<div dir="ltr">A lot of replies since last night<br><br>&gt;&gt;Would you be able to carry out your investigations normally if access to WHOIS thick were restricted only by the need to enter an email? <div><br></div><div>I am personally OK with being held accountable for the data i search for. I think a lot of the desire to require subpeonas or search warrants for WHOIS data is a need for the &quot;watchers&quot; to be held accountable, which I do believe in on a philosophical level. My search history would include NDA and sensitive information such as identities of clients and investigations in progress, so I wouldn&#39;t want it broadcasted, but I am absolutely prepared to demonstrate that my use is not abusive.</div><div><br></div><div><br></div><div>&gt;&gt;So basicaly what you say are… Buhu my work will get harder, let all innocent registrants suffer from spam/scam mail sprung out of the whois data published, all those registrants who get fake mails about renewing there domain or buying fake SEO plans?</div><div>How can anyone defend that we have data published to get abused just because some bad guys registrer domains? And those of you who does will still have access to the date just not in the same easy way…</div><div>&gt;&gt;Sorry for my harsh tone but I really don’t see why we cant look past our own walls and find a solution which are to the better for all..<br></div><div><br></div><div>I don&#39;t take it personally at all. And the spam to WHOIS data is a problem. I used to use real data on some old domains of mine, until I started receiving the spam, and discovered the existence of WHOIS and how easy it is to access. I have not used real info since that time.</div><div><br></div><div>But the reality is that cybercrime is a growing multi billion dollar &quot;industry&quot;, and the community of people that resist this industry is VERY small, and VERY overwhelmed. If our jobs get harder, it won&#39;t be us who are &quot;buhu&quot;ing, it will be you and everyone else who will pay higher fees on everything. We will be paid handsomely regardless, so I&#39;m not speaking on behalf of myself but on behalf of the people I try to protect. If you want to make light of a global problem, please choose one that doesn&#39;t involve unbelievable amounts of monetary losses, and doesn&#39;t cause far worse privacy violations than the stuff yall seem to be concerned about.</div><div><br></div><div>Here are some hard facts about the volume of abuse going on:</div><div><a href="https://www.spamhaus.org/statistics/tlds/">https://www.spamhaus.org/statistics/tlds/</a></div><div>Right now, 93.3 percent of all domains registered under the .science TLD are malicious!</div><div><br></div><div>&gt;&gt;<span style="font-size:12.8px">the question should be: Do you have a legally enforceable right to access that data and do with it whatever you please.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">At the moment, the answer to that is yes. And network owners also have a right to decide who they want to interact with. WHOIS is used as part of that determination. Not only is registrant data correlated with past malicious registrants, but the age of the domain is also determined through WHOIS. Without this granularity, network owners will absolutely err on the side of blocking too much over too little. We already see this with residential ISPs blocking entire TCP and UDP ports for their customer base, because the alternative is a level of abuse that takes the entire network down. Where is the &quot;free and open Internet&quot; when the Internet doesn&#39;t work anymore? Those are the battles that are being fought right now, and pretending this isn&#39;t a problem is a &quot;wall&quot; on yalls part, not mine.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Here is a list of all the ports that Comcast blocks for its users. This has nothing to do with freedom of speech and everything to do with the fact that Comcast&#39;s network will die if they don&#39;t do this. As a consequence I can&#39;t send outbound TCP/25 SMTP anymore:</span></div><div><span style="font-size:12.8px"><a href="https://www.xfinity.com/support/internet/list-of-blocked-ports/">https://www.xfinity.com/support/internet/list-of-blocked-ports/</a></span><br></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">And over-blocking is going to be a worse problem when granularity is taken away from network defenders. When Spamhaus decides an entire country&#39;s TLD has too much abuse, most network operators will agree, and legitimate sites (like that country&#39;s government, companies, and media outlets) are an acceptable loss. You&#39;re going to see more of this, and that country&#39;s government has little recourse aside from cleaning up their entire TLD so network operators can be convinced to remove the blocks. But since abuse-laden TLDs are usually that way due to lack of budget, it&#39;s more likely that the entire country will simply suffer harms instead.</span></div><div><br></div><div>I am really surprised at how little credence is being given to these problems.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 14, 2017 at 9:41 AM, theo geurts <span dir="ltr">&lt;<a href="mailto:gtheo@xs4all.nl" target="_blank">gtheo@xs4all.nl</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <p><br>
    </p>
    Hi John, <br>
    <br>
    I agree we do not want to create a centralized registration and
    surveillance scheme. <br>
    <br>
    Such a system would be subject to many regulations and fines from
    Data Regulators. If we do not execute privacy properly we are
    creating a system that will cost millions of dollars in fines alone.
