Re: [ga] Privacy and Whois databases

[John C Klensin <klensin@mci.net>]

On Fri, 15 Oct 1999 21:19:05 -0500 Peter Veeck <veeck@texoma.net>
wrote:

> I use whois to fight spam abuse.  Are  Spam complaints going 
> to be taken over by ICANN or a subset thereof?


(This note is going to be long and a bit technical.  I apologize
in advance and anyone who believes that all problems are easy 
should just skip it.  Additional disclaimer: these are personal 
impressions based on a bit of experience and thought --I have no
idea whether anyone else in MCI WorldCom would agree and they 
certainly aren't corporate positions.)

Peter,

This case worries me a lot, because I can argue that either 
whois is important to it or that it is nearly irrelevant.  The 
problem also looks different depending on whether you see those 
tables as sources of information for fighting spammers (and you 
and I do) or as sources of addresses for use by the spammers 
(the amount of spam I get as the result of being in those tables
is trivial compared to what shows up from other sources, and 
the CDs of millions of addresses for people to bother don't 
appear to be significantly populated from Whois).  

For background, in my day job, I've ended up with administrative 
responsibility for MCI.NET; if you check the Whois tables, 
you'll find my name and phone number there.  Until 13 
months ago, MCI.NET (with a fairly deep hierarchy) was the
management domain for internetMCI: there were never supposed to 
be any user/customer mail addresses in the domain, but there 
were many routers, mail and web servers, system management 
stations, etc.  internetMCI was pretty aggressively antispammer,
with a significant full-time staff dedicated to fighting the 
activity, and there are a good number of ex-spammers, would-be 
spammers, and even a few ex-large-bandwidth customers who can 
attest to that.   When we sold internetMCI to Cable and 
Wireless, most of the spam-fighting apparatus went to them along
with the equipment, customers, etc.   

But the spammers --or those who supply them with software and 
tools-- either don't know that the sale occurred or don't care, 
so MCI.NET has become a popular address for faking into 
messageIDs, "From:", fields, bogus server names, etc., and is 
used far more in those ways than it was, e.g., two years ago.   
That the addresses are being faked is, in almost all cases, 
obvious to anyone who has a clue about email and who takes a 
minute to examine the trash that they have received.

It is also worth noting that, as for most business activities, 
when things get large, they get specialized:  even if 
information is public, for a large domain, the top-level
contacts in the Whois tables are _exactly_ what the specs say 
they are, i.e., administrative, technical, and billing contacts 
for _namespace_ management.  They may not have much to do with 
email systems or, in especially bad cases, may not be more 
effective at reaching the email people in their organizations 
than an end user might be.

So, let's see what happens today.  A user receives spam and 
finds it offensive.  There are a bunch of neat tools on the 
market that either intercept the stuff sight unseen or take a 
referral from that user and start sending out complaint messages 
-- to postmaster, root, any address in whois, etc., at all of 
the apparently-relevant domains.  But those tools aren't too 
smart, especially in the hands of clueless users (we recently 
had the authors of one tell us that being more careful would 
slow down the software and be inefficient (!)).

So, these faked addresses produce a large flow of messages (some
of them quite abusive and threatening) to people who aren't 
responsible for the spam or its relaying, have little or no 
control over organizational mail servers, and, if there are 
specific people in the organization whose jobs focus on 
spammer-fighting and who have the skills and tools to do so, 
they don't get reached. I, and I assume most of us, do forward 
those notes to the right places, but some considerable time gets
lost in the process.  

And time is important: typically, the real offenders are 
originating the junk from short-lived dialup accounts.  If they 
can be tracked down at all, one has to capture the dialup 
address and timestamps from the email header, identify the ISP,
get to _their_ antispam people, and find out which customer was 
using that address at that time (that assumes little relaying 
and fakery goes on; otherwise the tracing process has to be done
recursively, one site/organization at a time.  Now, here, the 
whois tables might help us identify a site contact to discuss 
things with, but, as in our case, the larger and better-staffed 
the ISP is, the less likely it is that the whois path will be 
particularly efficient.   And many ISPs don't keep those 
detailed logs for a very long time: if the spammer can succeed 
in evading identification for long enough (in some cases we have
encountered, only 24 hours), it can't be found at all.

