. As for bread crumb data. This is a very difficult area. For those of us who are not prepared to give up on privacy, the fact that you can find anything about anybody today without their consent, if you know where to look and what identifiers to use is not okay. As we move into the IOT (following some of Sam's examples) we do get closer to that world, and if we dont hurry up it will be hard to have any privacy about our most intimate affairs. So privacy advocates (and not just the lone nutter volunteering on this group who is speaking at the moment) are determined to set limits on bread crumb data. (see the 2014 paper by the Art 29, which touches on some of these issues http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion...). Those of us who also administered the access to information acts when those acts were in their infancy, heard a lot of earnest argument from defence/intelligence/law enforcement agencies that we could not release seemingly innocuous crumbs of data lest they contribute to the "mosaic effect", whereby a dangerous picture of intelligence gathering/law enforcement techniques etc could be deduced from small elements released, once combined with others. Obviously this is true. The same agencies, again quite logically, argued that the same did not apply to personal data they needed. Personally, I find it hard to agree with that. Sadly, in the internet world, individuals are on their own in a largely unregulated universe. They are the victims of "information asymmetry", anyone with a life is too busy to be focused on what is happening to their personal data. We are past the point where someone can say "caveat emptor, it is up to the individual to read everything and find out what is happening to their data." Bread crumb data is therefore much more important now than it was when the original deal for a wide open WHOIS was hatched. 4. AS for authentication to get access to thick data, which you have pointed out correctly lies ahead of us.....we should not substitute one completely insecure open data trove with one with a weak authenticator that only stops bots. You and Scott Hollenbeck and many others would know better than I what we need, but given we only tweak this thing every 20 years we had better think ahead and make it better than an email address. We need to be able to arrest those who are committing fraud to get access to PI, what standard of evidence would that take? Stephanie Perrin On 2017-02-13 20:23, Deacon, Alex wrote:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed.
Also it’s one of the biggest sources of complaints we get from our clients (registrants)
It’s definitely not an “edge case”.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
+1 -----Original Message----- From: Deacon, Alex [mailto:Alex_Deacon@mpaa.org] Sent: Tuesday, February 14, 2017 1:23 AM To: Michele Neylon - Blacknight <michele@blacknight.com>; benny@nordreg.se; Victoria Sheckler <vsheckler@riaa.com> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois All, So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…) Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it. I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO. Alex On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote: I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
+1 Allison's comments. John Horton President and CEO, LegitScript *Follow LegitScript*: LinkedIn <http://www.linkedin.com/company/legitscript-com> | Facebook <https://www.facebook.com/LegitScript> | Twitter <https://twitter.com/legitscript> | *Blog <http://blog.legitscript.com>* | Google+ <https://plus.google.com/112436813474708014933/posts> On Mon, Feb 13, 2017 at 11:09 PM, Victoria Sheckler <vsheckler@riaa.com> wrote:
+1
-----Original Message----- From: Deacon, Alex [mailto:Alex_Deacon@mpaa.org] Sent: Tuesday, February 14, 2017 1:23 AM To: Michele Neylon - Blacknight <michele@blacknight.com>; benny@nordreg.se; Victoria Sheckler <vsheckler@riaa.com> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed.
Also it’s one of the biggest sources of complaints we get from our clients (registrants)
It’s definitely not an “edge case”.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I think this leads back to the initial question: What information _needs_ to be public to allow the functionality of the domain name? This is a question completely independant of what people can use the data for and whether it is beneficial to have this data public. For some of the thin data, the data has to be public to ensure the domain name works. But even then, if you register a domain name only to hold it as a nest egg for a rainy day and do not intend to activate it, even that need to publicise the most basic information like nameservers goes away. Volker Am 14.02.2017 um 02:23 schrieb Deacon, Alex:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed.
Also it’s one of the biggest sources of complaints we get from our clients (registrants)
It’s definitely not an “edge case”.
Regards
Michele
-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
Agreed Volker, From a process view, you actually should adopt privacy by design and then expand and address the practical issues that keep showing up on this list. https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.p... Theo Volker Greimann schreef op 2017-02-14 10:56 AM:
I think this leads back to the initial question:
What information _needs_ to be public to allow the functionality of the domain name? This is a question completely independant of what people can use the data for and whether it is beneficial to have this data public.
For some of the thin data, the data has to be public to ensure the domain name works.
But even then, if you register a domain name only to hold it as a nest egg for a rainy day and do not intend to activate it, even that need to publicise the most basic information like nameservers goes away.
