[Gnso-ppsai-pdp-wg] For review - updated templates Cat B, questions 1 and 2

Fri Feb 28 18:52:20 UTC 2014

Well, because absent an accurate Whois record, it can be difficult to know
who to hold accountable.

Stephanie, to clarify: I was saying that 95% of Whois data in a certain
sub-category of criminal or miscreant behavior (spam, malware, phishing) is
*inaccurate* (not "accurate").

John Horton
President, LegitScript

*Follow LegitScript*:
LinkedIn<http://www.linkedin.com/company/legitscript-com>
|  Facebook <https://www.facebook.com/LegitScript>  |
Twitter<https://twitter.com/legitscript>
|  YouTube <https://www.youtube.com/user/LegitScript>  |  *Blog
<http://blog.legitscript.com>*  |
Google+<https://plus.google.com/112436813474708014933/posts>

On Fri, Feb 28, 2014 at 9:44 AM, Stephanie Perrin <
stephanie.perrin at mail.utoronto.ca> wrote:

> I agree, it is all about risk...but what risk are we really talking about?
>   I dont understand why a P/P provider should be forced to take on more
> risk than other registrars.  Further,why should the registrar be
> accountable for verified data, once the original data verification is done.
>  If John is correct and in 95% of cases the data from the P/P service
> provider was proven accurate, then how does any amount of data verification
> solve the problem?  The accountability for miscreant behaviour of all kinds
> rests with the domain name user.  IF the data is inaccurate, ramp up the
> penalties if it can be shown that the data was rendered inaccurate for the
> purposes of fraudulent activity.
> At the risk of sounding overly philosophical, It seems to me that the
> Internet ecosystem is somehow being held to account for the actions of
> individuals.  It is the individuals that should be held to account.  Not
> the domain name, or the company that issued it. Particularly, I think that
> if products sold are tainted, then there is plenty of other consumer
> protection law that applies...why are we trying to solve that problem?
> Cheers Stephanie perrin
>
> On 2014-02-28, at 12:29 PM, Carlton Samuels wrote:
>
> ..which seems to me all about risk management on part of the provider.
>  Its the results that matter.
>
> So, for all the possible permutations, in line with those enumerated by
> Volker, might it not be more useful to refer 'verified credentials' as a
> requirement on the provider, allow them to accept the business risk and
> leave it to them to decide how to do it.......and, inherently, the risks
> acceptable to them for provisioning the service?
>
> -Carlton
>
>
> ==============================
> Carlton A Samuels
> Mobile: 876-818-1799
> *Strategy, Planning, Governance, Assessment & Turnaround*
> =============================
>
>
> On Fri, Feb 28, 2014 at 6:29 AM, Volker Greimann <
> vgreimann at key-systems.net> wrote:
>
>>  Hi John,
>>
>> I am having a bit of a hard time understanding your point here.
>>
>> You are describing three different cases here, two of which will not
>> benefit from verification in the least bit and one might, but only in some
>> cases:
>>
>> a) The data is accurate, but stolen: Here verification would not uncover
>> any issues with the data as it is essentially correct and will most likely
>> be identified as accurate.
>> b) The data is false: Here, depending on the methods used, the inaccuracy
>> may be uncovered and would lead to an automated request to provide updated
>> data or deactivation after a set time. Remember, in order to keep providing
>> services in a sensible manner, this needs to be automated in some form,
>> i.e. no individual record would likely see any manual review.
>> c) The data is already accurate: If the data is already correct, what
>> purpose does verification fulfill?  The data cannot become more accurate.
>> Verification in this case seems like an exercise in self-gratification.
>>
>> That said, even if there is a benefit to be derived from verification,
>> such benefits are achieved once verification concludes. Re-verification of
>> already verified data fulfills no purpose whatsoever. So if a set of data
>> has already been verified by the registrar, there is no need for the p/p
>> provider to again verify the same data. Only if no verification is or can
>> be performed on the registrar level does verification by providers come
>> into play.
>>
>> Volker
>>
>> Am 28.02.2014 00:32, schrieb John Horton:
>>
>>  Thanks, Marika. I also wanted to provide a comment pertaining to
>> Question 2 in the attachments (relating to periodic checks).
>>
>>  In a few of the recent discussions, there's been some reference to
>> criminals always or nearly always being untruthful in their Whois records
>> (even if privacy-protected), leading to the conclusion that there is little
>> purpose in having a registrar or any third party have to verify or
>> re-verify the information (especially if it is difficult to prove that the
>> data is falsified). I wanted to share our experience and observations on
>> that point, in the hope that it's relevant to future discussion regarding
>> Question 2.
>>
>>  Our consistent observation has been that when it comes to a particular
>> sub-category of criminal activity, spam, phishing, malware, and so forth,
>> it's probably safe to say that that statement is true -- the registrant's
>> Whois information is nearly always inaccurate. Even in cases, such as some
>> where we've worked with law enforcement, when the Whois record for a domain
>> name involved in spam, phishing or malware is privacy-protected and is
>> subsequently unmasked, the Whois record is still not accurate behind the
>> privacy curtain. There are probably exceptions, but that's what we've seen
>> well over 95% of the time. On occasion, it's a real address and phone
>> number, just not one genuinely connected to the registrant.
>>
>>  But there are other types of criminal activity where the Whois record
>> is not so regularly obfuscated. For example, we investigate a lot of
