Web Hosting Talk : Web Hosting Main Forums : Domain Names : The End of Bogus Whois Information?

[rapidtransit]

It's been almost a month since this appeared in the Washington Post:

http://www.newsbytes.com/news/02/176371.html

I apoloigize if this has been covered here before, but I didn't see it. In brief, the U.S. Congress is considering legislation to criminalize phony information in domain registrations "with intent to defraud."

"Intent to defaud" could be specific (running an illegal business) to very very general.

[Chicken]

Originally posted by rapidtransit
"Intent to defaud"

it is wording like that that completely either kills bills and makes it so they never go anywhere, *or* allows them to pass and then creates some really nify jobs for lawyers and confusion among everyone, landmark cases by a judge or judges, etc.

It is wishy washy at best.

[thewitt]

All this law really does is put some legal system teeth behind existing ICANN regulation. It's nothing new. It's another "Law of convenience" so that registrars will not be sued when they take away domains because the registrant used bogus information. In this case, the registrar was defrauded - since the registrar is required to make sure this data is accurate.

It's really not a new requirement, just a new way to make sure it's met.

-t

[DesElms]

Originally posted by thewitt
It's another "Law of convenience" so that registrars will not be sued when they take away domains because the registrant used bogus information. In this case, the registrar was defrauded - since the registrar is required to make sure this data is accurate.

What in the world would ever make you think that registrars have that kind of clout with legislators? Or that even ICANN does, for that matter? Why would legislators give a damn one way or the other whether registrars have an achilles heel of potential civil liability? That's not why Representatives Coble and Berman proposed the law at all, and I'm stunned by the ease with which you just pulled this out of the blue sky and so casually laid-it out here as if it were commonly known and obvious fact.

Law enforcement agencies have long been frustrated by bogus WHOIS data. FBI Crimes Against Children Coordinators (CACC) around the nation have complained to legislators that they can't easily find the pedophiles who host child pornography web sites when said sites' domain name ownership is falsified. Department of Justice investigators trying to make cases against copyright violators and other white collar criminals have complained of being stifled in their investigation of perpetrator domain ownership when WHOIS records are falsified. Federal Trade Comission field office attorneys and investigators complain that they are frustrated by bogus domain ownership information when they're hunting down alleged perpetrators of or witnesses to online deception, hucksterism and other illegal practices. And the FBI's Internet Fraud Complaint Center (IFCC) has complained that their investigations are often slowed-down by falsified WHOIS records.

Those, and those alone, are the reasons for Coble's and Berman's proposed legislation. They don't care one whit about whether a registrar can head-off potential liability. Moreover, if such a law existed, it would not even come close to having the effect on potential civil suits that you suggest.

Originally posted by thewitt
It's really not a new requirement, just a new way to make sure it's met.

Well, that, at least, is true.

[thewitt]

Actually, I "so casually" pulled that out of thin air because it's true.

The domain registrars have only one recourse today to keep registration information valid, and that's to put a domain on hold. There are not other penalties available to them, and as such the current ICANN regulations are not enforceable - and as you have stated, this frustrates law enforcement as well as any other agency that attempts to use this data.

The reality is even with the new law, it's not going to get any better. If a registrant supplies false data, who will know? No one will be policing the hundreds of thousands of new registrations in order to see if they were made with legal data or not. The only time it will come to light is in the case of a UDRP dispute or the potential law enforcement activities.

The reality is there are still very few options here. Put the domain on hold so it's unusable, or take it away completely. Fine the owner or put them in jail? Sure - assuming you can find them to serve them. Remember, they didn't use valid data to register their domain in the first place.

All the law does is put some teeth into existing regulations, making it less likely that you as a registrar will be sued when you take a domain out of circulation. It will have very little real application in enforcement of the law.

-t

[rapidtransit]

Originally posted by thewitt
The reality is even with the new law, it's not going to get any better. If a registrant supplies false data, who will know?

In many cases, they won't unless there is, as you say, legal action. However, if law enforcement interests itself in certain areas, such as porn or hate sites, there could be sweeps.

Also, some Whois data is blatantly false. Blank required fields, non-existing zip codes, telephone numbers of 000-0000 or 555-1212.

Now you can say that phony registrants will simply be more careful to put in plausible data. But that could increase their criminal liability if they do get caught, because it is increased evidence of "fraudulent intent." Ever hear the phrase "guilty knowledge"?

[DesElms]

Originally posted by thewitt
I ... pulled that out of thin air because it's true.

I see. Well... I guess that just about says it all, doesn't it?

Originally posted by thewitt
The domain registrars have only one recourse today to keep registration information valid, and that's to put a domain on hold.

