- NA-Discuss - lists.icann.org

Re: [NA-Discuss] Domain-name abuse proliferates
by Garth Bruen at KnujOn Sept. 15, 2009

Sept. 15, 2009

I don't think paper verification is a bad thing, but I agree with Bret and Alan that we should avoid process changes that slow the system down or add costs. A paper mailing verification could come after registration, say a week? There could be different levels of verification that may still work even if mail gets lost. This would help Eduardo while he's running his website from El Yunque. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates > From: Eduardo Diaz <eduardodiazrivera(a)gmail.com> > Date: Tue, September 15, 2009 10:48 am > To: "John R. Levine" <johnl(a)iecc.com> > Cc: NA Discuss <na-discuss(a)atlarge-lists.icann.org> > So if I live in the middle of nothing (where I can not receive paper mail) I > will not be able to register any domains? That effectively will exclude some > people of doing legitimate business through the Internet. > -ed > On Mon, Sep 14, 2009 at 7:46 PM, John R. Levine <johnl(a)iecc.com> wrote: > > I'm simply saying that if you are worried about preventing criminals from > >> registering tons of domains as the article describes, then the policy > >> discussion will have to be broader than what Danny's prescription allows. > >> > > > > Personally, I think that the registrar should send a verification code to > > the paper mailing address provided by the registrant, and not activate the > > domain until the registrant receives the code and shows (probably by web or > > email response) that he or she has received it. > > > > I realize this would make the registration process considerably slower and > > somewhat more expensive, but I see no public interest reason why that's a > > bad thing. > > > > R's, > > John > > > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > > > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > -- > NOTICE: The information contained in this e-mail message is intended only > for the personal and confidential use of the recipient(s) named above. If > you have received this communication by error, please notify us immediately > by e-mail, and delete the original message. > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > Visit the NARALO online at http://www.naralo.org > ------

1 0

Re: [NA-Discuss] Domain-name abuse proliferates
by Garth Bruen at KnujOn Sept. 15, 2009

