[council] Motion re Study on WHOIS Misuse

Thu Jul 15 11:18:58 UTC 2010

Thanks Terry,

I agree WHOIS is an important issue, and that getting real data would be 
helpful in understanding it.  I don't believe that the proposed Misuse 
Study is well tailored to generating valid data (nor that this study 
would generate data helpful toward the questions ARIN is facing).

--Wendy

On 07/14/2010 06:10 PM, Terry L Davis, P.E. wrote:
> Wendy/All
>
> I also follow the ARIN PPML mailing list for my day job.  The clip below is
> from today's discussions and whois issues are the big topic of the day there
> also but in their case because of the impeding exhaustion of IPv4 address
> space and a desire to recover unused/lost v4 address space.
>
> However the example gives you an idea of how big the problem appears to be,
> and given the source running the POC checks, it would seem that we would
> have a very reliable statistic by fall from their efforts for one part of
> the study.  And there might be considerable synergy to be gained from our
> work running either in parallel or just behind them to harvest their results
> into our study.
>
> And there is an expected explosion of IP addressing with the full
> introduction of IPv6 so it could get a lot worse a lot faster.  A few of the
> big ISPs and hardware vendors are expecting IPv6 based infrastructure to
> consume more 10 times the addresses of a similar v4 infrastructure since you
> can do a lot of things with v6 and that you can't with v4.
>
> To me, it's a really big deal.
>
> Take care
> Terry
>
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> +++++++++++++++++++++++++++++++++++++
>
> -----Original Message-----
> From: arin-ppml-bounces at arin.net [mailto:arin-ppml-bounces at arin.net] On
> Behalf Of John Curran
> Sent: Monday, July 12, 2010 3:02 PM
> To: Ted Mittelstaedt
> Cc: arin-ppml at arin.net
> Subject: Re: [arin-ppml] How bad is it really?
>
> On Jul 12, 2010, at 2:38 PM, Ted Mittelstaedt wrote:
>
>> Keep in mind that Section 3.6.1 requires ARIN to publish a list of
>> invalid POCS, so we should have in a year or two a list of subnets
>> that are "ripe for mining" as they say.
>
> Ted is right on target here, and we're proceeding with POC validation at an
> aggressive rate.  (For more information, see
> <https://www.arin.net/resources/services/poc_validation.html>)
>
> We're presently sending out 7500 validation requests each week, and getting
> just over a 33% update rate on those requests. It's too early to draw
> conclusions, but there's obviously ample space which presently lacks a
> responsive contact.  We'll provide a more detailed update on POC validation
> during the October PPML meeting.
>
> /John
>
> John Curran
> President and CEO
> ARIN
>
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to the ARIN Public
> Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>
>
>
> -----Original Message-----
> From: owner-council at gnso.icann.org [mailto:owner-council at gnso.icann.org] On
> Behalf Of Wendy Seltzer
> Sent: Wednesday, July 14, 2010 9:15 AM
> To: icann at rodenbaugh.com
> Cc: 'GNSO Council'
> Subject: Re: [council] Motion re Study on WHOIS Misuse
>
>
> On 07/14/2010 11:15 AM, Mike Rodenbaugh wrote:
>>
>> Hi Wendy,
>>
>> If you have specific changes to the text in mind, then we can consider as
>> potential friendly amendments.
>
> Thanks, Mike.  Since I am against funding this study, I do not think my
> overall amendment would be friendly.  (I think it remains possible that
> other WHOIS studies could be better designed and should be prioritized
> in funding.)  I think the narrative history is interesting, but not
> something that requires a vote of the GNSO Council (and the necessary
> fact-checking that would precede such a vote). I'd move that to a
> separate information page.
>
>>
>> As for the additional discussion that Staff calls for, Staff could/should
>> have that discussion with the vendor as the contract is negotiated by
> Staff.
>
> I think that is too much delegation. Since the validity and utility of
> the study will depend on the outcome of that discussion, I think GNSO
> should not approve until after these important elements have been
> clarified.
>
> --Wendy
>
>>
>> Mike Rodenbaugh
>> RODENBAUGH LAW
>> tel/fax:  +1 (415) 738-8087
