With all the recent attention to WHOIS, it's time for a confession: I'm somewhat guilty for the infamous WHOIS Data Reminder Policy. With hindsight, it's a bad policy, and it needs to die.
The year was 2002. ICANN's DNSO (soon to be renamed as the GNSO) had a WHOIS Task Force, and was trying to extract policy choices from an ill-conceived and worse-executed survey of assorted self-selected stakeholders. As today, the topics at hand included privacy protections, compliance (and graduated sanctions for non-complying registrars), and accuracy of WHOIS records.
To get the discussion going, I threw a few of the proposals that had come up in the survey into a draft report as straw men; I probably made up a few more policy proposals out of whole cloth. Alas, there it was: The seemingly-innocuous concept that having an annual data reminder might be good customer service, and that it might somehow help to increase data accuracy. Next to graduated sanctions and other proposals on the table at the time, this idea had the attraction of saving face in the accuracy area, while not being an obviously bad idea by the standards of that particular task force. And so we inflicted it on the gTLD registrars and registrants of the world. And on ICANN's not-yet nascent compliance department.
The policy appears to be implemented by most registrars in the form of an e-mail notification to registrants (even though it doesn't have to be in email). By definition, these notifications include almost entirely public information. They're therefore a first-rate phishing vector: For example, send a notification with slightly (but embarrassingly) wrong WHOIS data, give a link to fix the data, and hope that people will click that link and hand over the credentials that they're using to manage their registration.
More generally, this policy exhibits a few flaws that are symptomatic for the broken policy process of the time: It micro-managed a particular piece of registrars' interactions with their customers. It didn't have a sunset date. It had no clear success metrics (e.g., number of corrections traceable to notices) that would have permitted ICANN to phase it out if unnecessary. It had no proper review for its security impact on registrants.
Even the WHOIS Review Team acknowledges that the policy is probably ineffective.
It's time for the GNSO to propose to the Board to repeal this policy. Should be a slam dunk of a task force.
Originally posted on my personal blog.
By Thomas Roessler, Mathematician. Visit the blog maintained by Thomas Roessler here.
Related topics: ICANN, Whois