Congress (Still) Looking at whois 66
bief writes: "A NY Times [free reg., blah, blah] story examines the whois database debate and provides a fair reading of the current situation about the list that which is being abused by 'marketers who regularly cull the Whois database for e-mail addresses and phone numbers to add to their spam lists.' Responses from registrars to the House Judiciary Subcommittee on Courts, the Internet and Intellectual Property were due on February 1st, but Chris J. Katopis, counsel to the subcommittee, said that as of last week many registrars had not replied. 'If they're not going to respond to a government inquiry,' he said, 'what are they going to do to respond to an aggrieved individual when something happens?'"
Coincidence? (Score:5, Interesting)
I visited WWW.GEEK-HOUSE.ORG, and noticed that you're not listed on some search engines! I think we can offer you a service which can help you increase traffic and the number of visitors to your website.
The address I got this E-mail on is NOT shown on the site and is ONLY listed on the whois, I've managed to keep this account spam free for over a year till now.
Consider using myprivacy.ca (Score:2, Informative)
Of course, this doesn't help if the registrar [netsol.com] decides to send you spam...
Yet another worthy resource down the drain (Score:3, Insightful)
Yet another good thing is destroyed by spammers. Folks, frankly, I wonder when will we start really doing something against these subhuman vermin ? The poison every well they touch, the steal other people's resources and they don't bother detroying whatever they use to advance their cause.
Put Spammers to jail !
Re:Coincidence? (Score:2)
Under ICANN rules all registrars are obliged to make their customer names available to SPAMers. This provision was insisted upon by the new registrars who wanted to be able to SPAM Network Solutions customers with offers to switch.
Off course once they had their own customer databases a lot of the registrars have decided to take their customer databases offline. As a result it is quite likely that the mandatory listing rule will get dropped.
Some of the slimier SPAMers make the start of their mail appear to be a Network Solutions renewal notice.
Meanwhile lots of privacy minded folk have registered their domain names under false names and addresses which is fine, until they wonder why they have difficulty renewing.
Full Text off NTY Post (Score:1, Offtopic)
Anyone who registers a Web address must provide the company that handles the registration with a name, mailing address, e-mail address and phone number -- certainly, not an unreasonable amount of information to exchange in a business relationship.
But everyone may not realize that this information is made available to the public in a searchable database called Whois, enabling Internet users to look up any Web address and find out -- in theory, at least -- who owns a particular address. The database is accessible through the Web sites of most registrars, or at some independent sites like betterwhois.com.
In practice, savvy holders of Web addresses know they can circumvent the system by entering fake information -- resulting in Web sites registered to John Q. Smith on 1234 Main Street or a site owner reachable only through a cryptic e-mail address.
In some instances the subterfuge is meant to hide online scams or other illegal activity. But in many cases the aim is simply to preserve the privacy of the site owner or to outwit marketers who regularly cull the Whois database for e-mail addresses and phone numbers to add to their spam lists.
The conflicting motives, and the competing agendas of those interested in finding this information, have lined up various interest groups on opposite sides of a continuing debate over the Whois database. Namely, how much information should be made available to the public about the individuals and businesses that have registered more than 35 million Web addresses (or domain names, as they are known in the trade)? What restrictions, if any, should be placed on who has access to this data?
On one side of the fence are law enforcement agencies, intellectual property owners and marketers. All of them favor a more accurate, widely accessible registry of domain-name holders, although for different reasons. Investigators and lawyers have been frustrated to find that suspected criminals and copyright infringers can hide behind fake data given to a registrar, which itself may not know the true identity of some customers who have registered domain names. (Some registrars do not even bother to verify credit card data, so a site registered with a stolen card could function for months before anyone bothered to cancel the address.)
Marketers have a different agenda, perceiving a gold mine of leads in databases they buy from registrars. Although marketers agree not to contact potential customers by e-mail or phone when they buy this data, some registrars privately acknowledge that this promise is routinely broken and that skilled entrepreneurs can capture the same data free -- whether by filtering from the Web's data stream, setting themselves up as registrars or using various other means.
On the opposite side of the fence are privacy advocates and many consumers and businesses that have registered Web addresses. They generally prefer some restrictions on who can have access to their contact information.
Registrars, for their part, are of two minds on the issue. They do not want customers angry about who may view their personal data; nor do they want to be responsible for verifying that registrants have submitted accurate information. But as revenue from domain registrations is sagging, some registrars see marketing their data as a source of income.