Sept. 15, 2009

More like accountability than enforcement. I always like to say that if the police are handling something every other layer of policy has failed. If we can set up a policy structure that initially lets good people in and keeps bad people out, that is much better than cleaning up after. I don't really see a need to slow the process down. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates > From: Dharma Dailey <dharma(a)ethoswireless.com> > Date: Tue, September 15, 2009 10:49 am > To: Danny Younger <dannyyounger(a)yahoo.com> > Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, NA Discuss > <na-discuss(a)atlarge-lists.icann.org> > Thanks Garth and Danny for filling in some blanks. Both of these > proposals would not prevent people for registering domain names, but > set up the door for an enforcement action to be carried out by > registrars? Is that right? > -dharma > On Sep 15, 2009, at 10:33 AM, Danny Younger wrote: > > Hi Garth, > > > > I have also proposed an almost identical solution in a submission to > > an earlier WHOIS Task Force entitled "the Natural Persons Proposal" > > -- you can find a synopsis of it here: http://gnso.icann.org/mailing-lists/archives/ga/msg06282.html > > > > -- danny -- > > > > --- On Tue, 9/15/09, Garth Bruen at KnujOn <gbruen(a)knujon.com> wrote: > > > >> From: Garth Bruen at KnujOn <gbruen(a)knujon.com> > >> Subject: Re: [NA-Discuss] Domain-name abuse proliferates > >> To: "Dharma Dailey" <dharma(a)ethoswireless.com> > >> Cc: "NA Discuss" <na-discuss(a)atlarge-lists.icann.org> > >> Date: Tuesday, September 15, 2009, 10:24 AM > >> Dharma, > >> > >> There's a simple fix that I've proposed many times, and one > >> that is > >> currently in use in Canada and other countries among some > >> ccTLDs. This > >> fix would preserve privacy for individuals, allow for > >> freedom of > >> expression, reduce fraud, help law enforcement, and address > >> issues that > >> pain brand holders. > >> > >> Most illicit, spammed, fraudulent domains are used for > >> commercial > >> purposes, e.i., they sell something. .CA has very strict > >> privacy rules > >> concerning the disclosure of whois - but only for > >> individuals. Domains > >> engaged in commercial traffic or conducting transactions > >> cannot have > >> private Whois. Personal, informational sites found engaging > >> commercial > >> traffic could be immediately suspended. Likewise, > >> commercial domains > >> with missing or fake whois would also be terminated. > >> > >> This system would instantly preclude all software piracy > >> sites, fake > >> pharmacies, knockoff goods, phony lending institutions, > >> fake health care > >> companies, and cybersquatting. Obviously it does not > >> address all > >> domain-related crime but the items I just listed constitute > >> 90% of the > >> problem. > >> > >> We often hear that "Europe cares more about privacy that > >> America", this > >> is a red herring. As an American I cherish my privacy. In > >> Germany or > >> France you cannot have a pharmacy or bank with secret > >> ownership. > >> Corporations must publicly disclose their ownership and > >> location in lots > >> of publicly accessable documents, on their websites, > >> etc... > >> > >> The bulk of domain-related fraud is committed by industry > >> insiders often > >> with deep connections to the Registrars. So much of the > >> non-product spam > >> we process promotes domains being sold in bulk at auctions. > >> The spam > >> pumps up the perceived value of the domain and benefits the > >> Registrar > >> holding the auction. This is why Registrars do not want > >> Whois reform. > >> And why I constant get creepy messages telling me to shut > >> up. > >> > >> Consider this. How many domains does a multi-million dollar > >> company buy? > >> 1 maybe 2. Maybe one for each gTLD and ccTLD, that's still > >> less than > >> 300. The average spam campaign uses 5 to 10 thousand > >> domains. Because a > >> domain name can be anything and the processing is really > >> minimal, > >> they're not very expensive. This means a Registrar has to > >> make money > >> either by adding services to a domain sale(like hosting, > >> email, > >> advertising, web design), OR by selling large amounts of > >> domain names > >> and hopefully increasing the price of those domains in the > >> process. > >> > >> -Garth > >> > >> > >> ------------------------------------- > >> Collect, analyze, enforce, repeat... > >> > >> Garth Bruen > >> gbruen(a)knujon.com > >> http://www.knujon.com > >> http://www.linkedin.com/pub/4/149/724 > >> > >> Tentative Presentations: > >> Global Cyber Security Expo > >> http://cyberexpo.memphis.edu/ > >> > >> > >>> -------- Original Message -------- > >>> Subject: Re: [NA-Discuss] Domain-name abuse > >> proliferates > >>> From: Dharma Dailey <dharma(a)ethoswireless.com> > >>> Date: Tue, September 15, 2009 9:42 am > >>> To: Bret Fausett <bfausett(a)internet.law.pro> > >>> Cc: NA Discuss <na-discuss(a)atlarge-lists.icann.org> > >>> It seems that two important interests for internet > >> users are at odds > >>> in domain registration- freedom of expression and > >> protection from > >>> criminals. Is this really the case? > >> If so, how could you ever > >>> value one more than the other? Is there > >> some sort of matrix that > >>> lists possible reforms in relations to their impact on > >> both of these > >>> fronts such as a catalog of methods of verification, > >> how each might > >>> impact freedom of expression alongside how they might > >> impact cyber > >>> criminals? For example, if we could > >> weigh the likelihood that > >>> criminal activity would diminish by x percent from a > >> 24 hour delay in > >>> getting a domain registration completed versus the > >> harm to a concerned > >>> public having to wait a day to get their > >>> ProtectFlufferNutterSandwichsNow.com, then we can have > >> a substantive > >>> debate on whether that reform is worth the > >> effort. A few cyber- > >>> criminals will be able to circumvent anything, just as > >> people with a > >>> burning issue will find a way to speak regardless of > >> the > >>> consequences. But it's hard to make sense of the > >> trade offs in the > >>> abstract. > >>> -dharma > >>> On Sep 15, 2009, at 12:25 AM, Bret Fausett wrote: > >>>> I would not support any proposal that imposes > >> delay on the ability > >>>> of an individual to register a domain name. One > >> of the strengths of > >>>> the Internet is the speed with which users can > >> publish and speak. > >>>> You see this especially around newsworthy events, > >> where minutes > >>>> after something important or interesting has > >> happened, people are > >>>> registering domain names and using the traffic > >> that flows in to say > >>>> something. > >>>> > >>>> A postal verification process would add an > >> incremental accuracy gain > >>>> while burdening the ability to speak and react in > >> real time to world > >>>> events -- and the "bad guys" would subvert it > >> anyway. > >>>> > >>>> -- Bret > >>>> > >>>> > >>>> > >>>> ------ > >>>> NA-Discuss mailing list > >>>> NA-Discuss(a)atlarge-lists.icann.org > >>>> http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > >>>> > >>>> Visit the NARALO online at http://www.naralo.org > >>>> ------ > >>> ------ > >>> NA-Discuss mailing list > >>> NA-Discuss(a)atlarge-lists.icann.org > >>> http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > >>> Visit the NARALO online at http://www.naralo.org > >>> ------ > >> > >> > >> ------ > >> NA-Discuss mailing list > >> NA-Discuss(a)atlarge-lists.icann.org > >> http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > >> > >> Visit the NARALO online at http://www.naralo.org > >> ------ > >> > > > > > >

