[PC-NCSG] [NCUC Public Comment] Thick and Thin Whois Preliminary issues report -- draft comment

[Wendy Seltzer]

This is due today, Dec. 30, to thick-whois-preliminary-report at icann.org
On whose behalf shall I submit it?  NCSG or NCUC?
Current draft as circulated included below.

If it's acceptable, I'd like to add a bit more meat to the privacy
section, "Individual registrants in particular may be concerned that the
aggregation of data in a thick WHOIS makes it more attractive to data
miners and harder to confirm compliance with their local privacy laws."

Thanks,
--Wendy

-------- Original Message --------
Subject: Re: [NCSG-Discuss] [NCUC Public Comment] Thick and Thin Whois
Preliminary issues report -- draft comment
Date: Wed, 28 Dec 2011 11:19:37 +0000
From: Konstantinos Komaitis <k.komaitis at STRATH.AC.UK>
Reply-To: Konstantinos Komaitis <k.komaitis at STRATH.AC.UK>
To: NCSG-DISCUSS at LISTSERV.SYR.EDU

Hi Wendy,

this is a great statement - thanks for taking the time to draft this. I
fully support it. I would hope that this would become an NCSG statement
- can I ask whether NPOC would be willing to support it?

Thanks

KK

PS: going back to eating now....

---statement---
NCSG offers this comment on the Preliminary Issue Report on 'Thick' Whois.

As an initial matter, we question the impetus for this
policy-making.  It is not clear that changing the thickness of
WHOIS responds to the IRTP working groups' concerns about secure
data exchange in a transfer, as neither the security properties
nor alternatives are described in any detail.

The items in the Applicant Guidebook, in particular the
requirement that all new gTLD applicants provide thick WHOIS, do
not reflect a GNSO or community consensus. It would therefore
reverse the policy-making process to assert consistency with new
gTLDs as a rationale for creating a policy that required existing
registries to change their WHOIS model.  The issue report
correctly notes that no policy currently exists as to WHOIS
model. We do not believe this PDP is the time or way to make such
policy.

Further we question the timing and sequence of this proposed
PDP. A drafting team is currently developing a survey of WHOIS
technical requirements, to gauge community needs from the WHOIS
system. Policy requiring thick WHOIS appears to offer a solution
without before the problem is defined -- and so risks "solving"
the wrong problem, while in the process reducing flexibility to
solve actual problems that the community identifies. We also have
ongoing WHOIS studies. As the GNSO Council frequently hears about
the overload on staff resources, and community members themselves
face numerous competing demands on their time, we believe these
resources could be better optimized by rejecting this PDP or
postponing it until the prior WHOIS work gave definite objectives
that required changes to the WHOIS model such as a thick WHOIS.

If there is any consideration of a PDP on Thick Whois, it should
include the issue of the legitimacy of the current Applicant
Guidebook requirement on new gTLD applicants to use the Thick
Whois model. It is quite clear that this subject is within the
scope of the GNSO, a scope that should not have been preempted by
the New gTLD application process.  The Issues report should cover
this topic before any discussion on the appropriateness of
extending the model to the incumbent registries.

Within the report itself, we would like to see more consideration
of alternative models, such as standards that could streamline
the distributed database of thin WHOIS, or a centralized
database.  Many of the format and accessibility concerns, for
example, would appear to be better served by agreement on a
standardized format for WHOIS data responses than by requirements
on where the data must be kept. A new policy meant to address
these concerns should look at their root causes, and explore the
range of available options, not simply pick thick WHOIS because
it's common.


As this preliminary issue report was completed before the
adoption of the new PDP process, it does not contain the impact
analysis recommended there. NCSG has particular interest in the
impact on privacy rights. Moving all data to the registry could
facilitate invasion of privacy and decrease the jurisdictional
control registrants have through their choice of registrar.

For these reasons, NCSG opposes commencement of a PDP and recommends
constriction, not expansion of the thick WHOIS mandate.

---/statement---