Task force report looks at accuracy of Whois data

December 5th, 2002
By Linda Rosencrance

It's a question that continues to plague the Internet Corporation for Assigned Names and Numbers (ICANN), domain name registrars, the U.S. Congress and myriad federal agencies: How best to ensure the accuracy of Whois data?

And it doesn't look as though there will be an answer anytime soon.

Last week, the Domain Name Supporting Organization's (DNSO) Whois Task Force issued a report offering policy recommendations to ensure the accuracy of information contained in the Whois database, the directory that lists names and contact information of people who register domain names. The DNSO advises ICANN, the Marina Del Rey, Calif.-based organization that oversees the Internet's addressing system, on policy issues related to the domain name system.

Although the report addresses how best to rapidly correct data determined to be inaccurate after a complaint is lodged, it doesn't address proactive measures that could be used to screen out incorrect data during the registration process.

That issue, according to Marilyn Cade, co-chair of the task force, is something that needs to be addressed, given the growth of "spoofed" Web sites that have been used to try and defraud people online.

Despite repeated prodding by federal officials, who say successfully fighting fraud on the Internet depends on the accuracy of the Whois database's registration information, most registrars haven't hit on a way to ensure that the information provided by a registrant is accurate.

Registering a domain name is currently done on the honor system -- a registrant only needs to fill out an online form, and a domain name is automatically reserved for him. As such, the process is ideal for cybersquatters or other scammers looking to defraud businesses or consumers.

While ICANN requires registrants to provide accurate contact data, it doesn't force registrars to verify contact details at the time of registration. (Such a policy may be developed by ICANN in the future.)

ICANN Vice President Louis Touton said there is no feasible way right now to ensure the accuracy of Whois data on the front end.

Thomas D'Alleva, a spokesman for Baltimore-based BulkRegister.com Inc., implied that registrars shouldn't be held accountable for checking the accuracy of data provided by people who register domain names.

"We're like a department of motor vehicles," he said. "If you give false information to a DMV, they'll still give you a driver's license even though the information is false."

In a Sept 22 conference call between registrars and members of the Whois Task Force, Tim Ruiz, project manager at GoDaddy Software Inc., a Scottsdale, Ariz.-based registrar, said, "We would feel that proactive measures to make data accurate would not be affordable or useful."

A spokeswoman for VeriSign Inc., a Mountain View, Calif.-based registrar, provided information to Computerworld that indicated that the company had implemented a real-time validation process that would detect "lazy" keyboard typing in a form's address field, such as listing 123-123-1234 as a contact telephone number. This practice of entering dummy data is often used by people trying to perpetrate a fraud.

Despite this technology, a scammer who on Nov. 11 set up a spoof eBay Web site was allowed to register the domain name ebaylogin.com with VeriSign using 555-555-5555 as his fax number. The site has since been taken down.

Alec French, an aide to Rep. Howard Berman, (D-Calif.), the ranking member of the Judiciary Committee's Subcommittee on Courts and Intellectual Property, said Berman has filed a bill that would make it a criminal offense, punishable by a fine and imprisonment of not more than five years, for anyone to knowingly provide false contact data to a domain name registrar.

Despite warning ICANN last year that it should move to verify the contact information of its customers or face congressional action, Berman has not yet pushed his bill, French said.

Maneesha Mithal, a spokeswoman for the Federal Trade Commission, said that agency has met with ICANN and the registrars to discuss how to weed out fraudulent registration while still protecting the privacy of individuals setting up legitimate Web sites.

But the Whois Task Force doesn't advocate government intervention, said Cade.

"The registrars need to understand that a little bit of self-governance will prevent a large amount of governance by government," she said.