>> http://rodenbaugh.com
>>
>> -----Original Message-----
>> From: owner-council at gnso.icann.org [mailto:owner-council at gnso.icann.org]
> On
>> Behalf Of Wendy Seltzer
>> Sent: Wednesday, July 14, 2010 8:01 AM
>> To: Terry L Davis, P.E.
>> Cc: icann at rodenbaugh.com; 'GNSO Council'
>> Subject: Re: [council] Motion re Study on WHOIS Misuse
>>
>>
>> Two questions: Why do we need so much detail in the Whereas clauses?  I
>> don't believe that's necessary or helpful.
>>
>> Second, I do not believe that we have enough detail in the Resolved, or
>> the staff report to which it refers, to be confident that the Misuse
>> Study would be a statistically or scientifically valid study.
>>
>> Even the staff report still indicates  "However, even that [superior]
>> proposal did not address key challenges that could diminish the WHOIS
>> policy contributions afforded by this study - notably, determining the
>> "significance" of misuse and proving a causal relationship between
>> misuse reduction and WHOIS anti-harvesting measures. If ICANN and GNSO
>> elect to pursue this study, these concerns should be discussed with the
>> bidder before a contract is awarded."
>>
>> Who would be responsible for the "concerns should be discussed"?  I
>> think that question remains at the GNSO level.
>>
>>
>> I am therefore planning to vote against this resolution.
>>
>> Thanks,
>> --Wendy
>>
>>
>> On 07/13/2010 11:51 AM, Terry L Davis, P.E. wrote:
>>> Mike
>>>
>>>
>>>
>>> I didn't that anyone else seconded your motion.  If there is no second
>>> still, I second this motion.
>>>
>>>
>>>
>>> Take care
>>>
>>> Terry
>>>
>>>
>>>
>>> From: owner-council at gnso.icann.org [mailto:owner-council at gnso.icann.org]
>> On
>>> Behalf Of Mike Rodenbaugh
>>> Sent: Wednesday, July 07, 2010 6:52 PM
>>> To: 'GNSO Council'
>>> Subject: [council] Motion re Study on WHOIS Misuse
>>>
>>>
>>>
>>> I submit the attached motion (copied also below) for consideration by the
>>> Council at our meeting next week.
>>>
>>>
>>>
>>> Would appreciate a second, and am happy to answer any questions.
>>>
>>>
>>>
>>> Thanks,
>>>
>>> Mike
>>>
>>>
>>>
>>> Mike Rodenbaugh
>>>
>>> RODENBAUGH LAW
>>>
>>> tel/fax:  +1 (415) 738-8087
>>>
>>> http://rodenbaugh.com<http://rodenbaugh.com/>
>>>
>>>
>>>
>>>
>>>
>>> GNSO Council motion to pursue study of Whois Misuse.
>>>
>>> Whereas:
>>>
>>> In October 2007, the GNSO Council concluded that a comprehensive and
>>> objective understanding of key factual issues  regarding the gTLD Whois
>>> system would benefit future GNSO policy development efforts (
>>> <http://gnso.icann.org/resolutions/>
> http://gnso.icann.org/resolutions/).
>>>
>>> Before defining the details of these studies, the Council solicited
>>> suggestions from the community for specific topics of study on WHOIS.
>>> Suggestions were submitted (
>>> <http://forum.icann.org/lists/WHOIS-comments-2008/>
>>> http://forum.icann.org/lists/WHOIS-comments-2008/) and ICANN staff
>> prepared
>>> a  'Report on Public Suggestions on Further Studies of WHOIS', dated
>>> 25-Feb-2008 (
>>>
>>
> <http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25
>>> feb08.pdf>
>>>
>>
> http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25f
>>> eb08.pdf).
>>>
>>> On 28-Mar-2008 the GNSO Council resolved to form a WHOIS Study Working
>> Group
>>> to develop a proposed list, if any, of recommended studies for which
> ICANN
>>> staff would be asked to provide cost estimates to the Council (
>>> <http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml>
>>> http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml).
>>>
>>> The WHOIS Study WG did not reach consensus regarding further studies, and
>> on
>>> 25-Jun-2008 the GNSO Council resolved to form another group of volunteers
>>> (WHOIS Hypotheses WG) to review the 'Report on Public Suggestions on
>> Further
>>> Studies of WHOIS' and the GAC letter on WHOIS studies. (
>>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf).
>>>
>>> This WG was tasked to prepare a list of hypotheses to be tested, and
>>> reported to the Council on 26-Aug-2008.
>>>
>>
> (https://st.icann.org/Whois-hypoth-wg/index.cgi?whois_hypotheses_wg#Whois_st
>>> udy_hypotheses_wg_final_report ).
>>>
>>> On 5-Nov-2008, the Council convened a volunteer group of Councilors and