Putting the domain "on hold" is not only not the registrar's only recourse, it's not even among the registrar's choices as prescribed by ICANN regulations. From the May 10th ICANN advisory that caused the recent spate of articles on this subject -- and concomitant discussions, such as this one -- in the first place:

If the registrant fails to respond "for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details", then pursuant to RAA Subsection 3.7.7.2 the registrant is in "material breach" of its registration agreement with the registrar. That subsection also provides that "willful provision of inaccurate or unreliable information" shall constitute a material beach of the registration agreement. Under either of these circumstances, the RAA provides that the material breach of the registration agreement shall be "a basis for cancellation of the Registered Name registration." Accordingly, if the registrar's investigation results in a determination that the registrant is in material breach of its registration agreement, then in the absence of extenuating circumstances the registrar should cancel the domain registration.

"Cancellation" means cancellation. Period. It couldn't be more clear. The registrar is required by ICANN to have a registration agreement with the registrant which sets forth, among other things, the registrant's ability to cancel a registration when there is a material breach of said agreement; and said agreement must require that the data in WHOIS records be accurate. This is a civil matter, not a criminal one. And no registrar that follows ICANN's rules and creates, executes and fairly enforces an adequate registration agreement has anything to fear in the way of lawsuits from registrants who end-up getting their registrations cancelled as a consequence of their provable (by a preponderance of the evidence) material breach thereof. This is a slam dunk for the registrar. There's no liability issue here. Never was.

Originally posted by thewitt
There are not other penalties available to them, and as such the current ICANN regulations are not enforceable - and as you have stated, this frustrates law enforcement as well as any other agency that attempts to use this data.

While law enforcement is frustrated by the lack of accurate data in some WHOIS records, the proximate cause of that condition is not the unenfoceability of ICANN regulations -- which, incidentally, are completely enforceable, as clearly shown above.

Originally posted by thewitt
If a registrant supplies false data, who will know?

Knowing -- at least on some levels -- is not as difficult as it seems. While there is no foolproof method, just as there is no foolproof burglar alarm system, there certainly are a number of automated procedures that could go a long way toward eliminating certain kinds of false information in WHOIS records. Again, from the May 10th ICANN advisory:

Although 3.7.8 [of the RAA] envisions that ICANN may develop a policy requiring registrars to verify the contact details at the time of registration, ICANN has not yet done so. Nonetheless, registrars will find that implementing readily-available techniques to verify the format of data in the registration process (such as screening for blank fields or checking that addresses have valid post codes) will diminish the need for manual processes that would later be necessary to comply with the requirement to investigate reported inaccuracies.

Originally posted by thewitt
The reality is even with the new law, it's not going to get any better.

I believe that's wrong; that it will get better... or at least it could.

And it's not a law yet. Far from it, it will no doubt take several introductions of such legislative language before any of it actually begins to stick. I certainly wouldn't hold my breath for Coble and Berman's bill to even clear committee, much less be presented for a vote. But this is probably the beginning of a several year process wherein the language that may eventually become law will be refined until it's ready.

Originally posted by thewitt
The only time it will come to light is in the case of a UDRP dispute or the potential law enforcement activities.

No surprises there. Many laws are enforced that way. Just ask the IRS.

Originally posted by thewitt
No one will be policing the hundreds of thousands of new registrations in order to see if they were made with legal data or not.

I can virtually assure you that the authors of the bill have no interest in seeing that happen. Laws like this are not written so that massive infrastructure to enforce them will need to be created. Laws like this are written for basically two reasons:

1. So that a certain percentage of those who might otherwise have done what the law forbids will, because of the law, decide not to after all, and,

2. so that law enforcement will have yet another tool it can use when pursuing a bad actor against whom it may be having a bit of difficulty making its case in chief, but whom it can nevertheless charge with other crimes -- like, for example, falsifying WHOIS data, knowingly and with intent to defraud.

Apparently you're just not watching enough Law & Order on Wednesday nights. With a strong case against him for the five year felony of falsifying WHOIS data, a suspected pedophile against whom the feds may have a not-as-strong-as-desired case for child pornography is a much easier person to both investigate, and to intimidate into a plea on the lesser offense. It's a tool -- more a means, than an end.

Originally posted by thewitt
The reality is there are still very few options here. Put the domain on hold so it's unusable, or take it away completely. Fine the owner or put them in jail? Sure - assuming you can find them to serve them. Remember, they didn't use valid data to register their domain in the first place.

The flaw in your thinking -- one of them, at least -- is your perception of what the goal is. So it shouldn't be a surprise that you've missed the boat regarding the options...

If the WHOIS data for a given domain is false -- whether or not said falsification was knowing and/or with intent to defraud and/or whether or not there even is a law which prohibits it -- ICANN regulations clearly state that "if the registrar's investigation results in a determination that the registrant [has, in fact, falsified], then in the absence of extenuating circumstances the registrar should cancel the domain registration." That's it. Judge, jury, executioner. Done deal. End of discussion. It doesn't seem to me that many options more than that are required.

