<div dir="ltr"><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Hi all,</font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br>
</font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Following up on the white paper that Libby Baney just circulated, and as we wrap up our discussion regarding distinguishing between commercial and non-commercial use, I thought it might be helpful to provide a concrete example of a domain name that (I trust we can all agree) is being used for commercial purposes. Perhaps we can collectively think through whether it makes sense for this domain name to be afforded privacy protection. For simplicity, I am only using one domain name as an example, but there are thousands like this in our database alone. I hope that a concrete example will be helpful to the discussion.</font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Let’s take the domain name <a href="http://medsindia.com" target="_blank">medsindia.com</a>. First, as you can verify with a Whois query, it is using proxy/privacy services. </font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
<font color="#073763" face="courier new, monospace">Registrant Name: General (c/o Rebel.com Privacy Service)</font></div></div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Organization: Private Domain Services</font></div>
</div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Street: 300-12 York Street</font></div></div><div class="gmail_default"><div class="gmail_default">
<font color="#073763" face="courier new, monospace">Registrant City: Ottawa</font></div></div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant State/Province: ON</font></div>
</div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Postal Code: K1N 5S6</font></div></div><div class="gmail_default"><div class="gmail_default">
<font color="#073763" face="courier new, monospace">Registrant Country: CA</font></div></div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Phone: <a href="tel:%2B1.866-497-3235" value="+18664973235" target="_blank">+1.866-497-3235</a></font></div>
</div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Phone Ext:</font></div></div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Fax:</font></div>
</div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Fax Ext:</font></div></div><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="courier new, monospace">Registrant Email: <a href="mailto:IVP1JQKYRM3LQED1@rebelprivacy.com" target="_blank">IVP1JQKYRM3LQED1@rebelprivacy.com</a></font></div>
</div></blockquote><div class="gmail_default"><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">How is it being used? It’s fairly straightforward: it sells addictive (controlled substances) and other prescription drugs without a valid prescription. But that’s not all: </font></div>
<div class="gmail_default"><ul><li><span style="color:rgb(7,55,99);font-family:arial,helvetica,sans-serif">As noted, it sells prescription drugs, including controlled substances, without requiring a valid prescription. </span><br>
</li>
<li><span style="color:rgb(7,55,99);font-family:arial,helvetica,sans-serif">The drugs are not sold by a pharmacy licensed or otherwise recognized in the patient’s jurisdiction, as is the standard requirement. </span><br>
</li><li><span style="color:rgb(7,55,99);font-family:arial,helvetica,sans-serif">The drugs are considered unapproved or falsified, depending on the regulatory language in the jurisdiction. Part of the reason is that they are illegally imported into the customers’ jurisdiction and thus unregulated for safety or authenticity. </span><br>
</li></ul></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">To be clear, this domain name is not being used for legal commercial purposes in any jurisdiction. (Despite its claim to be using a licensed pharmacy in India, not even in India, for reasons I can explain separately if anyone wants to know.) I choose this domain name because I do not think its unlawful or dangerous use can be disputed. I would further argue that the use of the p/p protection allows the unlawful actor to continue operating, as I explain below. </font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Being privacy protected, of course, we can’t immediately tell who is operating the website. Can we get law enforcement or courts in the registrar’s jurisdiction to do anything –– e.g., go to the registrar and ask or require them to reveal the identity of the registrant? No. Try to buy a drug such as Xanax from this website. This Internet pharmacy will ship anywhere in the world <u>except</u> to Canada –– where its registrar and servers are located. To protect its ability to sell drugs globally, the registrant has sacrificed sales to a single country, and chosen a registrar and servers there, to create a safe haven. Consequently, Canadian law enforcement cannot point to a violation of Canadian law: no drugs are being shipped into Canada –– just everywhere else around the world. (Which, we can infer, is why this registrant removed Canada from their shipping destinations.) And, the reverse is true –– a court order or law enforcement request from outside of Canada can simply be ignored by the registrar and server companies in Canada. Those who have argued that the best way to deal with p/p use by illegal actors is simply to get a court order are not accounting for this quite common scenario.</font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Being able to hide their identity in the Whois record is also the perfect set up for another reason: many registrars have said in the past that they only way that they can (or perhaps, will) take action on a domain name is if the Whois record is falsified. But how would we know? It is privacy protected. That removes the WDPRS as a mechanism for dealing with abusive behavior. </font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Does this commercial registrant have a legitimate need for p/p services? I would argue that that is not the question to be answered.