>>> interested constituency members to draft a resolution regarding studies,
>> if
>>> any, for which cost estimates should be obtained.  The Whois Study
>> Drafting
>>> Team further consolidated studies and data requested by the GAC (
>>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf ).
>>>
>>>
>>>
>>> For each of the consolidated studies, constituencies were invited to
>> assign
>>> priority rank and assess feasibility.  5 constituencies provided the
>>> requested rankings, while 2 constituencies (NCUC and Registrars)
> indicated
>>> that no further studies were justified.  The GAC was also invited to
>> assign
>>> priorities, but no reply was received.  The Drafting Team determined that
>>> the six studies with the highest average priority scores should be the
>>> subject of further research to determine feasibility and obtain cost
>>> estimates.
>>>
>>> On 04-Mar-2009, Council requested Staff to conduct research on
> feasibility
>>> and cost estimates for selected Whois studies and report its findings to
>>> Council.  (See Motion 3 at
>>> <https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions>
>>> https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions).
>>>
>>>
>>>
>>> On 23-Mar-2010, Staff presented its latest report on feasibility and cost
>>> estimates for Whois Studies. (
>>>
>>
> http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
>>> pdf) This report included a Staff Analysis and Recommendations for the
>> first
>>> study, regarding WHOIS Misuse.   The WHOIS Misuse study addressed 3
>>> originally requested studies (1, 14, and 21) and GAC data set 2.   The
>>> hypothesis of the WHOIS Misuse study is: "Public access to WHOIS data is
>>> responsible for a material number of cases of misuse that have caused
> harm
>>> to natural persons whose registrations do not have a commercial purpose."
>>>
>>>
>>> At ICANN's meeting in Brussels, representatives of the GAC reiterated
>> their
>>> interest in ICANN's response to the GAC letter of Apr-2008, which
> included
>>> these requests for further studies of WHOIS (
>>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf),
>> stating:
>>>
>>>
>>>
>>>
>>> First and foremost, the GAC believes that studies of WHOIS gTLD data
>> should
>>> be undertaken by neutral third parties and should create a factual record
>>> that documents the uses and abuses of WHOIS data recognized by the GAC
>> WHOIS
>>> Principles. The goal should be to initially compile data that provides a
>>> documented evidence base regarding:
>>>
>>>
>>>
>>> .  the amount and source of traffic accessing WHOIS servers and the types
>>> and numbers of different groups of users and what those users are using
>>> WHOIS data for; and
>>>
>>>
>>>
>>> .  the types and extent of misuses of WHOIS data and what harm is caused
>> by
>>> each type of misuse, including economic, use of WHOIS data in SPAM
>>> generation, abuse of personal data, loss of reputation or identity theft,
>>> security costs and loss of data."
>>>
>>>
>>>
>>> The Affirmation of Commitments requires that ICANN conduct reviews of
>> WHOIS
>>> policy and implementation "to assess the extent to which WHOIS policy is
>>> effective and its implementation meets the legitimate needs of law
>>> enforcement and promotes consumer trust."  The first such review must be
>>> organized by 30-Sep-2010.  (
>>>
>>
> <http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm
>>>>
>>>
>>
> http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm)
>>>
>>>
>>>
>>> The proposed budget for FY 2011 includes at least $450,000 for WHOIS
>>> studies.
>>>
>>>
>>>
>>> Resolved:
>>>
>>> Council requests ICANN staff to proceed with the WHOIS Misuse Study, as
>>> described in Staff's 23-Mar-2010 Report, using the vendor selection
>> process
>>> described in Annex of that same report. (
>>>
>>
> <http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en
>>> .pdf>
>>>
>>
> http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
>>> pdf).
>>>
>>>
>>>
>>>
>>
>>
>
>

-- 
Wendy Seltzer -- wendy at seltzer.org
phone: +1.914.374.0613
Fellow, Silicon Flatirons Center at University of Colorado Law School
Fellow, Berkman Center for Internet & Society at Harvard University
http://cyber.law.harvard.edu/seltzer.html
http://www.chillingeffects.org/
https://www.torproject.org/