1 0

Re: [NA-Discuss] Domain-name abuse proliferates
by Garth Bruen at KnujOn Sept. 15, 2009

Sept. 15, 2009

Dharma, There's a simple fix that I've proposed many times, and one that is currently in use in Canada and other countries among some ccTLDs. This fix would preserve privacy for individuals, allow for freedom of expression, reduce fraud, help law enforcement, and address issues that pain brand holders. Most illicit, spammed, fraudulent domains are used for commercial purposes, e.i., they sell something. .CA has very strict privacy rules concerning the disclosure of whois - but only for individuals. Domains engaged in commercial traffic or conducting transactions cannot have private Whois. Personal, informational sites found engaging commercial traffic could be immediately suspended. Likewise, commercial domains with missing or fake whois would also be terminated. This system would instantly preclude all software piracy sites, fake pharmacies, knockoff goods, phony lending institutions, fake health care companies, and cybersquatting. Obviously it does not address all domain-related crime but the items I just listed constitute 90% of the problem. We often hear that "Europe cares more about privacy that America", this is a red herring. As an American I cherish my privacy. In Germany or France you cannot have a pharmacy or bank with secret ownership. Corporations must publicly disclose their ownership and location in lots of publicly accessable documents, on their websites, etc... The bulk of domain-related fraud is committed by industry insiders often with deep connections to the Registrars. So much of the non-product spam we process promotes domains being sold in bulk at auctions. The spam pumps up the perceived value of the domain and benefits the Registrar holding the auction. This is why Registrars do not want Whois reform. And why I constant get creepy messages telling me to shut up. Consider this. How many domains does a multi-million dollar company buy? 1 maybe 2. Maybe one for each gTLD and ccTLD, that's still less than 300. The average spam campaign uses 5 to 10 thousand domains. Because a domain name can be anything and the processing is really minimal, they're not very expensive. This means a Registrar has to make money either by adding services to a domain sale(like hosting, email, advertising, web design), OR by selling large amounts of domain names and hopefully increasing the price of those domains in the process. -Garth ------------------------------------- Collect, analyze, enforce, repeat... Garth Bruen gbruen(a)knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Tentative Presentations: Global Cyber Security Expo http://cyberexpo.memphis.edu/ > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates > From: Dharma Dailey <dharma(a)ethoswireless.com> > Date: Tue, September 15, 2009 9:42 am > To: Bret Fausett <bfausett(a)internet.law.pro> > Cc: NA Discuss <na-discuss(a)atlarge-lists.icann.org> > It seems that two important interests for internet users are at odds > in domain registration- freedom of expression and protection from > criminals. Is this really the case? If so, how could you ever > value one more than the other? Is there some sort of matrix that > lists possible reforms in relations to their impact on both of these > fronts such as a catalog of methods of verification, how each might > impact freedom of expression alongside how they might impact cyber > criminals? For example, if we could weigh the likelihood that > criminal activity would diminish by x percent from a 24 hour delay in > getting a domain registration completed versus the harm to a concerned > public having to wait a day to get their > ProtectFlufferNutterSandwichsNow.com, then we can have a substantive > debate on whether that reform is worth the effort. A few cyber- > criminals will be able to circumvent anything, just as people with a > burning issue will find a way to speak regardless of the > consequences. But it's hard to make sense of the trade offs in the > abstract. > -dharma > On Sep 15, 2009, at 12:25 AM, Bret Fausett wrote: > > I would not support any proposal that imposes delay on the ability > > of an individual to register a domain name. One of the strengths of > > the Internet is the speed with which users can publish and speak. > > You see this especially around newsworthy events, where minutes > > after something important or interesting has happened, people are > > registering domain names and using the traffic that flows in to say > > something. > > > > A postal verification process would add an incremental accuracy gain > > while burdening the ability to speak and react in real time to world > > events -- and the "bad guys" would subvert it anyway. > > > > -- Bret > > > > > > > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > > > > Visit the NARALO online at http://www.naralo.org > > ------ > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > Visit the NARALO online at http://www.naralo.org > ------

