<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
h1
{mso-style-priority:9;
mso-style-link:"Titre 1 Car";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:24.0pt;
font-family:"Times New Roman","serif";
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Titre1Car
{mso-style-name:"Titre 1 Car";
mso-style-priority:9;
mso-style-link:"Titre 1";
font-family:"Times New Roman","serif";
mso-fareast-language:FR;
font-weight:bold;}
span.fieldset-legend
{mso-style-name:fieldset-legend;}
span.date-display-single
{mso-style-name:date-display-single;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:850722937;
mso-list-template-ids:-2120054954;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FR link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><a href="https://www.icann.org/en/news/public-comment/whois-pp-abuse-study-24sep13-en.htm">https://www.icann.org/en/news/public-comment/whois-pp-abuse-study-24sep13-en.htm</a><o:p></o:p></span></p><h1><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Study on Whois Privacy & Proxy Service Abuse<o:p></o:p></span></h1><p class=MsoNormal><span class=fieldset-legend><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Comment / Reply Periods (*)</span></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Comment Open Date: <span class=date-display-single>24 September 2013</span><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Comment Close Date: <span class=date-display-single>22 October 2013 - 23:59 UTC</span><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Reply Open Date: <span class=date-display-single>23 October 2013</span><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Reply Close Date: <span class=date-display-single>13 November 2013 - 23:59 UTC</span><o:p></o:p></span></p><p class=MsoNormal><span class=fieldset-legend><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Important Information Links</span></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><a href="https://www.icann.org/en/news/announcements/announcement-24sep13-en.htm"><span lang=EN-US>Public Comment Announcement</span></a></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><a href="mailto:comments-whois-pp-abuse-study-24sep13@icann.org"><span lang=EN-US>To Submit Your Comments (Forum)</span></a></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><a href="http://forum.icann.org/lists/comments-whois-pp-abuse-study-24sep13/"><span lang=EN-US>View Comments Submitted</span></a></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span class=fieldset-legend><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Brief Overview</span></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Originating Organization: <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'>GNSO<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Categories/Tags: <o:p></o:p></span></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1'><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Policy Processes<o:p></o:p></span></li></ul><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Purpose (Brief): <o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>This study, conducted by the National Physical Laboratory (NPL) in the United Kingdom, analyzes gTLD domain names to measure whether the percentage of privacy/proxy use among domains engaged in illegal or harmful Internet activities is significantly greater than among domain names used for lawful Internet activities. Furthermore, this study compares these privacy/proxy percentages to other methods used to obscure identity – notably, Whois phone numbers that are invalid.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>These findings will help the community understand the role that privacy and proxy service abuse plays in obscuring the identities of parties engaged in illegal or harmful activities, including phishing, cybersquatting, hosting child abuse sexual images, advanced fee fraud, online sale of counterfeit pharmaceuticals, and more.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Current Status: <o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>This Public Comment solicitation represents an opportunity for the community to consider the study results detailed in this report, provide feedback and request further clarifications. In parallel, ICANN and NPL will conduct Webinars to facilitate feedback by summarizing this study’s purpose, methodology, key findings, and conclusions.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Next Steps: <o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>NPL will consider all comments submitted to this Public Comment forum during the comment period, incorporate any needed clarifications, and then publish a final version of this Whois Privacy and Proxy Service Abuse study report. It is expected that this report will inform future GNSO policy development in relation to the Whois system. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Staff Contact: <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Mary Wong<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><a href="mailto:policy-staff@icann.org?subject=More%20information%20on%20the%20Study%20on%20Whois%20Privacy%20and%20Proxy%20Service%20Abuse%20public%20comment%20period"><span lang=EN-US>Email Staff Contact</span></a></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span class=fieldset-legend><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Detailed Information</span></span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Section I: Description, Explanation, and Purpose: <o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>At the </span><span style='font-family:"Arial","sans-serif"'><a href="https://community.icann.org/display/gnsocouncilmeetings/Motions+28+April+2011"><span lang=EN-US>request of the GNSO Council</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'>, ICANN engaged the National Physical Laboratory (NPL) in the United Kingdom to test the hypothesis that "<em><span style='font-family:"Arial","sans-serif"'>A significant percentage of the domain names used to conduct illegal or harmful Internet activities are registered via privacy or proxy services to obscure the perpetrator's identity.</span></em>"<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>To provide empirical data of use to Whois policy-making, NPL set out to measure whether the percentage of privacy/proxy use among domains engaged in various kinds of illegal or harmful Internet activities is greater than among domain names used for lawful Internet activities. Additionally, because privacy/proxy policy changes could prompt malicious registrants to elude contact in other ways, NPL also measured other methods used to obscure perpetrator identity – notably, invalid Whois phone numbers.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>This study, led by Dr. Richard Clayton of the University of Cambridge, gathered large representative samples of domain names implicated in various illegal or harmful online activities, ranging from unsolicited phishing, typosquatting, and malware distribution to hosting child abuse sexual images, advanced fee fraud (also known as "419 scams"), and online sale of counterfeit pharmaceuticals. Key technical inputs were also provided by Professor Tyler Moore of Southern Methodist University and Dr Nicolas Christin of Carnegie Mellon University.