The Whois debate has been brewing for some time, but it could come to a boil soon, as Congress, the group overseeing the Internet's address system and privacy advocates all weigh in on how well the system is working. In December, the House Judiciary Subcommittee on Courts, the Internet and Intellectual Property sent letters to 50 United States registrars requesting information about whether and how the companies verify customer data and how they deal with complaints about fraudulent information.
Responses were due by Feb. 1, but Chris J. Katopis, counsel to the subcommittee, said that as of last week many registrars had not replied. "If they're not going to respond to a government inquiry," he said, "what are they going to do to respond to an aggrieved individual when something happens?"
Although Congress is focusing primarily on the validity of information in the Whois database, registrars are pessimistic about the prospect of verifying customer data.
"It's an unsolvable problem," said Larry Erlich, president of DomainRegistry.com, a small registrar based in Bensalem, Pa. Even if registrars tried to weed out obvious problems with a registration, he said, customers could easily change their contact information later.
Registrars say that with the small profit margins in the business, they cannot afford more extensive screening.
"To require verification by human beings, I would guess, is going to be cost-prohibitive for most of the industry," said Elana Broitman, director of policy for Register.com (news/quote), one of the largest registrars.
Register.com is still involved in a lawsuit it filed against Verio, a company that registers domain names and provides other Internet services. Verio is appealing a court ruling that prevented it from using Whois information to market its services to customers of Register.com.
That lawsuit, among other things, led the group that oversees the domain-name system, the Internet Corporation for Assigned Names and Numbers -- or Icann -- to appoint a task force to study some of the issues surrounding use of the Whois database. The committee is still compiling a report based on more than 3,000 responses to a survey last summer.
In the meantime, privacy advocates are concerned about the prospect of an even more comprehensive database of domain holders being developed by VeriSign (news/quote), the company that formerly had a government- granted monopoly in the domain registration business. Unlike the current Whois database, which does not include all of the new domain extensions or those assigned to specific countries, the universal Whois repository that VeriSign is developing would be able to search for any domain name.
Sarah Andrews, research director for the Electronic Privacy Information Center, a privacy rights advocacy group, said the organization was following the development of the universal Whois closely. "We think there are significant risks to privacy, anonymity and free speech," she said, adding that the center is particularly concerned about the right of individuals, especially in less open countries, to publish online anonymously.
"We think there could be a distinction drawn between individuals and commercial domain-name holders," she said, "and that individuals would not necessarily have to register their names and contact information."
Miriam Sapiro, director of international policy for VeriSign, said the company was moving forward with development of the universal Whois, according to the terms of its contract with Icann.
"A lot of people want a better system for accessing information -- what kind of information is yet to be decided -- about domain- name registrants, on a universal basis," Ms. Sapiro said. VeriSign's work is "a technical effort," she said, adding, "It's not intended to get into policy issues that are the proper purview of Icann."
New York Times articles (Score:2, Interesting)
Re:New York Times articles (Score:1)
WHOIS has too much information (Score:1)
Not all domains have a "web site" (Score:5, Insightful)
If you want to know something about the person who owns a domain, go to their site and find a way to contact them and ask.
Really? Try to contact me, the administrator for satch-test DOT com, modem-museum DOT org, or even jimgalloway DOT com without resorting to the WHOIS database. Or the Slashdot User Information for this ID. :)
Congratulations. Not every name has a "site" associated with it, contrary to your unwarranted assumption. I hold several domain names to which a web site (1) has not been created because I haven't had the time, (2) will never have a web site because it's used only for electronic mail and other, non-Web, Internet applications, (3) used to have a web site but now is gone, and (4) is intended for secure HTTP traffic with draconian access controls so even if you did figure out how to gain initial access you wuould have to be a cracker to get past the authenticaion that protects the content from the eyes of just anyone.
The information in the contact information portion of the WHOIS record for those domain names is real, and the spam traffic level is low...for now.
Please remember there is more to the Internet than just the World Wide Web and P2P file sharing.
Re:WHOIS has too much information (Score:2)
And by association, most people mistakenly believe the only reason to have a domain name is to have a web site. This has never been true. By extention, as you have proposed, most of these mistaken individuals expect to find detailed, accurate ownership and contact information at said web sites. I have enough trouble finding contact information for actual companies and you expect to be able to find contact data on any random individual's web site?