    Tho that would actually answer the question are the costs of RDS
    viable. The answer would be no. <br>
    <br>
    Theo <br><div><div class="h5">
    <div class="m_-7998131626756526054moz-cite-prefix">On 14-2-2017 14:59, John Horton wrote:<br>
    </div>
    <blockquote type="cite">
      <div dir="ltr">
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">Nathalie
          and others,</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)"><br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">I
          wanted to take a moment and explain why I&#39;m strongly opposed
          to requiring email or other registration in order to view thin
          or thick details. For the reasons outlined below, I think it&#39;s
          antithetical to the open and decentralized nature of the
          internet, and constitutes a form of internet surveillance. </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)"><br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">First,
          putting aside repressive regimes, private networks and edge
          cases, one of the hallmark principles of the internet is that
          it&#39;s open; you don&#39;t have to register or justify your need to
          access information on the internet. And, it&#39;s decentralized.
          Historically, its open nature has included not only being able
          to see a website, but also the registration details for the
          website&#39;s domain name. And, whatever governments may do (which
          isn&#39;t the question here), there&#39;s no centralized internet
          surveillance or registration authority for internet users
          generally. </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)"><br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">If
          we impose a scheme where there is a central organization with
          the authority to a) require registration and b) centrally
          control access, and c) (as has been proposed) require the user
          to provide a reason for their access, that organization then
          also has the ability to d) make judgment calls about what
          reasons are valid and which are not and e) maintain data on
          who accessed what RDS data, for what reason, for how long and
          why. Note also that at least one version of the EWG report
          said that f) the organization would be empowered to levy
          punitive measures against internet users who accessed more
          data than the RDS deems appropriate.</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)"><br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">So:
          you have a system that surveils internet users who access some
          information and maintains data on their use of that data.
          Let&#39;s think about the following scenarios from the point of
          view of openness, decentralization and civil liberties.</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;color:rgb(68,68,68)">
          <div class="gmail_default" style="color:rgb(34,34,34);font-family:arial,sans-serif">
            <ul>
              <li>A journalist (or blogger) is writing an investigative
                article and wants to find out who is behind a domain
                name. If we require registration and disclosure of the
                reason, that in essence creates a situation where the
                RDS de facto is monitoring that journalist and
                determining if their basis for conducting the
                investigation is worthy. It also allows the RDS the
                ability to monitor the journalist&#39;s use of the domain
                name registration data. This potentially chills free
                speech. </li>
              <li>Consider a political activist who wishes to expose
                corruption by an elected politician and wants to access
                RDS information to show, for example, conflicts of
                interests in the politician&#39;s business operations. Once
                the political activist has to disclose who they are, let
                alone why they are accessing the information, that not
                only chills legitimate political activism but also
                potentially opens up a route for government abuse (e.g.,
                if a government agency were able to subpoena the list of
                who accessed RDS information for which domain names and
                why). </li>
              <li>Academic researchers periodically review Whois/RDS
                data; requiring them to register before reviewing data
                and disclose why they are doing the research potentially
                empowers the RDS to monitor academic research and
                determine its worthiness. </li>
              <li>Imagine that a cybercrime network is under
                investigation (as they are wont to be); requiring law
                enforcement to register -- particularly if there is a
                log of which domain names they reviewed RDS for -- can
                potentially compromise the investigation if that
                information is disclosed. Would registrants have the
                right to be informed every time that someone registered
                to review their RDS details? </li>
            </ul>
            <div>For one central entity to possess that much power over
              internet users is something that I think we should avoid,
              and it&#39;s antithetical to the principles of openness and
              decentralization. There are other well-known solutions to
              spam and inappropriate contacts; forcing all other
              legitimate activities to grind to a screeching halt --
              particular under the umbrella of a surveillance scheme --
              is a cure worse than the disease.  </div>
            <div><br>
            </div>
            <div>I recognize and agree that we should try to find
              constructive solutions to this that require some
              compromise, and I&#39;m grateful not only for the expertise
              that Stephanie and others have brought to this group, but
              also that Benny and others have pointed out some of the
              problems with Whois details being inappropriately used
              (e.g., for spam). However, I wanted to outline my strong
              concerns about creating a centralized registration and
              surveillance scheme over one subset of internet users as
              part of the solutions. </div>
            <div><br>
            </div>
          </div>
        </div>
        <div class="gmail_extra">
          <div>
            <div class="m_-7998131626756526054m_-9163358764285633796gmail_signature" data-smartmail="gmail_signature">
              <div dir="ltr">
                <div>
                  <div dir="ltr">
                    <div>
                      <div dir="ltr">
                        <div>
                          <div dir="ltr">
                            <div>
                              <div dir="ltr">
                                <div>
                                  <div dir="ltr">
                                    <div>
                                      <div dir="ltr">
                                        <div>
                                          <div dir="ltr">