>> websites selling tainted dietary supplements that end up containing some
>> toxin or adulterant that harms people. In those cases, we've overwhelmingly
>> seen that even if the Whois record is privacy-protected, the trend is that
>> the underlying Whois record is accurate. The same has been true for illegal
>> or counterfeit medical device websites that we've researched. On illegal
>> Internet pharmacies not engaged in spam, it's probably 50-50. (It might be
>> a shell corporation, but that's still valuable information.)
>>
>>  One important point to consider is that the Whois registration can be
>> relevant information from a banking perspective for commercial entities.
>> That is, some banks are going to look at an online merchant's domain name
>> registration record and if it's either inaccurate or protected, they may
>> require disclosure, or ask about any discrepancy, which can be an incentive
>> for criminals selling products online who nevertheless want to get paid via
>> credit card to have an accurate Whois. Hackers, malware providers and
>> spammers will find a way around that, but they don't necessarily constitute
>> "most" criminal activity.
>>
>>  The point here is, I think verification can still be a useful and
>> necessary tool in either scenario, even if it doesn't uncover useful
>> information a portion of the time. I realize that only pertains to a
>> portion of the issues related to Question 2, but I hope that our
>> observations on that are relevant.
>>
>>  Thanks,
>>
>>  John Horton
>> President, LegitScript
>>
>>
>> *Follow LegitScript*: LinkedIn<http://www.linkedin.com/company/legitscript-com>
>> |  Facebook <https://www.facebook.com/LegitScript>  |  Twitter<https://twitter.com/legitscript>
>> |  YouTube <https://www.youtube.com/user/LegitScript>  |  *Blog
>> <http://blog.legitscript.com/>*  |  Google+<https://plus.google.com/112436813474708014933/posts>
>>
>>
>> On Wed, Feb 26, 2014 at 2:39 AM, Marika Konings <marika.konings at icann.org
>> > wrote:
>>
>>>  Dear All,
>>>
>>>  Following our call yesterday, please find attached the updated
>>> templates for Category B - questions 1 & 2. Please review these templates
>>> to make sure the WG discussions have been accurately reflected and feel
>>> free to share any comments / edits you may have with the mailing list.
>>> We've created a page on the wiki where we'll post the templates that have
>>> been finalised for now (noting that for some of these the WG will need to
>>> come back to the template at a later date), see
>>> https://community.icann.org/x/ihLRAg.
>>>
>>>  The WG will continue its deliberations on Category B - Question 2 next
>>> week. Some of the questions that came up during the conversation yesterday
>>> and which you are encouraged to share your views on (and/or add additional
>>> questions that need to be considered in this context) are:
>>>
>>>    - What would be the arguments for not using the same standards /
>>>    requirements for validation and verification as per the 2013 RAA?
>>>    - Should there be a requirement for re-verification, and if so, what
>>>    instances would trigger such re-verification?
>>>    - In case of affliction between the P/P service and the registrar,
>>>    if the registration information has already been verified by the registrar,
>>>    should this exempt the P/P provider from doing so?
>>>    - Should the same requirements apply to privacy and proxy services
>>>    or is there a reason to distinguish between the two?
>>>
>>> Best regards,
>>>
>>>  Marika
>>>
>>> _______________________________________________
>>> Gnso-ppsai-pdp-wg mailing list
>>> Gnso-ppsai-pdp-wg at icann.org
>>> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>>>
>>
>>
>>
>> _______________________________________________
>> Gnso-ppsai-pdp-wg mailing listGnso-ppsai-pdp-wg at icann.orghttps://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>>
>>
>> --
>> Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
>>
>> Mit freundlichen Grüßen,
>>
>> Volker A. Greimann
>> - Rechtsabteilung -
>>
>> Key-Systems GmbH
>> Im Oberen Werk 1
>> 66386 St. Ingbert
>> Tel.: +49 (0) 6894 - 9396 901
>> Fax.: +49 (0) 6894 - 9396 851
>> Email: vgreimann at key-systems.net
>>
>> Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
>>
>> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:www.facebook.com/KeySystemswww.twitter.com/key_systems
>>
>> Geschäftsführer: Alexander Siffrin
>> Handelsregister Nr.: HR B 18835 - Saarbruecken
>> Umsatzsteuer ID.: DE211006534
>>
>> Member of the KEYDRIVE GROUPwww.keydrive.lu
>>
>> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
>>
>> --------------------------------------------
>>
>> Should you have any further questions, please do not hesitate to contact us.
>>
>> Best regards,
>>
>> Volker A. Greimann
>> - legal department -
>>
>> Key-Systems GmbH
>> Im Oberen Werk 1
>> 66386 St. Ingbert
>> Tel.: +49 (0) 6894 - 9396 901
>> Fax.: +49 (0) 6894 - 9396 851
>> Email: vgreimann at key-systems.net
>>
>> Web: www.key-systems.net / www.RRPproxy.netwww.domaindiscount24.com / www.BrandShelter.com
>>
>> Follow us on Twitter or join our fan community on Facebook and stay updated:www.facebook.com/KeySystemswww.twitter.com/key_systems
>>
>> CEO: Alexander Siffrin
>> Registration No.: HR B 18835 - Saarbruecken
>> V.A.T. ID.: DE211006534
>>
>> Member of the KEYDRIVE GROUPwww.keydrive.lu
>>
>> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
>>
>>
>>
>>
>>
>> _______________________________________________
>> Gnso-ppsai-pdp-wg mailing list
>> Gnso-ppsai-pdp-wg at icann.org
>> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>>
>
> _______________________________________________
> Gnso-ppsai-pdp-wg mailing list
> Gnso-ppsai-pdp-wg at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>
>
>
> _______________________________________________
> Gnso-ppsai-pdp-wg mailing list
> Gnso-ppsai-pdp-wg at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-ppsai-pdp-wg/attachments/20140228/46871c0a/attachment-0001.html>