<b> The question is: Does a consumer, consumer protection firm, government agency, etc. have the right to know who is operating this website?</b> I would submit to this group that it is incumbent upon us to recommend a thoughtful, balanced policy that prevents this sort of “perfect set up” for Internet criminals to hide their identity as this one has. Keep in mind that, as pointed out in the circulated paper, no such right exists in the offline world –– rather, consumers have the right to know who they are dealing with. Ample requirements exist for business registrations to do business transparently. There should be no difference in the online world. </font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Finally, recall that the Affirmation of Commitments (AoC) requires "timely, unrestricted and public access to accurate and complete WHOIS information." The AoC goes on to state that WHOIS policy and its implementation needs to meet "the legitimate needs of law enforcement and promote consumer trust." I ask the group, is ICANN fulfilling its commitment, not only to law enforcement but especially to promote consumer trust, if it allows websites like this to continue using p/p services?</font></div>
<div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#073763" face="arial, helvetica, sans-serif">Thank you for your consideration. </font></div>
</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><font color="#073763" face="arial, helvetica, sans-serif">John Horton<br>President, LegitScript</font><div> <img src="https://static.legitscript.com/assets/logo-smaller-cdb8a6f307ce2c6172e72257dc6dfc34.png" width="96" height="21"><br>
<div><div><p style="margin:0.0px 0.0px 0.0px 0.0px;font:12.0px Helvetica"><br></p><p style="margin:0px;font-style:normal;font-variant:normal;font-size:12px;line-height:normal;font-family:Helvetica"><b><font color="#444444">Follow</font><font color="#0b5394"> </font><font color="#000000">Legit</font><font color="#0b5394">Script</font></b>: <a href="http://www.linkedin.com/company/legitscript-com" style="font-weight:normal" target="_blank"><font color="#cc0000">LinkedIn</font></a> | <a href="https://www.facebook.com/LegitScript" style="font-weight:normal" target="_blank"><font color="#6aa84f">Facebook</font></a> | <a href="https://twitter.com/legitscript" style="font-weight:normal" target="_blank"><font color="#674ea7">Twitter</font></a> | <a href="https://www.youtube.com/user/LegitScript" style="font-weight:normal" target="_blank"><font color="#bf9000">YouTube</font></a> | <font color="#ff9900"><u><a href="http://blog.legitscript.com" target="_blank">Blog</a></u></font> |<font color="#ff9900"> <font style="font-weight:normal"><a href="https://plus.google.com/112436813474708014933/posts" target="_blank">Google+</a></font></font></p>
</div></div></div></div></div>
<br><br><div class="gmail_quote">On Mon, May 12, 2014 at 11:40 PM, Libby Baney <span dir="ltr"><<a href="mailto:libby.baney@fwdstrategies.com" target="_blank">libby.baney@fwdstrategies.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div><div>All --</div><div><br></div><div>I appreciate the dialogue the group has begun regarding WHOIS transparency for entities engaged in commercial activity. With the hope of encouraging discussion on the merits of the issue, I am pleased to share the attached white paper: <i><b>Commercial Use of Domain Names: An Analysis of Multiple Jurisdictions. </b></i></div>
<div><br></div><div>As you'll see, the paper addresses the following question: Should domain name registrants who sell products or services on their websites should be able to conceal their identity and location in the domain name registration? The paper argues that they should not. Rather, the authors find that requiring domain name registrants engaged in commercial activity to provide transparent WHOIS information falls squarely in line both with ICANN’s commitment to Internet users and existing global public policy to keep businesses honest and consumers safe. Accordingly, the paper recommends an approach that balances personal privacy and consumer protection rights. On the one hand, domain names used for non-commercial purposes (e.g., personal blogs) should, the authors believe, be permitted to utilize privacy or proxy registration. This reflects a fundamental right to privacy of domain name registrants not engaged in commerce. However, the authors do not believe the same right exists for registrants of websites engaged in commerce – a conclusion borne out by our research. </div>
<div><br></div></div><div>It goes without saying that this group is divided on the issue of requiring WHOIS transparency for sites engaged in commercial activity. As some in the PPSAI WG have commented, these issues may be complicated but they nonetheless merit our full consideration. We hope the attached white paper stimulates further thinking and group discussion on the issues. </div>
<div>
<div><br></div><div>I look forward to continuing the discussion tomorrow.</div><div><br></div><div>Libby</div></div></div><div><div><br></div>-- <br><div dir="ltr"><font face="trebuchet ms, sans-serif">Libby Baney, JD</font><div>
<font face="trebuchet ms, sans-serif">President</font></div>
<div><font face="trebuchet ms, sans-serif">FWD Strategies International</font></div><div><font face="trebuchet ms, sans-serif"><a href="http://www.fwdstrategies.com" target="_blank">www.fwdstrategies.com</a></font></div>
<div>
<font face="trebuchet ms, sans-serif">P: <a href="tel:202-499-2296" value="+12024992296" target="_blank">202-499-2296</a></font></div><div><br></div></div>
</div></div>
<br>_______________________________________________<br>
Gnso-ppsai-pdp-wg mailing list<br>
<a href="mailto:Gnso-ppsai-pdp-wg@icann.org" target="_blank">Gnso-ppsai-pdp-wg@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg</a><br></blockquote></div><br></div></div>