                                            <div>
                                              <div dir="ltr">
                                                <div>
                                                  <div dir="ltr">
                                                    <div>
                                                      <div dir="ltr"><font face="arial,
                                                          helvetica,
                                                          sans-serif" color="#073763">John
                                                          Horton<br>
                                                          President and
                                                          CEO,
                                                          LegitScript</font>
                                                        <div><img height="36" width="96"><br>
                                                          <div>
                                                          <div>
                                                          <p style="margin:0.0px 0.0px 0.0px 0.0px;font:12.0px Helvetica"><br>
                                                          </p>
                                                          <p style="margin:0px;font-style:normal;font-variant:normal;font-size:12px;line-height:normal;font-family:Helvetica"><b><font color="#444444">Follow</font><font color="#0b5394"> </font><font color="#000000">Legit</font><font color="#0b5394">Script</font></b>: <a href="http://www.linkedin.com/company/legitscript-com" style="font-weight:normal" target="_blank"><font color="#cc0000">LinkedIn</font></a> 
                                                          |  <a href="https://www.facebook.com/LegitScript" style="font-weight:normal" target="_blank"><font color="#6aa84f">Facebook</font></a>  |  <a href="https://twitter.com/legitscript" style="font-weight:normal" target="_blank"><font color="#674ea7">Twitter</font></a> 
                                                          |  <font color="#ff9900"><u><a href="http://blog.legitscript.com" target="_blank">Blog</a></u></font>
                                                           |<font color="#ff9900">
                                                           <font style="font-weight:normal"><a href="https://plus.google.com/112436813474708014933/posts" target="_blank">Google+</a></font></font></p>
                                                          <p style="margin:0px;font-style:normal;font-variant:normal;font-size:12px;line-height:normal;font-family:Helvetica"><font color="#ff9900"><br>
                                                          </font></p>
                                                          <p style="text-align:left;margin:0px;font-style:normal;font-variant:normal;font-size:12px;line-height:normal;font-family:Helvetica"><font color="#ff9900"><img height="96" width="46"><img height="96" width="47"><br>
                                                          </font></p>
                                                          </div>
                                                          </div>
                                                        </div>
                                                      </div>
                                                    </div>
                                                  </div>
                                                </div>
                                              </div>
                                            </div>
                                          </div>
                                        </div>
                                      </div>
                                    </div>
                                  </div>
                                </div>
                              </div>
                            </div>
                          </div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
          <br>
          <div class="gmail_quote">On Tue, Feb 14, 2017 at 4:10 AM,
            nathalie coupet via gnso-rds-pdp-wg <span dir="ltr">&lt;<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div>
                <div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
                  <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184"><span>Hi
                      Allison,</span></div>
                  <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184"><span><br>
                    </span></div>
                  <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184" dir="ltr"><span id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39362">Would
                      you be able to carry out your investigations
                      normally if access to WHOIS thick were restricted
                      only by the need to enter an email? </span></div>
                  <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184" dir="ltr"><span><br>
                    </span></div>
                  <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184" dir="ltr">With regards to privacy by design, instead
                    of pushing for the implementation of this concept
                    inside the realm of WHOIS where it is foreign, since
                    it is an engineering concept, why not advocate for
                    its implementation at the design level of the
                    Internet, where it belongs? </div>
                  <span class="m_-7998131626756526054m_-9163358764285633796HOEnZb"><font color="#888888">
                      <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39184" dir="ltr"><br>
                      </div>
                      <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39185"> </div>
                      <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531signature" id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yui_3_16_0_ym19_1_1487072479779_39232">Nathalie </div>
                      <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531qtdSeparateBR"><br>
                        <br>
                      </div>
                    </font></span>
                  <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yahoo_quoted" style="display:block">
                    <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
                      <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px"><span>
                          <div dir="ltr"><font face="Arial" size="2"> On
                              Tuesday, February 14, 2017 12:38 AM,
                              allison nixon &lt;<a href="mailto:elsakoo@gmail.com" target="_blank">elsakoo@gmail.com</a>&gt;
                              wrote:<br>
                            </font></div>
                          <br>
                          <br>
                        </span>
                        <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531y_msg_container">
                          <div id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549">
                            <div><span>
                                <div dir="ltr">This car metaphor isn&#39;t
                                  complete without also stating that
                                  some car owners purchase them for the
                                  sole purpose of running over people! 
