ICANN Responds to FDA’s Concerns Regarding Whois Data Accessibility
The Internet Corporation for Assigned Names and Numbers (ICANN), the organization responsible for coordinating the global internet’s systems of unique identifiers, has formally addressed concerns raised by a representative of the U.S. Food and Drug Administration (FDA) regarding the accessibility and accuracy of Whois data. This response comes in the form of a detailed letter from ICANN CEO Göran Marby to the FDA, disputing claims made in a recent presentation by FDA officials.
The core of the disagreement lies in the FDA’s perception of the difficulties in obtaining accurate and timely information about domain name registrants through the Whois system. The FDA argues that these difficulties hinder their efforts to combat online pharmacies selling counterfeit or unapproved drugs, and other illegal activities facilitated by domain names.
The initial concerns were articulated by Dan Burke, Chief of the Investigative Services Division at the U.S. FDA, during a webinar hosted by The Coalition for a Secure and Transparent Internet (CSTI). CSTI, an organization founded by DomainTools, LegitScript, and Spamhaus, advocates for greater transparency in Whois records, particularly in the wake of the European Union’s General Data Protection Regulation (GDPR), which has led to the masking of much of the personal information previously available in Whois databases. These organizations rely heavily on Whois data for investigative purposes, making the GDPR-induced obfuscation a significant challenge.
ICANN, however, contends that the FDA’s portrayal of the situation is inaccurate and that viable mechanisms exist for legitimate entities like the FDA to access necessary registration data. ICANN’s letter directly addresses specific points raised by Burke during his presentation.
Key Points of Contention Between ICANN and the FDA
ICANN’s response focuses on three primary areas where it believes the FDA’s presentation misrepresented the reality of Whois data access and ICANN’s role in facilitating that access:
1. The Subpoena Requirement for Accessing Non-Public Registration Data
One of the main points of contention is the assertion that a subpoena is the only way to obtain non-public registration data. Burke stated that gaining access to Whois information necessitates a subpoena. ICANN strongly refutes this, clarifying that registrars and registry operators are obligated to provide reasonable access to registrant data when legitimate interests are demonstrated. The precise interpretation of “legitimate interests” remains a subject of ongoing discussion and interpretation. However, ICANN insists that a subpoena is not the sole avenue for accessing this data.
Burke’s presentation cited an example of adderallstore(.)com, a domain registered with Crazy Domains (part of Newfold Digital), where the FDA’s request to take down the domain was allegedly met with a referral to the domain’s host. ICANN emphasizes that this was a take-down request, not a request for Whois data. While some registrars are more cooperative than others in such matters, ICANN maintains that established protocols exist for legitimate requests.
Furthermore, the FDA has engaged in a pilot program with Verisign and Public Interest Registry (PIR) to address the issue of online opioid sales, which highlights the potential for collaboration between government agencies and domain registries to combat illicit activities.
2. ICANN’s Financial Incentives and Domain Sales
Another claim made during the FDA presentation was that ICANN’s salaries, as well as those of individuals at registrars and registries, are directly tied to the number of domains sold. The implication is that ICANN might be incentivized to overlook problematic domains in order to boost registration numbers and, consequently, its revenue.
ICANN vehemently denies this assertion. Considering the current registration figures and ICANN’s overall budget, it is highly unlikely that malicious domain registrations significantly contribute to executive salaries. While this argument might hold more weight for certain registrars and registries that actively profit from malicious registrations, it is not a fair characterization of ICANN’s financial structure.
3. ICANN’s Responsiveness to Government Agency Complaints
The third point of contention revolves around the perception that ICANN disregards complaints from government agencies. ICANN has outlined its role within the internet ecosystem and the various channels through which government agencies can participate in its processes. Burke, however, stated that the FDA lacks the resources to effectively engage with ICANN.
ICANN emphasizes that it has established mechanisms for addressing concerns raised by government agencies and encourages their active participation in shaping internet governance policies. While resource constraints may pose a challenge for some agencies, ICANN maintains that it is committed to working with government entities to address legitimate concerns.
The Importance of Accurate Whois Data
The debate surrounding Whois data accessibility underscores the critical role that this information plays in maintaining a secure and trustworthy internet environment. While concerns about privacy have led to increased data obfuscation, the ability to identify and track down malicious actors remains essential for combating cybercrime, fraud, and other online threats.
Even incomplete or inaccurate Whois data can provide valuable leads for investigators. As Burke pointed out, Whois data has been instrumental in establishing links between networks and obtaining subpoenas based on that information. The absence of this data significantly hinders investigative efforts and allows malicious actors to operate with greater impunity.
Moving Forward: Finding a Balance Between Privacy and Security
The challenge lies in finding a balance between protecting individual privacy and ensuring that law enforcement and security researchers have the tools they need to combat online crime. The current system, shaped by GDPR and other privacy regulations, has undoubtedly made it more difficult to access Whois data. However, alternative mechanisms for accessing this information, such as accredited access programs and data escrow arrangements, offer potential solutions.
ICANN’s response to the FDA’s concerns highlights the ongoing dialogue and the need for continued collaboration between stakeholders to address the challenges of Whois data accessibility. By working together, government agencies, domain registries, registrars, and privacy advocates can develop solutions that protect both privacy and security in the digital age.
Conclusion: A Need for Nuance and Collaboration
In conclusion, the disagreement between ICANN and the FDA regarding Whois data highlights the complexities and challenges of internet governance in the era of enhanced data privacy. While the FDA’s concerns about the difficulty of accessing accurate Whois data are valid, ICANN maintains that mechanisms exist for legitimate entities to obtain necessary information. The debate underscores the need for a nuanced understanding of the issues and a collaborative approach to finding solutions that balance privacy and security concerns.
Perhaps, using a rating system similar to Politifact, the FDA’s presentation could be described as “Mostly True” or “Half True.” It contains accurate information but omits crucial details, offering an incomplete picture of the reality of Whois data access and ICANN’s role in the internet ecosystem. Continued dialogue and collaboration are essential to bridge the gap and ensure a safer and more secure online environment for all.