back to article Privacy advocates descend on proposed domain name change

A proposal to force domain name owners to reveals their true identity and address if their website is deemed "commercial" has set off a privacy storm. Under the proposal put forward by domain name overseer ICANN, any "registrants of websites engaged in active commerce" would not be entitled to use proxy services, which replace …

  1. Anonymous Coward
    Anonymous Coward

    um...

    I agree, but only if there is a unescapable, untimately-terminal penalty for not forwarding the messages to the registered owner of the domain, and only if there is a similar penalty for the owner ignoring the messages.

    On the other hand, if your domain is a .com, ...

    1. the spectacularly refined chap

      Re: um...

      I agree, but only if there is a unescapable, untimately-terminal penalty for not forwarding the messages to the registered owner of the domain

      But that doesn't really get you very far. If the site is engaged in commerce you still need real contact data in case of dispute. "These guys promise to send on the correspondence" doesn't look very good on a county court writ and ultimately the bailiffs can't do anything without knowing where the defendant is. You can claim simply "Get a court order and force them to release the data" but in most jurisdictions pursuing something other than money (such as records) is vastly more complex and expensive. And that is always assuming the proxy companies don't relocate to some noddy jurisdiction where such orders are difficult or impossible to get.

      Privacy is generally something to defend, but if you are trading with the public and taking money from them you have to follow the rules of the game. Being accountable for what you sell is part of that.

      1. xerocred

        Re: um...ICANN hypocritical bastards

        Even ICANN don't follow their own rules. There is no name in the contacts on their own whois entry whois search engine..

        So why should anyone else?

      2. Anonymous Coward
        Anonymous Coward

        Re: um...

        In most cases if you are carrying on commercial activity you will be some sort of company and thus registered with companies house or equivalent, no?

        1. Lee D Silver badge

          Re: um...

          Sole traders.

          Indie game makers.

          People who take chips out of old ZX Spectrums and sell them on via Paypal for a couple of quid a time.

          eBayers

          People who use Etsy and put their stuffed animals on their website.

          Cam-girls (private individuals selling videos)

          A small pottery down in Somerset which is a one-retired-man operation to keep his hands going.

          Random political blogger / whistleblower who wants to not have to publish a name to put information on his domain.

          I can think of any number of private individuals, and especially some who DO NOT want their personal data sitting on their domain name, that won't be registered companies but might well come under these restrictions.

          For most of them, just the cost of registering a company would be prohibitive compared to what they bring in in a year via that activity.

          But, ignoring all that, my personal data is my personal data. Under EU law, you have to have a need to be able to disseminate that. Giving Joe Bloggs on the other side of the world my home address, on demand, just because he asked is not a reasonable use of my data. Sorry, but it's not.

          And companies are EXACTLY the type of people who should be forced to give them information, and personal users the ones not to, not the other way around.

      3. LucreLout

        Re: um...@The spectacularly refined chap

        While I generally agree with your sentiments, there seems very little difference between using a proxy, or simply using your corporate lawyers name and address. They won't divulge your details without the same court order.

        Yes, small claims paperwork can guarantee to be delivered if senrt to the lawyers office, and they will have to demonstrate they followed a KYC process. It seems to me that the same should be made applicable to proxies, rather than reworking privacy rights.

        An extreme example of hiding under the proposed process would be simply to register a company in say bermuda and have them set up a shell corp in say delaware. Repeat until you've chained legal entities half way around the world, then have the last in line register the site at their correspondence address. The level of court orders required from 30+ jurisdictions would prevent all but the most determined and well resourced company from determining your real identity and address. Unless I'm mistaken, the person signing the threat letters from the BBC TV licencing is still a wholly fictitious person, so until you actually arrive in court you would be unlikely to have to give your real name.

  2. Anonymous Coward
    Anonymous Coward

    I always lie glibly on the forms.

    Order me to give out my real data and then blackmail me into a yearly fee to not publish it to abso-bastard-lutely everyone on the web? I think not.

  3. Anonymous Coward
    Anonymous Coward

    Sub editors all on holiday?