If, in addition, legislative language like Coble's and Berman's ever becomes the letter of the law, it will never be used to patrol the Internet for WHOIS scofflaws. Nor will it matter that anyone with whom the FBI would like to chat, as you put it, "didn't use valid data to register their domain in the first place." To begin with, were it prohibited by law, then that they did and that it's an easily-provable felony would simply be used as a tool when they're finally caught-up with. Seems to me like little more of an option than that would be necessary, either.

And, in addition, make no mistake about it: If you use a credit card to register a domain, and then if you actually turn around and use it anywhere in the United States, and if I had the resources of the FBI -- and the power of subpoena and search warrant -- I'd find you in fairly short order, sir. Make no mistake about it.

Originally posted by thewitt
All the law does is put some teeth into existing regulations, making it less likely that you as a registrar will be sued when you take a domain out of circulation. It will have very little real application in enforcement of the law.

A mere re-statement of that which you didn't state terribly well the first time -- only now worse. And it's every bit the flawed thinking now that it was then. Coble and Berman didn't give one bit of notice to existing ICANN regulations when they wrote their legislative language. They didn't care a whit if registrars had exposure to civil liability on account of their having, as you put it, "taken out of circulation" domain names with falsified WHOIS data. In fact, they didn't care if WHOIS records, generally, were accurate or not... as is clearly evidenced by their inclusion of the predicate condition of knowing intent to defraud as requisite to criminal culpability.

And, perhaps not surprisingly, your closing comment is dead wrong in my opinion. If such a bill were to ever become law, I assure you that you would quickly and clearly see, as you put it, its "application in enforcement of the law."

Just watch.

[Chang Lee]

I think that not everyone who posts falsified or blank WhoIs information with their registrars need necessarily be having intentions to commit fraud.

One big reason why people dont post their correct WhoIs info is simply because they wish to retain their privacy.

A good suggestion would be to have two sections to every WhoIs record...

Section 1 would require compulsory and accurate information which should only be accessible by AUTHORITATIVE BODIES such as enforcement bodies, etc.

Section 2 would require obligatory information which should be accessible by the PUBLIC.

Wouldn't that be a good idea?

I also have another question:

Often I see blank WhoIs info. How do people do that? My registrar REGISTER.COM doesn't allow that, it seems... forcing one to input false info

[rapidtransit]

Originally posted by DesElms
ICANN regulations clearly state that "if the registrar's investigation results in a determination that the registrant [has, in fact, falsified], then in the absence of extenuating circumstances the registrar should cancel the domain registration." That's it. Judge, jury, executioner.

Does the registrar really have such absolute power? What if the investigation is mistaken, or even corrupt? Can you see the possibiliy of "finding" a defect in a registration that would enable a coveted registration to be picked up by a third party?

Also, for such purposes, who is a registrar? Only an ICANN-designated registrar? What about a reseller who may actually collect the data, only passing it on to a registrar?

[allan]

If this law is passed, what affect wil lit have on the sub-$10 registrars? Obviously it is going to cost more if they have to ensure data is valid, will that cost be passed on the consumer?

[rapidtransit]

Originally posted by uuallan
If this law is passed, what affect wil lit have on the sub-$10 registrars? Obviously it is going to cost more if they have to ensure data is valid, will that cost be passed on the consumer?

I don't see anything that puts that requirements on registrars (yet). It looks like it would criminalize fraudulent registrations but doesn't say what registrars would have to do that they don't do now.

The Washtech link appears to be gone. Here is a followup on the Internet Democracy Project with a link to C-Net:

http://news.com.com/2102-1017-921236.html

Here is the Federal Trade Commission's take on what this is about:

http://www.house.gov/judiciary/beales052202.htm

[allan]

Actually, according to ICANN it might:

"3.7.8 Registrar shall abide by any specifications or policies established according to Section 4 requiring reasonable and commercially practicable (a) verification, at the time of registration, of contact information associated with a Registered Name sponsored by Registrar or (b) periodic re-verification of such information. Registrar shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy."


This is from:

http://www.icann.org/announcements/advisory-10may02.htm

If ICANN decides to specify what is considered "reasonable", it may wind up costing the registrar more money per domain.

[rapidtransit]

Originally posted by uuallan
If ICANN decides to specify what is considered "reasonable", it may wind up costing the registrar more money per domain.

Well, the devil is in the details, but it says "reasonable and commercially practicable, which implies that registrars won't have to jump through hoops.

Maybe it would be a good idea for the gummint to supply registrars with approved software filters for registration. If the registration passes the filter, the registrar is off the hook.

Or perhaps a copy of all new and altered WHOIS information could be electronically forwarded to a government agency, and let them run it through whatever tests they think appropriate.