                                  <div>
                                    <div><br clear="none">
                                    </div>
                                    <div>Some car owners purchase fleets
                                      of cars to run over as many people
                                      as possible. Even though they
                                      re-use their name on every single
                                      vehicle registration, the subpeona
                                      takes so long that the city can no
                                      longer automatically block the
                                      cars as they enter, and need to
                                      wait for them to run over a few
                                      people before they can do anything
                                      about it.</div>
                                  </div>
                                  <div><br clear="none">
                                    This metaphor has obviously been
                                    tortured past the point of
                                    absurdity, I&#39;ll leave it alone now.</div>
                                  <div><br clear="none">
                                  </div>
                                  <div>I&#39;ve mostly been lurking for the
                                    whole duration of this group, and
                                    please forgive me if I&#39;m missing
                                    something massive here, but I get
                                    the impression that most people here
                                    don&#39;t spend a lot of time doing
                                    investigations. But this is my life.
                                    If I needed a subpeona for every
                                    single historical lookup, pivot, and
                                    reverse search, I would get zero
                                    done due to a lack of legal
                                    authority. Many if not most of the
                                    people doing the heavy lifting in
                                    anti-cybercrime efforts are private
                                    citizens with no government issued
                                    authority. It seems that the general
                                    expectation here is that limiting
                                    access to people with badges is OK,
                                    but I&#39;m telling you there is a
                                    severe lack of those skillsets and
                                    it will be years before we see
                                    widespread technical literacy among
                                    the police. Whatever system results,
                                    private citizens need a path for
                                    unrestricted and automated access.
                                    And if we want to talk protecting
                                    privacy, I think criminally
                                    motivated violations of privacy are
                                    far more likely to affect everyone&#39;s
                                    day to day life right now, and
                                    automated WHOIS lookups are used
                                    heavily especially in anti-phishing
                                    and anti-spam operations.</div>
                                  <div><br clear="none">
                                  </div>
                                  <div>With the status quo, I can go on
                                    fishing expeditions through the
                                    WHOIS data and turn up hundreds of
                                    domains used for the same type of
                                    malicious activity, and predict with
                                    a high accuracy which domains will
                                    be malicious before they are used
                                    for anything. It sometimes turns up
                                    domains owned by innocent people,
                                    and I doubt privacy minded people
                                    would like that, but the reality is
                                    I rarely ever encounter WHOIS data
                                    that is convincing PII. It&#39;s almost
                                    all fake. And if it&#39;s not fake, it&#39;s
                                    a company&#39;s public contact info, or
                                    it&#39;s a foolish person who turned
                                    down WHOIS privacy protection, and
                                    will change their WHOIS as soon as
                                    the spam starts flowing.</div>
                                  <div><br clear="none">
                                  </div>
                                  <div>Have there been any studies on
                                    what percentage of WHOIS data is
                                    real and correct? Can we ever expect
                                    to have meaningful data when
                                    registrars are allowed to take
                                    Bitcoins over Tor as payment? At
                                    what point does &quot;privacy&quot; become an
                                    empty argument when some of these
                                    Internet hosting/registrar companies
                                    clearly profit from facilitating
                                    abuse, and network defenders block
                                    entire TLDs due to the saturation of
                                    abuse?</div>
                                  <div><br clear="none">
                                  </div>
                                  <div>From my vantage point, I see
                                    great benefit from seeing patterns
                                    in the fake data submitted by
                                    fraudsters, and I see few harms from
                                    the privacy side of things, because
                                    people seem to generally realize
                                    that &quot;123 fake st&quot; is a perfectly
                                    acceptable WHOIS entry.</div>
                                  <div><br clear="none">
                                  </div>
                                  <div>I also recognize this situation
                                    is completely absurd. Every aspect
                                    of this is surely an abuse of the
                                    original system. But it seems like
                                    building a pyramid from the top
                                    down, restricting access to supposed
                                    &quot;PII&quot; that is unlikely to contain
                                    PII, to the detriment of legitimate
                                    efforts that also seek to enhance
                                    privacy by preventing criminal theft
                                    of private data like bank account
                                    numbers.</div>
                                  <div><br clear="none">
                                  </div>
                                </div>
                              </span>
                              <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549gmail_extra"><br clear="none">
                                <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549yqt3115795380" id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549yqtfd25452">
                                  <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549gmail_quote"><span>On
                                      Mon, Feb 13, 2017 at 9:14 PM, Sam
                                      Lanfranco <span dir="ltr">&lt;<a rel="nofollow" shape="rect" href="mailto:sam@lanfranco.net" target="_blank">sam@lanfranco.net</a>&gt;</span>
                                      wrote:<br clear="none">
                                    </span>