    'A proposal to force domain name owners to reveals their true identity'

    'reveals' really, come on it's in the first line.

    I might as well read The Guardian.

  4. phil dude
    FAIL

    liability...

    corporations need more liability for having any personal data...and its usage.

    Isn't this just creepy?

    P.

  5. Anonymous Coward
    Anonymous Coward

    According to savedomainprivacy.org, "WHOIS contains contact information for small businesses, churches, individuals, even minor children."

    Thanks for thinking about the children! But should they really be "engag[ing] in active commerce"??

    Businesses and churches - are their names, PO boxes and phone numbers really that sensitive? You wouldn't find them in the phone book, or maybe even on their websites??

    Privacy is for individuals. Companies and other organizations, need to be accountable.

    1. Graham Marsden

      @AC

      Yes, Companies and other organisations need to be accountable, but *until* such a point as that accountability becomes an issue, those behind them should still be entitled to their privacy.

      Imagine if you're operating a Gay Rights organisation in one of the many countries where homosexuality is criminalised?

      Or what about parts of the world where one schism of the religion you follow deems your particular schism to be apostasy and punishable by death?

      There are plenty of other examples like this, would you want your real name to be easily accessible if you were in such a situation and wanted to set up a website for like-minded people?

      1. Where not exists

        Re: @Graham Marsden

        "Imagine if you're operating a Gay Rights organisation in one of the many countries where homosexuality is criminalised?

        Or what about parts of the world where one schism of the religion you follow deems your particular schism to be apostasy and punishable by death?"

        Then why not choose a TLD other than .com? There are many more now than there used to be, with many of them generalized and without a business intent.

        1. Graham Cobb Silver badge

          Re: @Graham Marsden

          Where did you get the idea this is about .com? This is about ALL domains: the rule says you will not be able to register any domain name using a proxy if you are deemed to be using it commercially. What is "commercially"? Who decides? If I am non-commercial today can I be deemed to be commercial tomorrow? Am I commercial if I include ads on some of my pages? What if I ask for donations? What if I ask for donations to a charity? What if I use my webpage to advertise some charitable event (Children in Need)?

          It is ridiculous. There are national laws about how trading entities make themselves known (e.g. UK companies have to publish their registered number). The national rules of the person registering the domain should apply. And so should their data protection rights (so if I have used a proxy in the EU, it would be violation of my data protection rights for the proxy to pass my name on to anyone who asked except law enforcement).

    2. Anonymous Coward
      WTF?

      Well excuse me AC, but my first professional gig as a statistician and programmer was when I was 14. I even had the computing center dedicate an entire disk pack on the IBM 370 for my use. We only wanted to deal with the 25,000+ data punch cards loading once. The Chairwoman of the department of Statistics and Computer Science happened to be my mentor so it wasn't unusual to find me in the center or outlying facilities learning from lBM system engineers and other professionals in statistics or comp. sci. It was a lot of fun.

      Were I that age today working in the mathematical, computing and engineering fields, I sure as heck would have a nice site out there to hang out my consulting shingle. Oh, and I'd be paid at least $345 per hour in today's money. They actually got a bargain by a factor of 400,000 or so ROI.

      Ya'd think that maybe some sort of masquerade would be appropriate. We did do a DBA (Doing Business As) which still exists today. On campus there really was no concerns about where and what I was doing. [Just a lot of patronizing smiles until I did presentation in class or lab.] Today, I can see some concerning points. And I'm very far from holding any kind of record in starting a business. Should we expose all of these individuals to the full force of open disclosure? Always? I can't speak to any of that save my own experience but at the time, I did not realize how much behind the scenes cover that was being run by those around me. The only 'solution' appropriate that comes to mind is rather expensive; that of establishing a corporation with some adults in supervisory (officer) roles.

      Anyway, this is all speculation until the crap really hits the fan. I do hope Zuckerberg and his ilk has a ton of money to spare. They'll need it. Reminds me of the internet bullying incidents although there was real money on the table. [Oh, I did have to cope with bullys, but as I ran around on my bike with this huge-ass chain with a large, heavy lock. I'd start it swinging and ask 'whose first?' Worked like a charm.]