Even if we (or someone closer to the user -- we really shouldn't
be involved at all in this part of the process) find the right 
ISP, privacy and business considerations often prevent their 
identifying the customer to us.  If they care (some do more than
others), they must identify the customer and take responsibility
for discouraging the behavior (noting that shutting down the 
account of a dialup user is nearly pointless -- it just shows up 
somewhere else a few minutes later).   But those are other 
issues.

Conclusion: the whois data, even if available, aren't an 
especially good tool for fighting spam, although they may be 
better than anything else right now (see below).  And, if they 
are needed, replacing them with the smail, inquiries to 
registrars, or proofs of why the information is important, just 
aren't going to be adequate substitutes because of those 
timeout problems.

However, it is often extremely important to be able to use the 
Whois data for the reasons for which they (and the rule that 
sites running email must support a "postmaster" address) were 
originally intended: to get a message to someone about 
something, in the name space, on the mail system, or elsewhere 
relevant, that the involved system is broken and needs fixing up
from the inside.  In the Whois case, relying on a DNS SOA record
(or something similar) to obtain the contact information can be 
pointless -- the canonical complaint is "your DNS server is 
broken and is causing network damage", and that requires a path 
that doesn't depend upon being able to access the DNS server.   
Remember that, ultimately, the information in those tables is 
about the management of a name space... it is not about who runs
a business, where to find the web master, or who is the chief 
poo-bah in charge of cutting off customers who violate network 
norms.  

Oddly, the trademark issues that keep coming up as examples of 
why the data need to be public may be less difficult, just 
because obtaining information in strictly real-time may be a bit
less important.  I haven't seen anything that feels to me like 
the right formula yet (some of the ideas that have been floated 
feel distinctly not-right, but I think there may be a reasonable
one somewhere).  For example, there may be some possibilities 
involving registering or credentialing people who would engage 
in legitimate intellectual property searches to get them 
different access than random users might have while ensuring 
those mechanisms don't create another monopoly or another 
"business opportunity" for registries or registrars.  And, if 
_their_ privacy is important, we could imagine third-party 
organizations, keys, and certificates that would provide 
credentials while protecting privacy.

That obviously isn't a case for either "should be completely 
open" or "should be completely closed" or even for "user 
option".  It is a strong suggestion that there are more 
possibilities if we think creatively about the issues and what 
we are trying to accomplish.

And that brings us back to the fighting of the spammers.  I 
think some creative work is needed.  It isn't clear to me that 
ICANN is the right place to do the work or to make whatever 
guidelines are needed.  I think most ISPs, and companies who 
receive a lot of spam complaints, would be delighted to publish, 
either as part of Whois data that was always exposed or through 
some agreed-upon DNS entry, contact information for anyone who 
believes spam is originating from their sites and that the odds 
of persuading others to go along are pretty good.  A "for 
alleged spam, contact" address could be published, even for a 
domain whose real contact information needed to be hidden from 
general view, by pointing to a third party (since many of the 
sites requiring anonymity don't run mail servers, they might 
find that recruiting someone to accept such mail and return a 
brief response, ideally after an automated review, quite easy). 
Or we could try to standardize another address like 
"postmaster".   But we would all need a convention about where 
to put the information and how to present it that could be used 
by low-clue users and whatever tools they select.

Like it or not, these are complex systems.  Everything is 
related to everything else.  Answers that are developed from 
only a single perspective, or with the needs of only a single 
user group, in mind, will almost always be wrong because they 
will foul up something else of [nearly] equal importance.  We 
need to figure out how to work together to get all of the issues
and considerations onto the table, to eliminate the fantasies, 
and then to construct a solution space and see what can be 
created in it.

My impression is that the turmoil of the last few years has made
it hard to think creatively about these problems and to inject 
any solutions that might be found into the systems.  Too much 
else has been going on, and it has been too tempting to identify
any change or suggestion as a plot with one sinister purpose or 
another. But maybe this, or right after we get through the 
election, is the right time. And maybe the GA would be a good 
place to at least initiate the discussion, rather than just 
turning into a series of simplistic straw polls on a small 
fraction of the options or arguments about which objective is 
most important.

     john