EU Privacy Watchdog To ICANN: Law Enforcement WHOIS Demands "Unlawful"
First time accepted submitter benyacrick writes "WHOIS was invented as an address book for sysadmins. These days, it's more likely to be used by Law Enforcement to identify a perpetrator or victim of an online crime. With ICANN's own study showing that 29% of WHOIS data is junk, it's no surprise that Law Enforcement have been lobbying ICANN hard to improve WHOIS accuracy. The EU's privacy watchdog, the Article 29 Data Protection Working Party, has stepped into the fray with a letter claiming that two of Law Enforcement's twelve asks are "unlawful" (PDF). The problem proposals are data retention — where registrant details will be kept for up to two years after a domain has expired — and re-verification, where a registrant's phone number and e-mail will be checked annually and published in the WHOIS database. The community consultation takes place at ICANN 45 in Toronto on October 15th."
What is this push the past few years that technical companies need to do the job of law enforcement? The craigslist hooker scandal is a prime example... Here is this nice list of criminals for you to arrest, yet it is the websites fault?
That would be a problem for me. I have hundreds of domains with a made up phone number. The last thing I wanted was calls from robo-dialers mining the whois db to a real number.
you need to type in a PIN that is SMSed to the phone to register the website. filter out online only phone numbers. phone numbers can be traced to an owner, or "oh yeah, my boyfriend {XYZ} borrowed my phone that day" which is law enforcement due diligence when investigating crime
seems to be about as good a system as you can hope for
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I didn't RTFA, but who exactly is "Law Enforcement?" The capitalization makes it seem like it's the proper name of some organization.
The rotten and corrupt Domain Name System.
> two of Law Enforcement's twelve asks
Also known as questions in plain English. Or in this instance, possibly requirements.
It might become like flying I was a regular, I no longer fly.
Some thing others want worse than I do.
Prices gets high on grocery items I don't buy them, the store wants them worse than I do.
Same with products and services cost to much in my time or money I find something else to do.
I'll give the correct information on my domains. Until then, ICANN can go fuck itself. I'm tired of receiving spam sent to the address I use on my WHOIS listings.
They might hope that Whois would allow them to short-circuit the good old-fashioned policework method of following the money, but I'm afraid it's just not going to be that easy. Sorry guys, try again!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
two of Law Enforcement's twelve asks are "unlawful"
Can't you call them "requests" like a normal person?
systemd is Roko's Basilisk.
WHOIS data has been crap for a long time now. There is no longer any incentive for registrars and ISPs to keep accurate WHOIS data as there is no penalty for providing garbage. ICANN doesn't give a shit that hte data is crap, they only give lip service to the problem and then go back to rolling in their piles of cash.
The real question is who is the idiot who told law enforcement officers that there is meaningful data in the WHOIS databases anyways. I would bet that the ICANN assertion of 29% of it being bad is a huge underestimate.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Welcome to another New World Order / Law Enforcement Policy. Make up your own mind; but those are my thoughts.
All cows eat grass!
This does not apply to all European countries, there are still European countries that require that you have a local corporation and registration number to apply for domains [under the national TLD]. I assume you're wrongly using EU as a synonym for all of Europe(?)
The EU only requires that you don't put barriers in place, in any form, that hinder inter-European trade. French and Italian TLDs require a European address, but nothing beyond that.
Even within the EU's economic area (EEA), as per your original comment, includes countries that are not members of the EU itself. The same laws apply in the whole EEA-region.
http://en.wikipedia.org/wiki/File:Supranational_European_Bodies.png
It is in fact amongst this group of countries you will the few registrars that [still] require a local entity. I see now that there are very few left...
NORID of Norway's requirements are as follows:
Main requirements .no, you need to:
To register a domain name within
- have a local presence in Norway
- be an organization. At present this is defined as being one of certain forms of organization registered in the Brønnøysund Register Centre
- ensure that the domain is technically operative
http://www.norid.no/regelverk/index.en.html
This was/is a big issue at every conference, where of course the focus is always placed on 'policing' agencies wanting to know who operates an IP Address, however the concept is a lot greater than that. And of course, there is a perception that even at the highest levels (the Board) there is a lot of pressure by hosting companies who want to accomodate the customers who wish anonymity. The fact is that an IP Address or domain is/are Public lookup , and if you want to have an IP address/domain that is available to the public, you should post some public identity. This is used for a lot more than simply policing. Eg, various reputation services, auditing systems, and legitimate network operators who need to be able to identify the operator. Already, there are policies in place in theory to require this information; we already have tools and policies to do this, the problem that we hear is enforcement, and a mandate to take action during enforcement. There is a lot of finger pointing on this issue even amongst ARIN/ICANN officials and board members. And far too many times we see abusive behavior from 'Privacy Protected' holders of Public information. Now, it can be that the line on how much information about the holder should be publicized, but the operator/organization information at least MUST be provided, and the upstream providers should have a way to validate this information. And this has to be bigger than just ICANN/ARIN. We talk to operators who blatantly state that they do not collect information, and do NOT monitor activity on their networks, because they are concerned that if they 'know' about what is going on, they can be held responsible. Some protection must be given upstream providers, registrars etc, but on the basis they are diligent on getting information of the holders of public resources they assign.
"The EU is behind more positive changes in IT"
Name one mainstream application platform, development environment, or key technology that isn't built upon technology originally developed in the US or blatantly stolen by countries like China. IBM, MS, Apple, Xerox, Dell, HP, Google, Facebook, Twitter, Oracle, Red Hat, and CISCO are just a few examples of the global IT contributions developed in the US. And while the Internet has grown due to contributions from both inside the US and outside the US the fact is the Internet began life as a DARPA project. There is a good reason the Internet root servers are under US management and will remain so. Nationalism be damned the fact is the world at large contributes very little to advancing IT technology. Why should they invest the time and money when you can just use what others develop. This mirrors why the EU would rather rely on US military technology and protection. That's not to say their are no foreign contributors but the majority of non-US professionals live and work in the US because that is were the opportunities are. Even Torvalds had to immigrate to the US to advance his Linux development because even though Linux might be considered open source he actually got corporate sponsorship and a salary while doing continuing his work. Do you think Google would have succeeded if it was developed in Russia? About the only country contributing any thing worthwhile in IT technology is Isreal.
And your privacy issue is 100% BS. England has a CCTV on every corner. And while people everywhere bemoan privacy issues you should remember the US government could have tracked you down way before the Internet was every built. Drivers licenses, Mortgages, Personal property deeds, bank accounts, tax rolls, birth certificates, and even wire tapping have been available for quite a while. It might have taking more time to put the information together but the end result is the same. And wile I can't speak for Europe or any other country the US has strict rules of evidence in place for judicial procedures and I have seen no evidence any US citizen has been convicted of a crime based upon warrant less data collection. Evidence collected illegally is regular in admissible in court proceedings. The only way to get around this is for the prosecutor to argue inevitable discovery. Also give me an example of the EU sticking up for it's citizens. No government or system is perfect by any means but the EU has really never shown that they have a spine to deal with any important problems facing the world today. They prefer to castigate the US for not providing a solution and when the US tries they get accused of meddling. And finally I really wish the EU would develop their own IT technology because I am tired of traveling to the European continent to help make sure their technology and associated applications actually work.
"The EU is behind more positive changes in IT"
Name one mainstream application platform, development environment, or key technology
I'll name three, off the top of my head:
1. The World Wide Web
2. Linux
3. The ARM CPU