                                    <blockquote class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>I
                                        have to strongly agree with Alex
                                        that whatever the criteria are
                                        for thin data, they cannot
                                        include that thin data &quot;is
                                        transitive&quot; in some sort of
                                        bread crumb trail manner.<br clear="none">
                                        <br clear="none">
                                        Everything is potentially
                                        transitive in that sense. I
                                        observe a vehicle but all I get
                                        is make, model and license
                                        plate, and in most jurisdictions
                                        that is all I get. It is the
                                        vehicle owner&#39;s &quot;thin data&quot;. Of
                                        course I can hang around, see
                                        that the car has a baby seat,
                                        witness a woman or man putting a
                                        child in the car, assume that
                                        she/he has legitimate access to
                                        the car, follow the car and
                                        assemble more personal
                                        information (lives at; works at;
                                        shops at; visits;) The license
                                        plate didn&#39;t facilitate that
                                        crumb train discovery, but no
                                        license plate would hamper
                                        legitimate seeking of
                                        information about who owns the
                                        car (issuing a parking ticket,
                                        LEA investigation, etc.) .
                                        License plate is part of thin
                                        data with no gated access. Of
                                        course, this will change in the
                                        era of the digital vehicle.
                                        Depending on security, and
                                        authorization, one will be able
                                        to just ask the car, and ask
                                        about a lot of things...like
                                        whose cell phone was in the
                                        passenger&#39;s seat last night,
                                        when I was supposed to be alone
                                        )-:<br clear="none">
                                        <br clear="none">
                                        There needs to be a similar
                                        balance (license plate but no
                                        owner&#39;s name unless wanted, like
                                        Sam&#39;s Curry Pizza Barn logo,
                                        phone number and website URL
                                        painted on the side).<br clear="none">
                                        <br clear="none">
                                        More Important, have we made
                                        progress (convergence) on the
                                        working principles that should
                                        be brought to bear in building a
                                        thin data set. A lot of time has
                                        been spent looking at good case
                                        and bad case scenarios. What
                                        operational principles have been
                                        distilled from all these
                                        examples? What is the balance
                                        between thin data inclusion and
                                        exclusion, and design and
                                        technical solutions that can be
                                        used to prevent (for example)
                                        robotic harvesting? There is
                                        another frontier here, and that
                                        is what governments will do to
                                        restrain or enable certain uses
                                        of thin data? While ICANN needs
                                        to be aware of what is going on
                                        there, that part is beyond
                                        ICANN&#39;s remit, but those
                                        policies will help shape some of
                                        the context within which ICANN
                                        deals with the thin data task.<br clear="none">
                                        <br clear="none">
                                        Sam L</span>
                                      <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549HOEnZb">
                                        <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549h5"><span><br clear="none">
                                            <br clear="none">
                                            On 2017-02-14 1:23 AM,
                                            Deacon, Alex wrote:<br clear="none">
                                          </span>
                                          <blockquote class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>
                                              All,<br clear="none">
                                              <br clear="none">
                                              So it seems the debate has
                                              progressed from “thin
                                              data” to “thick data”
                                              (i.e. data that includes
                                              email).  I know we are all
                                              super excited to talk
                                              about “thick data” but I
                                              don’t think we are there
                                              yet (are we?  Hopefully I
                                              didn’t miss the party…)<br clear="none">
                                              <br clear="none">
                                              Focusing on thin data for
                                              the moment I struggle to
                                              understand how it is
                                              personal data.  I do not
                                              believe it is.    As for
                                              the odd logic proposed by
                                              some that the property of
                                              privacy is transitive
                                              (i.e. Because “thin data”
                                              can be used to
                                              link/point/discover other
                                              data then “thin data”
                                              equals “personal data”) I
                                              just don’t buy it.<br clear="none">
                                              <br clear="none">
                                              I don’t disagree with much
                                              of what was expressed in
                                              this thread, however we
                                              must keep in mind that
                                              balance and
                                              proportionality are
                                              important concepts in many
                                              (all?) data privacy laws. 
