What is WHOIS
Emily Taylor has written an excellent article outlining the issues surrounding WHOIS, its recent review, and the even more recent action taken by the ICANN (Internet Corporation for Assigned Names and Numbers) Board. I recommend reading Emily’s article as background for what follows and won’t attempt to provide a précis of the myriad issues surrounding WHOIS. Suffice it to say that the issues surrounding WHOIS have remained unresolved for over a decade and are a constant irritation for ICANN and the Community.
Life after WHOIS
Yesterday, ICANN announced that it had completed the selection process for its Expert Group on gTLD Directory Services (a longer and newer way to say WHOIS). It is encouraging to see Susan Kawaguchi, a WHOIS Review Team alumna, as one of the thirteen members of the Expert Group. Her presence will ensure at least some continuity between the work of the Review Team (I was a member of that team) and that of this Expert Group.
In its original announcement of the Expert Group, ICANN stated that:
The objectives of the working group are to
- define the purpose of collecting and maintaining gTLD registration data, and consider how to safeguard the data, and
- provide a proposed model for managing gTLD directory services that addresses related data accuracy and access issues, while taking into account safeguards for protecting data.
This output will feed into a Board-initiated GNSO policy development process to serve as a foundation for the GNSO’s creation of new consensus policy, and requisite contract changes, as appropriate.
(reformatted for clarity)
This could be seen as an extremely broad remit, were it not for the Affirmation of Commitments (AoC) that states:
ICANN additionally commits to enforcing its existing policy relating to WHOIS, subject to applicable laws. Such existing policy requires that ICANN implement measures to maintain timely, unrestricted and public access to accurate and complete WHOIS information, including registrant, technical, billing, and administrative contact information.
The Affirmation of Commitments
The AoC contains a set of promises from ICANN and the United States Department of Commerce. In it ICANN covenants, among other things, that it has a WHOIS policy and further that said policy requires unrestricted public access to WHOIS information. The AoC establishes a set of promises to the Community, a framework under which ICANN will operate. Any deviation from the promises made require careful consideration and should not be undertaken lightly or through a select group appointed by ICANN.
It is within this framework that the recently selected Expert Group must operate and as a consequence, it has a much narrower remit than outlined in the original announcement. Let’s look at the objectives of the Expert Group with the AoC in mind as opposed to the isolated setting as presented in the original announcement, where the AoC was not mentioned at all.
The first objective states “define the purpose of collecting and maintaining gTLD registration data, and consider how to safeguard the data”. Defining the purpose of gTLD registration (WHOIS) data not only makes sense, it is required in certain jurisdictions in order to comply with “applicable laws”. Given the diversity of the Expert Group members, collecting a set of purposes for the data should be a relatively straightforward matter, provided that the discussion does not wander into discussions of whether the data should be collected. That issue is already a matter of policy and this group is not chartered to address that issue.
Moving to the second part of the first objective, “consider how to safeguard the data” should be similarly simple given that this data is required to be accessible to the public, without restriction, subject only to applicable laws. As a consequence, safeguarding this data can only relate to ensuring that the data can only be modified by those authorized to do so. In the absence of the AoC, this phrase could be taken to mean that the Expert Group could consider access control mechanisms that might restrict access to data. But as we saw above, policy already exists and requires unrestricted access to this data.
The second objective is to “provide a proposed model for managing gTLD directory services that addresses related data accuracy and access issues, while taking into account safeguards for protecting data”. Access to and protection of the data have already been discussed within the context of the AoC. Access is required to be public and unrestricted and protection should be limited to ensuring that unauthorized changes are not made. What remains, is for the Expert Group to propose a model for managing services while addressesing accuracy issues, the heart of the WHOIS debate for some time now.
Such a model would be most welcome and would be entirely in line with the Affirmation of Commitments provided that it does not restrict public access to registration information. This access is assured by ICANN through promises made in the AoC and it is entirely appropriate that ICANN honor these commitments.
Déjà Vu or une aube novelle
Time will tell whether this Expert Group can remain within its charter. If it does, it just might be of utility to the ICANN community. However, if it ventures afield from the covenants in the Affirmation of Commitments requiring unrestricted public access to certain registration data, it will have failed the Community. The transparency afforded by such unrestricted access, subject to applicable laws, is essential to the health and vitality of the Internet. It permits individuals and other entities, to know with whom they are interacting when that knowledge is both necessary and permitted.
Obfuscating, or otherwise concealing personally identifiable registration data is warranted in certain circumstances, e.g. an individual not engaged in commerce. If this Expert Group could help establish what those exceptional cases are, along with suggestions for how to best deal with them, the discussion might be advanced significantly and the Community would be in their debt.
We will know before long whether this Expert Group is the dawn of something new, or simply déjà vu all over again.