Volker
Am 14.02.2017 um 02:23 schrieb Deacon, Alex:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Thanks Theo for the reference article. Lisa/Marika - Let's add this article to our resource list. This one is only 2 pages so it does not need to be summarized. All - Whether you are a privacy advocate or not, I encourage you to read it. It's not a magic solution for the tasks in front of us but I think the principles might be helpful for us to apply as we work toward finding solutions. Chuck -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of gtheo Sent: Tuesday, February 14, 2017 5:59 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois Agreed Volker, From a process view, you actually should adopt privacy by design and then expand and address the practical issues that keep showing up on this list. https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.p... Theo Volker Greimann schreef op 2017-02-14 10:56 AM:
I think this leads back to the initial question:
What information _needs_ to be public to allow the functionality of the domain name? This is a question completely independant of what people can use the data for and whether it is beneficial to have this data public.
For some of the thin data, the data has to be public to ensure the domain name works.
But even then, if you register a domain name only to hold it as a nest egg for a rainy day and do not intend to activate it, even that need to publicise the most basic information like nameservers goes away.
Volker
Am 14.02.2017 um 02:23 schrieb Deacon, Alex:
All,
So it seems the debate has progressed from “thin data” to “thick data” (i.e. data that includes email). I know we are all super excited to talk about “thick data” but I don’t think we are there yet (are we? Hopefully I didn’t miss the party…)
Focusing on thin data for the moment I struggle to understand how it is personal data. I do not believe it is. As for the odd logic proposed by some that the property of privacy is transitive (i.e. Because “thin data” can be used to link/point/discover other data then “thin data” equals “personal data”) I just don’t buy it.
I don’t disagree with much of what was expressed in this thread, however we must keep in mind that balance and proportionality are important concepts in many (all?) data privacy laws. Any arguments that imply that no such balance exists (or should exist) is obstructive IMO.
Alex
On 2/13/17, 5:42 AM, <gnso-rds-pdp-wg-bounces@icann.org on behalf of michele@blacknight.com> wrote:
I agree and I know from how I’ve used various email addresses that they are actively being harvested and spammed. Also it’s one of the biggest sources of complaints we get from our clients (registrants) It’s definitely not an “edge case”. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Some thoughts: http://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Proposal: By allowing the flow of WHOIS data to enable as many legitimate activites as possible througout the root and main branches of the tree: 1) we will strengthen the Internet by providing peripheral purposes that protect the medium (consumer protection, research,...)2) we will protect the Internet economy as much as possible3) by increasing granularity, we can tackle edge cases at the edge. Nathalie On Friday, February 10, 2017 11:01 AM, Victoria Sheckler <vsheckler@riaa.com> wrote: We need to find balance and a constructive way to propose solutions, not this endless back and forth of edge cases. -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of benny@nordreg.se Sent: Friday, February 10, 2017 4:44 AM To: Volker Greimann <vgreimann@key-systems.net> Cc: gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois +1 to Volker Spot on, we cant let the criminals endanger all innocents life by default expose data as we do today -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 10:41, Volker Greimann <vgreimann@key-systems.net> wrote:
Pivoting off domain whois is my #1 valued resource in cybercrime investigations.
Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc.
And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized.
Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se <benny@nordreg.se> wrote: Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se" <benny@nordreg.se> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-wh ois-privacy/ While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
This illustrates the basic difference of opinion: Proposal: By not allowing the flow of WHOIS data for anything but purposes backed by legal rights to that information or required for the technical operation of the internet 1) We will strengthen the rights to private data against anyone desiring to abuse that data by claiming to have some ephemeral purpose to access that data 2) The internet economy will likely not be affected 3) By defining restrictive access requirements, we will still enable legitimate cases where access to such data is needed Best, Volker Am 10.02.2017 um 17:11 schrieb nathalie coupet via gnso-rds-pdp-wg:
Proposal: By allowing the flow of WHOIS data to enable as many legitimate activites as possible througout the root and main branches of the tree: 1) we will strengthen the Internet by providing peripheral purposes that protect the medium (consumer protection, research,...) 2) we will protect the Internet economy as much as possible 3) by increasing granularity, we can tackle edge cases at the edge. Nathalie
On Friday, February 10, 2017 11:01 AM, Victoria Sheckler <vsheckler@riaa.com> wrote:
We need to find balance and a constructive way to propose solutions, not this endless back and forth of edge cases.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of benny@nordreg.se <mailto:benny@nordreg.se> Sent: Friday, February 10, 2017 4:44 AM To: Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> Cc: gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
+1 to Volker
Spot on, we cant let the criminals endanger all innocents life by default expose data as we do today
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 10 Feb 2017, at 10:41, Volker Greimann <vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>> wrote:
Pivoting off domain whois is my #1 valued resource in cybercrime
investigations. Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc.