                                               Any arguments that imply
                                              that no such balance
                                              exists (or should exist)
                                              is obstructive IMO.<br clear="none">
                                              <br clear="none">
                                              Alex<br clear="none">
                                              <br clear="none">
                                              <br clear="none">
                                            </span>
                                            <div>
                                              <div class="m_-7998131626756526054m_-9163358764285633796h5">
                                                On 2/13/17, 5:42 AM, 
                                                &lt;<a rel="nofollow" shape="rect" href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank">gnso-rds-pdp-wg-bounces@icann
                                                  .org</a> on behalf of
                                                <a rel="nofollow" shape="rect" href="mailto:michele@blacknight.com" target="_blank">michele@blacknight.com</a>&gt;
                                                wrote:<br clear="none">
                                                <br clear="none">
                                                     I agree and I know
                                                from how I’ve used
                                                various email addresses
                                                that they are actively
                                                being harvested and
                                                spammed.<br clear="none">
                                                          Also it’s one
                                                of the biggest sources
                                                of complaints we get
                                                from our clients
                                                (registrants)<br clear="none">
                                                          It’s
                                                definitely not an “edge
                                                case”.<br clear="none">
                                                          Regards<br clear="none">
                                                          Michele<br clear="none">
                                                               --<br clear="none">
                                                     Mr Michele Neylon<br clear="none">
                                                     Blacknight
                                                Solutions<br clear="none">
                                                     Hosting, Colocation
                                                &amp; Domains<br clear="none">
                                                     <a rel="nofollow" shape="rect" href="https://www.blacknight.com/" target="_blank">https://www.blacknight.com/</a><br clear="none">
                                                     <a rel="nofollow" shape="rect" href="http://blacknight.blog/" target="_blank">http://blacknight.blog/</a><br clear="none">
                                                     Intl. <a rel="nofollow" shape="rect">+353 (0)
                                                  59 9183072</a><br clear="none">
                                                     Direct Dial: <a rel="nofollow" shape="rect">+353
                                                  (0)59 9183090</a><br clear="none">
                                                     Social: <a rel="nofollow" shape="rect" href="http://mneylon.social/" target="_blank">http://mneylon.social</a><br clear="none">
                                                     Some thoughts: <a rel="nofollow" shape="rect" href="http://ceo.hosting/" target="_blank">http://ceo.hosting/</a><br clear="none">
                                                   
                                                 -----------------------------
                                                --<br clear="none">
                                                     Blacknight Internet
                                                Solutions Ltd, Unit
                                                12A,Barrowside Business
                                                Park,Sleaty<br clear="none">
                                                   
                                                 Road,Graiguecullen,Carlow,R93
                                                X265,Ireland  Company
                                                No.: 370845<br clear="none">
                                                         
                                                ______________________________
                                                _________________<br clear="none">
                                                     gnso-rds-pdp-wg
                                                mailing list<br clear="none">
                                                     <a rel="nofollow" shape="rect" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a><br clear="none">
                                                     <a rel="nofollow" shape="rect" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank">https://mm.icann.org/mailman/
listinfo/gnso-rds-pdp-wg</a><br clear="none">
                                                <br clear="none">
______________________________ _________________<br clear="none">
                                                gnso-rds-pdp-wg mailing
                                                list<br clear="none">
                                                <a rel="nofollow" shape="rect" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a><br clear="none">
                                                <a rel="nofollow" shape="rect" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank">https://mm.icann.org/mailman/l