3 2

Re: [NA-Discuss] Domain-name abuse proliferates
by Garth Bruen at KnujOn Sept. 15, 2009

Sept. 15, 2009

Thanks Evan. Obviously we need to make it clear from the get-go that this is not an "American plan" but rather a comprehensive one that is actually in-line with various international standards. ------------------------------------- Collect, analyze, enforce, repeat... Garth Bruen gbruen(a)knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Tentative Presentations: Global Cyber Security Expo http://cyberexpo.memphis.edu/ > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates > From: Evan Leibovitch <evan(a)telly.org> > Date: Tue, September 15, 2009 10:43 am > To: Garth Bruen at KnujOn <gbruen(a)knujon.com> > Cc: Danny Younger <dannyyounger(a)yahoo.com>, NA Discuss > <na-discuss(a)atlarge-lists.icann.org> > Garth Bruen at KnujOn wrote: > > Great. So how do we get support for this? > > > We discuss it and endorse it (or some modified version of it) as a > NARALO position (together of a detailed account of how the status quo > damages the public good). > At that point we submit it to ALAC, which will then do one of three things: > 1) Endorse it as-is > 2) Endorse it after ALAC modifications > 3) Choose not to endorse it, or to not deal with it. > If ALAC chooses (2) or (3) we can choose to submit this request > ourselves as a NARALO statement. > We may also find that we may be able to attract support for this within > the business and non commercial constituencies of GNSO. > I have indicated to the ALAC Chair our interest in this issue, an she > has responded that ALAC and other regions share our concerns. It is > possible that our initiative may achieve global support, which will make > ICANN rejection of it more difficult. > - Evan

1 0

Re: [NA-Discuss] Domain-name abuse proliferates; rogue registrars turn a blind eye
by Bret Fausett Sept. 14, 2009

Sept. 14, 2009

ALan, I'd be interested in hearing more about this. I served on the Deletes Task Force once upon a time, and I can share some of our experiences. > As I get deeper into the Post Expiration Domain Name Recovery issue, > it is becoming apparent that earlier attempts to address the problem > not only did not fix the problem, but may have in fact worsened it. I > attribute this to some degree because they were trying to fix a > symptom and not address the long-term needs. > > Alan

1 0

Re: [NA-Discuss] Domain-name abuse proliferates; rogue registrars turn a blind eye
by Garth Bruen at KnujOn Sept. 14, 2009

Sept. 14, 2009

Yes, it's a great tool used by pimps, human traffickers, software pirates, drug-dealers, counterfieters and terrorists the world over. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates; rogue > registrars turn a blind eye > From: Wendy Seltzer <wendy(a)seltzer.com> > Date: Mon, September 14, 2009 2:42 pm > To: NA Discuss <na-discuss(a)atlarge-lists.icann.org> > Alan Greenberg wrote: > > I support this. No one (among us in any case) is likely to advocate > > WHOIS inaccuracy, > You didn't really think I'd let that pass? I do not advocate WHOIS > accuracy, as I believe it focuses on the wrong points in the chain of > accountability. I support "inaccuracy" as one way among many of > maintaining privacy or anonymity in domain registration. > --Wendy > -- > Wendy Seltzer -- wendy(a)seltzer.org > Fellow, Silicon Flatirons Center at University of Colorado Law School > Fellow, Berkman Center for Internet & Society at Harvard University > http://cyber.law.harvard.edu/seltzer.html > http://www.chillingeffects.org/ > https://www.torproject.org/ > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > Visit the NARALO online at http://www.naralo.org > ------

1 0

Re: [NA-Discuss] Domain-name abuse proliferates; rogue registrars turn a blind eye
by Garth Bruen at KnujOn Sept. 14, 2009