And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized.
Best, Volker
On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se
<mailto:benny@nordreg.se> <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Dnsservers, domainstatus, various dates, Registrar
None of these data are personal data imo
The only info you see in Whois are the contact ID the user have at the registrar/ registry
Sent from my iPhone
On 9 Feb 2017, at 18:10, nathalie coupet <nathaliecoupet@yahoo.com <mailto:nathaliecoupet@yahoo.com>> wrote:
Benny,
All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability?
Nathalie
On Thursday, February 9, 2017 11:46 AM, "benny@nordreg.se <mailto:benny@nordreg.se>" <benny@nordreg.se <mailto:benny@nordreg.se>> wrote:
Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data.
A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data.
-- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen
Benny Samuelsen Registry Manager - Domainexpert
Nordreg AB - ICANN accredited registrar IANA-ID: 638
Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200
On 09/02/2017, 17:38, "gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of Greg Aaron" <gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> on behalf of gca@icginc.com <mailto:gca@icginc.com>> wrote:
Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone.
All best, --Greg
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org> [mailto:gnso-rds-pdp-wg-bounces@icann.org <mailto:gnso-rds-pdp-wg-bounces@icann.org>] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here:
http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-wh ois-privacy/
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
--
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP www.keydrive.lu
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- _________________________________ Note to self: Pillage BEFORE burning.
_______________________________________________ gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann - Rechtsabteilung -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
www.facebook.com/KeySystems www.twitter.com/key_systems
Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
Der Inhalt dieser Nachricht ist vertraulich und nur für den
angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to
contact us.
Best regards,
Volker A. Greimann - legal department -
Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com
Follow us on Twitter or join our fan community on Facebook and stay
updated:
www.facebook.com/KeySystems www.twitter.com/key_systems
CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
www.keydrive.lu
This e-mail and its attachments is intended only for the person to
whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org <mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
_______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
+1 to points made here by Volker. Kind regards, Chris From: "Volker Greimann" <vgreimann@key-systems.net> To: "gnso-rds-pdp-wg" <gnso-rds-pdp-wg@icann.org> Sent: Friday, 10 February, 2017 09:41:48 Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Pivoting off domain whois is my #1 valued resource in cybercrime investigations. Judging from the amount of abuse and spam out there, it is also the #1 valued resource of spammers, cyber criminals, nigerian princes, domain slammers ,etc etc. And that leads to the question: Is it really worth giving up the private data of all registrants to whoever wants it just to catch a few bad guys? And to answer that: I'd rather see a few criminals uncaught if that means the innocent majority will be that much less at risk to be victimized. Best, Volker BQ_BEGIN On Thu, Feb 9, 2017 at 12:16 PM, benny@nordreg.se < benny@nordreg.se > wrote: BQ_BEGIN Dnsservers, domainstatus, various dates, Registrar None of these data are personal data imo The only info you see in Whois are the contact ID the user have at the registrar/ registry Sent from my iPhone On 9 Feb 2017, at 18:10, nathalie coupet < nathaliecoupet@yahoo.com > wrote: BQ_BEGIN Benny, All personal info on personal domains are hidden by default. What are the info that remain available for public view - after personal information have been hidden by default - which still enable technical operability? Nathalie On Thursday, February 9, 2017 11:46 AM, " benny@nordreg.se " < benny@nordreg.se > wrote: Maybe not but there are nothing who prevent us from trying to protect people from there mistakes and stupidity and still be able to have certain level of technical operability with whois data. A good example are .se which have a whois policy where all personal info on personal domains are hidden by default. The registrant need to opt out of the privacy actively by making a decision. That might be the way we should think instead of what to do to hide data. -- Med vänliga hälsningar / Kind Regards / Med vennlig hilsen Benny Samuelsen Registry Manager - Domainexpert Nordreg AB - ICANN accredited registrar IANA-ID: 638 Phone: +46.42197080 Direct: +47.32260201 Mobile: +47.40410200 On 09/02/2017, 17:38, " gnso-rds-pdp-wg-bounces@icann.org on behalf of Greg Aaron" < gnso-rds-pdp-wg-bounces@icann.org on behalf of gca@icginc.com > wrote: Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto: gnso-rds-pdp-wg-bounces@icann.org ] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg BQ_END -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Greg makes some very valid points. I will add that the article Volker posted points out in the last paragraph that consumer education about Whois may be key. It seems like the responsibility of the service provider to make sure that website owners know what's going on with their Whois data. Also, and I think this is very important... it is very easy to have contactable, accurate Whois information that isn't your home address. Education and choice matters. Kiran Kiran Malancharuvil Policy MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Greg Aaron Sent: Thursday, February 09, 2017 9:39 AM To: Volker Greimann <vgreimann@key-systems.net>; gnso-rds-pdp-wg@icann.org Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois Is ICANN (or anyone else) responsible for protecting Spicer from himself? A lot of the articles about this subject point out that Spicer was neglectful and occasionally incompetent. Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. * Spicer tweeted out his own Twitter password. He's responsible for that. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. All best, --Greg -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for: mashable.com/2017/02/07/sean-spicer-who-is also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv... While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper. I hope this helps remind folks that getting private data out of the public view is a good thing. -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
Hi Greg, while Spicer may have done many things differently, this was not intended to point out why Spicer is an imbecile but rather to illustrate an overarching point: Public data enables abuse.