WHOIS has just enough information (Score:2)
As Bungie of olde would've said: (Score:1, Insightful)
A very important but missing group in the article. (Score:4, Insightful)
On the opposite side of the fence are privacy advocates and many consumers and businesses that have registered Web addresses.
And on which site are the network administrators, which use this information trying to keep their network free of unwanted junk (spam, scans, attacks etc) and to alert other people with broken systems?
Re:A very important but missing group in the artic (Score:2)
The biggest problem would be actualy getting the law written that does this, only this, and wouldn't be twisted to pieces by the lawyers.
Sure maybe your Aunt Sally might get a little freaked by the notice, but hey she'd be pretty low on the radar compared the asian's who can send 100k SPAM's a hour.
a little off topic but i got SPAMMED by Microsoft the other day, after all the hype about security and privacy and evil-hackers, the send a Email pimping Visual Studio
Re:A very important but missing group in the artic (Score:2)
It's like the DMCA -- breaking copyright is illegal but no one is stopping it, so we pass a law to make it illegal to break the law.
Good initiative (Score:4, Informative)
Re:Good initiative (Score:3, Informative)
Lookup my .co.uk domain [samspade.org]
In the UK, we have a law called the "Data Protection Act" that protects all "personally identifiable information". This covers my name, e-mail and postal addresses, telephone number, etc - in fact basically anything that's held in a computer and can be retrieved by searching on my name. Companies are not allowed to gather, hold, disclose or use this information without my consent, and if they don't have a good reason to keep it (e.g. if they're just using it for advertising) then I can ask them to delete it.
This law also stops spammers operating from the UK - they can't legally make a list of e-mail addresses without getting consent from the people involved.
It's a pity the US doesn't have similar laws.
Re:Good initiative (Score:1)
Re:Good initiative (Score:1)
The Act isn't explicit about email addresses as far as I know, but it certainly is implicit: data is "personal" if it can be used to identify a living person. I think most courts would not accept a defense if you tried to claim that an email address like john.doe@hotmail.com was NOT personal data. They probably would also take the same view about 122492,29910@compuserve.com as well.
Re:Good initiative (Score:2)
- It's a pity the US doesn't have similar laws
Dude, the US has hundreds of thousands of laws. We enforce maybe less than 1% of them. And even if we did have such a law, people would end up spending years in courts holding people to it.See, in the US, the courts don't have much to do with right and wrong, morality, ethics, common sense, or even the actual law. The courts are merely the fist(s) welded be bullies. Whomever has the most money to hire the most lawyers and argue the longest almost always wins. It's the threat of the suit that does the work -- everyone may know the case is baseless, but it'll cost thousands of dollars and years to prove it. (And if it ever does approach an actual court room, the case is magicly "settled" or dropped.)
Tag your data (Score:1, Interesting)
The "organization" names have never existed in any other form. I've been getting mail with them in the address for years now. It's obvious who's scraping the whois registries.
These days, I've added another line to my address information listing the registrar and approximate age of the update. Nobody's mailed one of them yet, but it's only been a couple of months.
NSI and friends need to salt the databases with spam traps and LART anyone who mails them. Give unique salts to each query and see what happens.
Re:Tag your data (Score:2)
When use your real identity, and when not. (Score:1)
Never gave a real telephone number, though.
Whois Spam.. (Score:2)
Seems that spam is kind of making good info go to shit.. since people do NOT want to get spammed so htey put fake info.. kind of a shame since if they did not use it for spam, it'd be a nice viable database to use for contact info..
Down with the spammers! why the hell cant we sue 'em? they're shoving it down our throats, lets go shove it back down THEIRS!
Register.com (Score:1)
-Rick
..."Wow... that last lightning was really clo%$#&%^ NO CARRIER"
Two WHOIS databases (Score:2, Insightful)
Entries for IP addresses have few privacy problems. Usually, not the end user is listed in the WHOIS database, but the ISP. It would be disastrous if misled privacy advocates and policymakers abolished this database.
Re: IP WHOIS databases (Score:1)
I work in the database group at the RIPE NCC, and there are actually more privacy problems with the IP database than I'm comfortable with. We do our best to protect user information, but of course we also have an obligation to make the information available to those who genuinely need it. It's a tough balance to maintain, since we are a public resource, and do not require registration of any kind to access the database.