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>By examining sampled incidents and Whois data associated with domain names across the top five gTLDs – .biz, .com, .info, .net and .org – this study measured how often privacy or proxy services were abused by perpetrators (alleged and confirmed). Additionally, these results were compared to privacy/proxy use among domains engaged in lawful and harmless activities (e.g., banks and legal pharmacies), chosen to mirror studied illegal/harmful activities. Finally, researchers attempted to call registrants for a subset of these domain names not using privacy or proxy services, to determine whether they could in fact be contacted with only Whois data.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>This draft report summarizes project activities, methodology, sampled data and findings, including statistical analysis of differences observed by the research team. These study findings will help the community understand the role that privacy and proxy service abuse plays in obscuring the identities of parties engaged in illegal or harmful Internet activities.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>The GNSO Council is now seeking community review and feedback on the draft report. The purpose of this Public Comment period is to ensure that study results have been communicated clearly and to solicit feedback on desired clarifications (if any).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Section II: Background: <o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>As part of its effort to develop a comprehensive understanding of the gTLD Whois system, the GNSO Council expressed an interest in conducting an in-depth study of privacy and proxy service abuse among gTLD domain names registrants engaged in illegal or harmful Internet activities. At the GNSO's request, ICANN issued a Request for Proposal (RFP) in May 2010 describing a study to methodically analyze a representative sample of gTLD domains associated with a variety of illegal or harmful Internet activities. By comparing how often these "bad actors" use privacy/proxy services with overall privacy/proxy use, the GNSO hoped to prove or disprove its hypothesis that a significant percentage of the domain names used to conduct illegal or harmful Internet activities are registered via privacy or proxy services in order to obscure the perpetrator's identity.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>After considering RFP responses received from researchers willing to undertake this Privacy/Proxy Abuse study, as well as questions raised by both researchers and reviewers, the GNSO Council decided to fund a somewhat revised study proposed by NPL. Specifically, NPL proposed studying many but not all of the illegal/harmful activities enumerated by the RFP, using samples obtained largely from "live feeds" and authoritative sources. NPL declined to study DoS attacks, DNS poisoning, IP theft, and on-line stalking using incidents submitted by victims, questioning their relevance and/or the ability to gather reliably representative samples.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>In April 2011, this revised study was approved by the GNSO Council and awarded to NPL. When initiating this study, the GNSO Council asked that the study report expressly note that this study's purpose is only to analyze "bad actors". Notwithstanding the legal or harmless domain names studied here for comparison purposes, many legitimate privacy/proxy customers are unaccounted for within the scope of this study. This study does <u>not</u> attempt to measure privacy/proxy use or Whois accuracy across all gTLDs, as did broader studies such as that performed by NORC at the University of Chicago in 2010.<o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>The findings from this study are intended to provide empirical data needed to understand the role that privacy and proxy service abuse plays in obscuring the identities of parties engaged in illegal or harmful activities. This empirical data will create a baseline for evaluating potential Whois and Privacy/Proxy service policy changes.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Section III: Document and Resource Links: <o:p></o:p></span></p><p><span style='font-family:"Arial","sans-serif"'><a href="http://gnso.icann.org/en/issues/whois/pp-abuse-study-20sep13-en.pdf"><span lang=EN-US>Whois Privacy and Proxy Service Abuse Study Draft Report</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'> [PDF, 624 KB]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Section IV: Additional Information: <o:p></o:p></span></p><p><span style='font-family:"Arial","sans-serif"'><a href="http://gnso.icann.org/issues/whois/whois-proxy-abuse-study-18may10-en.pdf"><span lang=EN-US>Whois Privacy/Proxy Abuse Study Terms of Reference</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'> [PDF, 321 KB]<o:p></o:p></span></p><p><span style='font-family:"Arial","sans-serif"'><a href="http://gnso.icann.org/issues/whois/gnso-whois-pp-abuse-studies-report-05oct10-en.pdf"><span lang=EN-US>Whois Privacy/Proxy Abuse Study Staff Report</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'> [PDF, 437 KB]<o:p></o:p></span></p><p><span style='font-family:"Arial","sans-serif"'><a href="https://community.icann.org/display/gnsocouncilmeetings/Motions+28+April+2011"><span lang=EN-US>GNSO Council Motion April 2011</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p><span style='font-family:"Arial","sans-serif"'><a href="http://blog.icann.org/2012/04/national-physical-laboratory-of-the-uk-selected-to-conduct-a-gtld-whois-privacy-and-proxy-abuse-study/"><span lang=EN-US>NPL Selected to Conduct a gTLD Whois Privacy and Proxy Abuse Study</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>Additional Whois studies have also been conducted at the request of the GNSO Council, as summarized at: </span><span style='font-family:"Arial","sans-serif"'><a href="http://gnso.icann.org/issues/whois/"><span lang=EN-US>http://gnso.icann.org/issues/whois/</span></a></span><span lang=EN-US style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><hr size=3 width="100%" align=center></span></div><p><span lang=EN-US style='font-family:"Arial","sans-serif"'>(*) Comments submitted after the posted Close Date/Time are not guaranteed to be considered in any final summary, analysis, reporting, or decision-making that takes place once this period lapses.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif";mso-fareast-language:FR'>Glen de Saint Géry <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif";mso-fareast-language:FR'>GNSO Secretariat <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif";mso-fareast-language:FR'>gnso.secretariat@gnso.icann.org <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif";mso-fareast-language:FR'>http://gnso.icann.org<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>