Sept. 14, 2009

Then maybe we can all agree that a set of proposed fixes to the registration system be drafted, which includes WHOIS accuracy as a main component. Maybe an expanded set of RAA amendments. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Domain-name abuse proliferates; rogue > registrars turn a blind eye > From: Gareth Shearman <shearman(a)victoria.tc.ca> > Date: Mon, September 14, 2009 2:10 pm > To: Evan Leibovitch <evan(a)telly.org> > Cc: NA Discuss <na-discuss(a)atlarge-lists.icann.org> > I certainly agree with Danny, Garth and Evan that the Whois issue > needs to be addressed, but I also agree with Ross that we need to > address the larger policy issues as well. > Gareth > On 14-Sep-09, at 9:10 AM, Evan Leibovitch wrote: > > Ross Rader wrote: > >> An exchange of two or three emails doesn't lead to "a really good > >> idea > >> of what needs to be done". > > > > And At-Large has been at this for a very long time. > > > > I believe that it has already identified WHOIS accuracy as a necessary > > -- if not complete -- part of the solution. Danny's original question > > was on tactics, not strategy. > > > > If we stay in the theoretical forever we get nothing done -- which is > > what's been happening. Eventually we need to define specific fixes. > > > > - Evan > > > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ic… > Visit the NARALO online at http://www.naralo.org > ------

1 0

NARALO Voting Open: NARALO Nominees for ALAC Board Liaison 2009/2010
by At-Large Staff Sept. 14, 2009

Sept. 14, 2009

Dear Community: In accordance with the NARALO process for selecting those persons whom the region will forward to the ALAC for inclusion on the ALAC ballot for ALAC Board Liaison 2009/2010, we can confirm that a vote has just been opened. All authorised voters - that being the same list of persons who participated in the balloting for NomCom delegate names for 2009/2010 from NARALO - will receive voting credentials by mail in the next few minutes. If you do not receive the message due to spam filtering or for some other technical reason, you may access the poll at this URL: https://www.bigpulse.com/24535/signin. Note that if you do not have a voting account for this vote, you will be unable to make use of this URL. The vote will close at 19:30 UTC on 14th September. This is one half hour after the start of the regional teleconference at 19:00. Evan and Darlene will receive a list of those who have not voted as at the opening of the conference so that any who have not yet voted can do so at the beginning of the teleconference. At the same time, the Staff will remind those who have not voted on the 13th by email. -- -- Regards, Nick Ashton-Hart, Heidi Ullrich, Matthias Langenegger, Gisella Gruber-White, Marie-Helene Bouchoms ICANN At-Large Staff email: staff(a)atlarge.icann.org

4 4

Domain-name abuse proliferates; rogue registrars turn a blind eye
by Danny Younger Sept. 14, 2009

Sept. 14, 2009

Yet another article on domain name abuses (1). At one point the article quotes Ram Mohan as saying, "ICANN, which has overall responsibility for the Whois database of registration information, has to find a way to validate the entries." Perhaps Ram wasn't aware that the very first RAA (1999) contained this language: "Registrar shall abide by any ICANN-adopted policies requiring reasonable and commercially practicable (a) verification, at the time of registration, of contact information associated with an SLD registration sponsored by Registrar or (b) periodic re-verification of such information." Time-of-registration-whois-verification is a policy that is long overdue. Is the at-large prepared to bring this issue forward? (1) http://news.idg.no/cw/art.cfm?id=B809FA70-1A64-67EA-E4B5B30FF36D196B

3 5

NARALO Teleconference and Adobe Connect Training - Sept. 14
by At Large Staff Sept. 11, 2009

Sept. 11, 2009

Dear All This is a friendly follow up reminder that the next NARALO teleconference is scheduled for Monday, 14 September at 19:00 UTC (12:00 p.m. PDT/3 p.m. EDT). Participation information as well as the proposed agenda can found on the following page: https://st.icann.org/naralo/index.cgi?14%20September%202009. For those of you are would like to increase your Adobe Connect skills, there will be a NARALO Adobe Connect Training session 30 minutes prior to the start of the NARALO teleconference beginning at 18:30 UTC (11:30 a.m. PDT/2:30 p.m. EDT). To participate in the audio portion of this meeting, please dial into to the same Adigo telephone number as for the NARALO teleconferences (North America toll-free: 1-800-550-6865 - dial in: 1638). The link to the Adobe Connect Training room as well as questions that will be answered during the call are available at: https://st.icann.org/naralo/index.cgi?14_september_2009_adobe_connect_briefi ng_session. Please feel free to add your questions to the wiki by using the comments section. If you require a dial-out for either call, please let us know at staff(a)atlarge.icann.org. Regards, Nick Ashton-Hart, Heidi Ullrich, Matthias Langenegger, Gisella Gruber-White ICANN At-Large Staff email: staff(a)atlarge.icann.org

1 0