The Regional Internet Registry (RIR) community has guidelines defining the largest network that can be listed without providing end-user contact information. Currently, any network bigger than a
One of the great things about the RIPE NCC and the other RIR's is that if you don't like the policy, you can change it.
SPAM (Score:1)
Using a different adress for various activities
on the net will at least identify the source of of the spammers info!
Publishing private details (Score:1)
What should happen it that this information be held in a repository somewhere that must be asked for by the relevant authoritive bodies such as the Government (concensus, stats, etc) and the Court of Law. Personally I see this no different to publishing my credit card number - becuase on the internet I demand some sort of anonyomity, and I don't wish my address, email and daytime telephone number to be broadcast to any CowboyNeal whose trying to sell his porn banners.
whois house.gov (Score:1, Informative)
U.S. House of Representatives (HOUSE-DOM)
Ford House Office Building
Washington, DC 20515
Domain Name: HOUSE.GOV
Status: Active
Administrative Contact:
Adams, Joseph L. (JLA1)
(202) 692-1337
JOE.ADAMS@MAIL.HOUSE.GOV
Domain servers in listed order:
MERCURY.HOUSE.GOV 143.231.1.67
CADMIUM.HOUSE.GOV 143.231.249.195
Record last updated on 16-Jan-02.
Information Systems, U.S. House of Representatives (NET-HOUSE2)
2nd and D Street, S. W.
Washington, D.C. 20515
US
Netname: HOUSE2
Netblock: 143.231.0.0 - 143.231.255.255
Coordinator:
Adams, Joseph (JA1117-ARIN) joe.adams@MAIL.HOUSE.GOV
(202) 226-6194 (FAX) (202) 226-0123
Domain System inverse mapping provided by:
MERCURY.HOUSE.GOV 143.231.1.67
NS3.CW.NET 204.70.25.234
CADMIUM.HOUSE.GOV 143.231.249.195
Record last updated on 27-Jan-1998.
Database last updated on 1-Mar-2002 19:57:27 EDT.
Whois also a useful anti-spam tool (Score:2, Interesting)
Without the ability to lookup the owners of domains and individual IP addresses, it would be much harder to register complaints to ISPs about the torrent of spam that's coming into my mailbox. Traceroute's a useful tool for finding out who a spam host's upstream provider is, but it's not as reliable as whois for getting contact information. If there's no reverse lookup for an address and ICMP packets are screened out several hops out from the offending host then there's no other tool to locate the owner or their provider.
What's really needed are tougher data privacy laws. The US falls far behind the EU in this respect - it seems that once someone has your address it's impossible to prevent it being sold on to third parties in the States. Though legislation isn't the solution to every problem, banning unsolicited commercial bulk eMail would be a good place to start.
A strategy? (Score:1)
If someone wants to REALLY contact the site holder, let them find a second site that lists them. It would be too much of a bother for anyone who does this on a regular basis.
Besides, phone lookup would list anyone any(w)hoo
There may be a time when servers only allow from a contact list, cull the rest. I can imagine it would kill terabytes of pink mailstuff...
Easy solution... (Score:1)
Now... snail mail.. that's a different story. I get (no exageration) two bulk mail cards every single day a telling me that I, too, can accept credit cards today!
Speaking of free registrations (Score:1)
Not a real Problem (Score:2, Interesting)
I have three domains in my name with my real e-mail address, and post to slashdot and USENET with my real email address.
I have never, in 2 years, recieved a piece of spam. The only reason I can see for spam, is people having their addresses sold by their ISP. WHOIS hasn't hurt me, and in two years, I should've been hurt if there was anything wrong.
Re:Not a real Problem (Score:1)
So the ISP does not have to sell your email address for you to get spam
--Jeff
Re:Not a real Problem (Score:1)
Or do they not want to piss of the administrator who can block their IP?
You will (Score:1)
I run my own e-mail server...
Are you sure it's working?
I've had tagged domain addresses since '94 and get spam both postal and email to addresses on whois records that were deleted up to 5 years ago. IME the mean time between registering a domain and getting spam to that address is in days, not months. I'm pretty sure I'm not selling addresses from my mailserver too.
It really isn't tough to generate lists of email addresses to newly registered domains.