  6. Shadow Systems

    It's called DotCom for a bloody reason.

    As in Commercial domain, originally intended for businesses enguaged in commerce.

    Since anyone & their dog's groomer's aunt's hairdresser's podiatrist's dead cat Wink's Medium can get a DotCom domain for the onorous price of the cost of lunch at the local rolling RoachCoach, that's obviously no longer true.

    If you're not taking money from strangers in exchange for goods or services, aka an actual Commercial venture, then by all means keep your privacy. I don't care & don't need to know whom you are, since you don't have access to my financial data.

    But if you ARE enguaged in Commerce, then you don't get to remain hidden anymore. I need to know you're a legit vendor whom has records on file where I can freely Copy+Paste them into the Police Report if need be. Not having to obtain an expensive Court Order to force a proxy service to reveal your data, but your data in full view of the public. If you're not willing to be open & up-front with us, then you don't deserve to be doing business with the public. That kind of shady marketer is typicly operating off the boot of the car in the alley behind the Stop-N-Rob at two A.M. with a call of "Pssst. Hey, wanna buy a stereo?"

    If you're some persecuted bunch that needs money, there re reputable corporations out there that will collect on your behalf. You register with them to do the collecting, they put their corporate face/rep/ass on the line to do it. If they fuck over the people doing business with them then they have public identifying info that we can use to sue them. You get your cover of anonymity, you get donations, and we get someone whom can have the cops called on them for fraud.

    And that's what it all boils down to. You may want to be anonymous, but you ALSO want to be doing business with the public. The Public has the Need/Right To Know whom they're doing business with, and that means real ID contact info for use in a call to the police to file a complaint. No real contact data means you aren't a legit place to do business.

    Would you be willing to fork over your cash to the local Chemist if they wore a full face hood to hide their features, a voice masking warbler to make it impossible to identify them by theirs, and removed their address numbers off the front door to try & prevent you from knowing where you were doing business at in the first place?

    Because that's what the anonymity of a proxy in the WhoIs data is accomplishing; the Chemist can change the name on the front door, change the hood colour, alter the timber of the voice, & beat the crap out of you for all your cash safe in the knowledge YOU can't ID them to the cops when you want to report it afterwards.

    That's why if I intend to do business with someone & there's a proxy in the WhoIs, then I go elsewhere instead. Even if it's just a DBA line with a corporate street address as the WhoIs entry, that's what you list in the Court Filing to sue the shit out of them. A Proxy isn't the Business, and thus can tell you to go fuck yourself with those Filing forms.

    1. Lee D Silver badge

      Re: It's called DotCom for a bloody reason.

      Companies are required only to give you their head office name and address. NOTHING else. The "particulars" as they are known.

      The guy behind the counter does not need to give you his name at all. His company might say that but they are under no obligation to at all. There is no legal requirement that he show YOU his qualification certificates or allow you to ask his university whether he is actually a pharmacist or not. He doesn't have to give out his phone number or home address to anyone who walks up.

      The ONLY details that *you* are legally able to get off him without a court order are the company details of the company he works for. That's it. You want any more, you have to ask a policeman or court to obtain them unless he gives them up voluntarily. However, if there's a grievance, you go to someone who DOES have that capability.

      There is no requirement for him to publish his name, address, home phone number, personal email address etc. and put it on a placard at the front of the pharmacy and publish it online. None. Because it's HIS. Even if he's a sole-trader - unlikely - he doesn't need to give that information to YOU, nor to every single person who looks. Market stall holders do not need to tell you their home phone number, even if you demand it, without a court order. They have to give it to police / courts on demand, of course, but that's always an available option via places like ICANN and proxy companies anyway.

      Not everyone with .com is a business, not every business is a company, not every guy selling crap out of his loft via his own domain will want to register as a company just to stop you getting his home address.

      So, please stop talking rubbish. You're inflating what a company is required to do with what a sole trader, private individual selling goods on eBay, or random person with a Donate button on their website would be required to do.