istinfo/gnso-rds-pdp-wg</a><br clear="none">
                                              </div>
                                            </div>
                                          </blockquote>
                                          <br clear="none">
                                        </div>
                                      </div>
                                      <span class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549HOEnZb"><font color="#888888">
                                          -- <br clear="none">
                                          *-----------------------------
                                          ---------------*<span><br clear="none">
                                            &quot;It is a disgrace to be rich
                                            and honoured<br clear="none">
                                            in an unjust state&quot;
                                            -Confucius<br clear="none">
------------------------------ ----------------<br clear="none">
                                            Dr Sam Lanfranco (Prof
                                            Emeritus &amp; Senior
                                            Scholar)<br clear="none">
                                            Econ, York U., Toronto,
                                            Ontario, CANADA - M3J 1P3<br clear="none">
                                            YorkU email:
                                            <a class="m_-7998131626756526054moz-txt-link-abbreviated" href="mailto:Lanfran@Yorku.ca" target="_blank">Lanfran@Yorku.ca</a>   Skype:
                                            slanfranco<br clear="none">
                                            blog:  <a rel="nofollow" shape="rect" href="http://samlanfranco.blogspot.com/" target="_blank">http://samlanfranco.blogspot.c
                                              om</a><br clear="none">
                                            Phone: <a rel="nofollow" shape="rect">613 476-0429</a>
                                            cell: <a rel="nofollow" shape="rect">416-816-2852</a></span></font></span>
                                      <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549HOEnZb">
                                        <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549h5"><br clear="none">
                                          <br clear="none">
                                          ______________________________
                                          _________________<span><br clear="none">
                                            gnso-rds-pdp-wg mailing list<br clear="none">
                                            <a rel="nofollow" shape="rect" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a><br clear="none">
                                            <a rel="nofollow" shape="rect" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank">https://mm.icann.org/mailman/l
                                              istinfo/gnso-rds-pdp-wg</a></span></div>
                                      </div>
                                    </blockquote>
                                  </div>
                                </div>
                                <br clear="none">
                                <br clear="all">
                                <span>
                                  <div><br clear="none">
                                  </div>
                                  -- <br clear="none">
                                  <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549gmail_signature">______________________________<wbr>___<br clear="none">
                                    Note to self: Pillage BEFORE
                                    burning.</div>
                                  <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549yqt3115795380" id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yiv9108844549yqtfd22628">
                                  </div>
                                </span></div>
                            </div>
                          </div>
                          <br>
                          <span>
                            <div class="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yqt3115795380" id="m_-7998131626756526054m_-9163358764285633796m_3299425158225197531yqtfd09601">______________________________<wbr>_________________<br clear="none">
                              gnso-rds-pdp-wg mailing list<br clear="none">
                              <a shape="rect" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a><br clear="none">
                              <a shape="rect" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank">https://mm.icann.org/mailman/l<wbr>istinfo/gnso-rds-pdp-wg</a></div>
                            <br>
                            <br>
                          </span></div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
              <br>
              ______________________________<wbr>_________________<br>
              gnso-rds-pdp-wg mailing list<br>
              <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a><br>
              <a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/l<wbr>istinfo/gnso-rds-pdp-wg</a><br>
            </blockquote>
          </div>
          <br>
        </div>
      </div>
      <br>
      <fieldset class="m_-7998131626756526054mimeAttachmentHeader"></fieldset>
      <br>
      <pre>______________________________<wbr>_________________
gnso-rds-pdp-wg mailing list
<a class="m_-7998131626756526054moz-txt-link-abbreviated" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">gnso-rds-pdp-wg@icann.org</a>
<a class="m_-7998131626756526054moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a></pre>
    </blockquote>
    <br>
  </div></div></div>

<br>______________________________<wbr>_________________<br>
gnso-rds-pdp-wg mailing list<br>
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">_________________________________<br>Note to self: Pillage BEFORE burning.</div>
</div>