Re:Not a real Problem (Score:1)
BTW, your e-mail is hidden in your Spamcop posts; although, I don't think Spamcop posts are much of an issue, because it's not a very crawlable web site.
Congress has no constitutional authority... (Score:5, Informative)
If you dislike the whois database containing your information, let's e-mail, call, and write letters to the organizations telling them we want more privacy. Eventually, we must find a way to find a provider who will offer us the privacy we want.
Or, use the free market solution -- create an e-mail address you don't use, and check it once in a while for important e-mails. Filter out anything but what comes from your ISP or registrar.
Re:Congress has no constitutional authority... (Score:1)
The Supreme Court examined the CDA and COPA without ever once even hinting that Congress cannot regulate these areas. The only question they asked was how much Congress can regulate speech on the Internet. Also, courts (but not the Supreme Court, to my knowledge) have routinely enforced anti-cybersquatting laws.
Either Congress can regulate in this area or the Supreme Court is misinterpreting the Constitution (a proposition of questionable possibility). On my reading, of the constitution, it is the former.
Re:Congress has no constitutional authority... (Score:2)
Actually, I would have guessed that the Internet is about the ultimate in "Interstate Commerce", which Congress is not only allowed to regulate according to the Consitution, but is actually expected to regulate (because who else can, the states?)
Re:Congress has no constitutional authority... (Score:1)
The US government [whitehouse.gov] has had nothing to do with computing?
What was that project called again? Arpanet [webopedia.com]?
I would also assume that various colleges/universities such as MIT and Berkeley had some degree of government funding, and projects such as Unix [webopedia.com] and X [x.org] wouldn't quite be the same without them.
Let's face it, various problems have been allowed to continue due to a lack of government intervention. Think about how much spam is sent (regardless of whether you filter it -- it's still sent halfway around the world). Think about everybody (even non-companies) getting a
On the other hand, recent moves by the current conservative government to place backdoors in cryptographic software, and the existence of the 3ch3l0n spy system could well be used to show negative government influence.
You can say what you like about government intervention (and no doubt the libertarians here will), but you can't deny that the US government has had a profound influence on the computing industry.
Re: (Score:2)
Re:Congress has no constitutional authority... (Score:2)
The US government may sometimes behave in ways you don't like, but that doesn't make them illegitimate or their actions unconstitutional. We live in a democracy, and that's what you have to deal with in a democracy. It's not great, but it sure beats any of the alternatives anybody has been able to come up with. Or, to put it differently, imagine how much worse off we would be if idiots like Bush actually were kings.
A whois solution (Score:2, Insightful)
A better change would be to return email back to it's pre-attachment days (which would make using it for spam more unattractive - as well as shrink the size of the documents and make the net more secure in general).
Leave whois alone... or make it such that it won't allow datamineing. But don't remove our ability to locate and communicate with owners of domain names!
Shooting themselves? (Score:2, Insightful)
Seems to me that culling addresses from a whois database for the purposes of spamming would be somewhat self defeating. Maybe I am offbase here, but I would expect that email addresses in whois records would have a far lower than average percentage of people who would fall for spams, and a far higher percentage of people who will complain. And sometimes those complaints actually get spammers nuked (yea I know, rarely).
Still, I would think that if a spammer actually thought it through, they would use the whois database to do list washing, to minimize complaints.
I got a telelmarketing call from Microsoft (Score:1)
Of course, after being treated like a mere woman by this flunkie, the tune changed when I calmly informed the maladjusted toadstool that I was the owner of the business. They tried very hard to do the high pressure sell on me when they found out that I made the purchasing decisions--all talking in simple, bandwagon language(because I'm female). Mind you, I don't own any MS software, don't want to, and find being gotten out of bed at 8am by their contract telemarketing flunkies who are treating me like a girl and trying to tell me that using Microsoft B-Central and IIS will bring me untold riches to be about as annoying as it gets before raising my voice.
I did tell them to put me on their 'do not call' list, which means we'll get one more call from some sales rep who wants to push their B-Central abortion.
Another great reason to hate Microsoft and wish a rain of firey boulders on Redmond.
And IBM and Apple and Bell Canada and HP... (Score:1)
As for the issue of privacy vs. the need to contact domain owners... if anybody has a workable solution (sounds like the
At the end of the day perhaps what's needed is anti-spam policies and or legislation with teeth; and that whois mining is not the real issue.