      And .com might have originally meant commercial but it also meant INTERNATIONAL / stateless commercial (that's why the regional descriptors are there, but we're supposed to be .gb anyway, not .uk) - so anyone with a .com who doesn't trade internationally should be thrown off too (bye bye askmid.com, the official UK government place to check if you're on the motor insurance database), and .org should be non-profit organisations, etc. but NOBODY has ever enforced any of those restrictions ever. Because they aren't binding, only a recommendation. There's nothing that says they will take your .com away just because you're not a commercial entity or vice versa.

      (P.S. I'm sure you don't use 90% of online websites, then, if you don't use proxied-whois.)

    2. Velv
      FAIL

      Re: It's called DotCom for a bloody reason.

      "I need to know you're a legit vendor whom has records on file where I can freely Copy+Paste them into the Police Report if need be"

      I conduct commercial operations using a .com address. I only deal on referral, I don't advertise my services and I don't solicit new business from unknown parties. My business is registered with Companies House, there are several years of returns filed and on public record, and all contracts feature the company number of both my business and the client. There is ZERO requirement for anybody to use domain records to determine if I'm legitimate.

      I can see a case where there needs to be able to trace the operation behind a domain, but that does not warrant the details being published openly to every malicious bandit out there.

      1. Anonymous Coward
        Anonymous Coward

        Re: It's called DotCom for a bloody reason.

        My sites are test sites to try stuff out on before inflicting them on live sites (and also shiny covers for vanity-plate email addesses when I'm not blowing them up). There is absolutely no fucking way I'm publishing my home address on the same internet that Anonymous is on. I use mostly .coms because -unlike other TLDs- they have an inherent value....something that my grandkids may be immensely thankful for one day. Or not....can't tell from here.

        So @Shadow Systems you want to seriously compromise my personal security for your own convenience? Have you though of a career at GCHQ? My counter-argument is simply this: It's not meant to be easy. In the unlikely event of my committing police-worthy naughtiness, you file your police report and -if there is merit in your claim- the appropriate authorities will subpoena the webhost who will in turn cough up all the needed info to locate me. A little cumbersome, but it works. If you display the info to all; any idiot with a grudge can have a go and -in a population of 7 billion there are a lot of idiots and a lot of grudges; and let's not forget lulz here.

        Furthermore, in the (probably unlikely) event of our doing business, I am quite happy to send information over a more private channel like email but am absolutely not prepared to publish it for the great unfiltered masses. I do web stuff; and have a list of about 30,000 IP addresses so far this year who are definitely out to get me, or at least my sites, so you can't really call it paranoia.

        ICANN can pronounce what they like. Publishing my home address just ain't happening.

  7. Anonymous Coward
    Anonymous Coward

    Perhaps the whois record should list your ISP unless you are a corporate

    Law enforcement can ask your ISP for personal contact details, joe public does not have access to your personal detail. This should be managed in a similar way to Uk electoral rolls.

    I still believe that there should be some "live" contact number or email or similar in the event an administrator has to be contacted - this does not have to be personal - it just has to be monitored

    1. Anonymous Coward
      Anonymous Coward

      Re: Perhaps the whois record should list your ISP unless you are a corporate

      I don't object to publishing a live email addess that I'll actually monitor read and reply to, but my name, home address and number... this is just giving identity thieves a gift.

      I have several dotcoms. Only once was I contacted via whois info - by email... someone wanted to acquire the domain of my client who I had registered their domain for over 10 years. The offer was declined.

      1. Anonymous Coward
        Anonymous Coward

        Re: Perhaps the whois record should list your ISP unless you are a corporate

        Every .com I have has a contact form on the site anyway. If anyone genuine wants to find me, all they have to do is ask. Takes seconds.

  8. Anonymous Coward
    Anonymous Coward

    Journalist Laurie Penny

    I wonder why Journalist Laurie Penny thinks using her real name on Facebook will increase the risk of rape and death threats?

    I quick google shows she writes in quite a few place on the web under her real name already!

    e.g. http://www.newstatesman.com/blogs/laurie-penny

  9. jerryperes

    I really enjoy reading your blog. I think security and privacy of domain names is the most important factor for a website. If you want to transfer or renewal domain names then you can visit on our website.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like