Here are some facts to consider: * Privacy protection was available and Spicer didn’t obtain it. That was his choice. It was for him, but not all registrars or resellers offer it. * Spicer agreed to have his data published in WHOIS. So that was either OK with him, or he didn't read the terms of service in his domain registration agreement. Either way, it was his choice. If you could see the number of complaints we get about publishing the private data of our customers even though they have agreed to our terms and voluntarily handed it over, you might argue differently. Most registrants (Mums, Dads, Singles, Teens, etc) do not know what whois is, and have no idea that their address will be published. By Choice? I don't think so. As a provider, you can warn them only so much. * Spicer tweeted out his own Twitter password. He's responsible for that. Indeed. * Spicer himself published his email address in many, many public places over the years. A simple Google search will tell you what his email address was. He did, many others don't. * Those data breaches that Volker mentions have nothing to do with domain registration data. They did not reveal domain registration data. Domain registration data didn't allow hackers to penetrate Dropbox, LinkedIn, and MySpace, and the other places where Spicer's credentials were lost over the years. Bad corporate security allowed those breaches to happen. I completely agree about the data breaches themselves, however the email address being public makes the work of those that wish to benefit from these breaches that much easier: They just have to look at the address listed in the whois, then check if the address has appeared in any of the leaked data files and that is that. If the address had not been publicly listed, that piece of information would have been harder to find. * Spicer has a very different risk profile than the average person. He's been a prominent PR and political operative for many years (and is now working for the most scrutinized entity in the world). A key tenet of risk assessment is that exceptional cases may not justify making rules that affect everyone. I wonder how many more cases are out there like this. And even if someone is not in the public limelight that does not mean they are not volnerable to their data being abused.
Best, Volker
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Volker Greimann Sent: Thursday, February 9, 2017 4:28 AM To: gnso-rds-pdp-wg@icann.org Subject: [gnso-rds-pdp-wg] Dangers of public whois
As we tend to get lost in the thick and nitty gritty from time to time, this recent article should remind us what we are working for:
mashable.com/2017/02/07/sean-spicer-who-is
also here: http://domainnamewire.com/2017/02/08/sean-spicer-brings-attention-whois-priv...
While it could not have hit a nicer guy, he completely and accurately followed policy and look where it lead. Hi private address and telephone number as well as email address known to the world, other domains he registered for himself and his family published, etc. As his email address was compromised in no less than three leaks (plus one honorable mention on Wikileaks), and he recently tweeted his password, it may even be possible to dig deeper.
I hope this helps remind folks that getting private data out of the public view is a good thing.
-- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann@key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
I have to say that my beliefs about private data have been evolving for as long as this working group has existed. One thing I believe now is that asking the question, “What is private/personal/PII data?” is not the best way to approach the problem. In my opinion, in this world of “big data”, a case could be made that everything is personal information. This includes the “thin data” we’ve been talking about. The reality is that doing “reverse lookups” with one or more bits of information can be quite revealing, much more so for folks like Sean Spicer than others perhaps, but nonetheless true. As Greg A. pointed out later in this thread, different people have different risk profiles and frankly there’s a limit to how much you can protect people from their own ignorance. In my opinion, our focus should be on what information we need and why, i.e., what is the purpose of the registration data? We should be taking a minimalist approach, to start, followed by extended discussion about what else we might collect and why? Although we need to keep in mind access and visibility of information, as Chuck so often reminds us, that’s a separate discussion to be had “next”, in the not too distant future I hope. Discussions about what is personal data and what is not are distracting. Let’s assume it all is and move forward from there. Understanding the “why” collecting the data will quite naturally drive the discussion of whether or not it needs to be “public” or in some way be subject to “restricted access”. Jim
I'd say that good privacy practice would assume: Only collect what you need (not something you "might" need) Only keep it as long as you need it, discard it as soon as its utility is expired Only use it for the reason you collected it, don't invent new reasons to use it post facto Restrict access on a need to know basis, which applies both to human access and machine access And +1 on most data being "linkable" to other data available elsewhere, thus potentially becoming PII in aggregate. -----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of James Galvin Sent: Thursday, February 9, 2017 2:16 PM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois I have to say that my beliefs about private data have been evolving for as long as this working group has existed. One thing I believe now is that asking the question, “What is private/personal/PII data?” is not the best way to approach the problem. In my opinion, in this world of “big data”, a case could be made that everything is personal information. This includes the “thin data” we’ve been talking about. The reality is that doing “reverse lookups” with one or more bits of information can be quite revealing, much more so for folks like Sean Spicer than others perhaps, but nonetheless true. As Greg A. pointed out later in this thread, different people have different risk profiles and frankly there’s a limit to how much you can protect people from their own ignorance. In my opinion, our focus should be on what information we need and why, i.e., what is the purpose of the registration data? We should be taking a minimalist approach, to start, followed by extended discussion about what else we might collect and why? Although we need to keep in mind access and visibility of information, as Chuck so often reminds us, that’s a separate discussion to be had “next”, in the not too distant future I hope. Discussions about what is personal data and what is not are distracting. Let’s assume it all is and move forward from there. Understanding the “why” collecting the data will quite naturally drive the discussion of whether or not it needs to be “public” or in some way be subject to “restricted access”. Jim _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
I agree with both Jim’s and Mark’s thoughtful responses. We do live in a world where the gathering of so much data that can be connected back to an individual through algorithms begs the question - what is private/ personal information. And I like Mark's questions - really a simply form of privacy principles. Holly On 11 Feb 2017, at 9:03 am, Mark Svancarek via gnso-rds-pdp-wg <gnso-rds-pdp-wg@icann.org> wrote:
I'd say that good privacy practice would assume:
Only collect what you need (not something you "might" need) Only keep it as long as you need it, discard it as soon as its utility is expired Only use it for the reason you collected it, don't invent new reasons to use it post facto Restrict access on a need to know basis, which applies both to human access and machine access
And +1 on most data being "linkable" to other data available elsewhere, thus potentially becoming PII in aggregate.
-----Original Message----- From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of James Galvin Sent: Thursday, February 9, 2017 2:16 PM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
I have to say that my beliefs about private data have been evolving for as long as this working group has existed.
One thing I believe now is that asking the question, “What is private/personal/PII data?” is not the best way to approach the problem.
In my opinion, in this world of “big data”, a case could be made that everything is personal information. This includes the “thin data” we’ve been talking about. The reality is that doing “reverse lookups” with one or more bits of information can be quite revealing, much more so for folks like Sean Spicer than others perhaps, but nonetheless true.
As Greg A. pointed out later in this thread, different people have different risk profiles and frankly there’s a limit to how much you can protect people from their own ignorance.
In my opinion, our focus should be on what information we need and why, i.e., what is the purpose of the registration data? We should be taking a minimalist approach, to start, followed by extended discussion about what else we might collect and why?
Although we need to keep in mind access and visibility of information, as Chuck so often reminds us, that’s a separate discussion to be had “next”, in the not too distant future I hope.
Discussions about what is personal data and what is not are distracting. Let’s assume it all is and move forward from there. Understanding the “why” collecting the data will quite naturally drive the discussion of whether or not it needs to be “public” or in some way be subject to “restricted access”.
Jim _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
participants (32)
-
allison nixon -
Andrew Sullivan -
Ayden Férdeline -
Ben Anderson -
benny@nordreg.se -
Carlton Samuels -
Chris Pelling -
DANIEL NANGHAKA -
Deacon, Alex -
Denny Watson -
Gomes, Chuck -
Greg Aaron -
Greg Shatan -
gtheo -
Hollenbeck, Scott -
Holly Raiche -
James Galvin -
John Bambenek -
John Horton -
Kiran Malancharuvil -
Mark Svancarek -
Metalitz, Steven -
Michele Neylon - Blacknight -
nathalie coupet -
Richard Leaning -
Rob Golding -
Rod Rasmussen -
Sam Lanfranco -
Stephanie Perrin -
theo geurts -
Victoria Sheckler -
Volker Greimann