On the Moniker Whois Privacy Incident — My Thoughts
It’s an unfortunate incident. Not a scandal.
I’ve waited a few days to write regarding the Moniker whois privacy flap. My first reaction was that this whole thing was being blown way out of proportion, so I wanted to wait and see how I felt in a few days.
But I still feel the same way.
What happened
I really don’t know all the details behind what happened. What I can gather from reading this blog entry is that an Oversee.net employee found out who owned a domain name protected by the firm’s Moniker Privacy Services and disclosed this information to the domain owner’s boss.
How Bad is This?
This is a pretty bad lack of judgment by the individual who did this. I’d be rather upset if the firm disclosed that I owned a particular domain name. Even if the information was publicly available, I wouldn’t want my registrar to disclose certain information without my permission.
How could this happen?
There are certain people who know just regarding every domain name I own. That includes my Moniker and Go Daddy account reps. They also know the few domains I have protected by whois privacy (mainly since they are for fresh ideas I had at one point).
Beyond that not many people at these firms ought to know what I have registered with them. I suspect their boss and their bosses boss up the chain could get access, too. I’ve always taken this into consideration when registering domain names.
I don’t know how the employee accessed the information in this case. But Moniker has stated that distributing the information was against firm policy.
Have you ever made a snap decision that seemed like no big deal at the time you made it, then afterward you ask yourself how you could have been so stupid? I know I have. Sounds like that’s what happened here.
Whose fault is it?
It depends on the details of what happened.
Perhaps there need to be more controls within the registrar (and I’m sure at other registrars, too). But there are limits.
As I mentioned, my Moniker and Go Daddy account reps know which domains I own. If one of them decided to break firm policy and disclose this, there’s very little that can be done to stop that. It would be a bad decision for an employee to disclose this information, but good and bad people make bad decisions all the time.
Ought to the perpetrator be named, tarred, and feathered?
Not by Moniker.
Like it or not, these sorts of violations of firm policy happen all the time in all industries. In most situations the firm will not name who violated a firm policy. It’s confidential information and they could get sued for doing it. It may not even be any of our business to know who it was.
One exception is if a law is broken, or if it’s a senior employee, officer, or an ironic person — such as the Chief Privacy Officer who was specifically entrusted with the information.
If the Moniker client whose information was released wants to name names, that’s certainly up to them. But it’s certainly not Moniker who ought to disclose that information.
As for punishment, the employee could be fired. That’s serious. They also probably had a horrible holiday as they wondered regarding their fate. But it’s not like you go to jail for violating firm policy.
What ought to Moniker have done following learning regarding what happened?
I’ll tell you this: they shouldn’t have immediately fired off an email to clients telling them what happened. Here’s why:
1. No clients are at immediate risk of damage due to this breach. If a lot of clients were victims, or a number of credit cards were disclosed somehow, that’s when an immediate message is warranted.
2. They need to investigate what exactly happened and determine if it’s the first time or a repeat occurrence. Do you think SnapNames immediately informed clients following the Halvarez scandal? No, they researched all the facts and then disclosed the information.
3. The firm may need to make changes to internal procedures and would want to announce these in its communication.
4. The incident appears to only involve one client and one employee. If that’s the case, and this is an isolated instance, it’s not the type of thing firms generally tell the world. If a client service rep cusses me out, do they issue a press release? If a rogue client service rep at Amazon tells someone else what I ordered, do they tell all their other clients that this happened or do they just discipline the employee?
In summary
Unless something else comes out, this is not a scandal we’re looking at. It’s an isolated incident perpetrated by one person who made a bad decision that affected only one client.
It’s an unfortunate incident, and I don’t want to downplay that. All domain registrars ought to consider how this information is safeguarded. But let’s not make this something more than it is.
