[nc-whois] Final (?): Accuracy

[Thomas Roessler <roessler@does-not-exist.org>]

Here's the accuracy chapter in HTML, including a variety of links.
I have taken the liberty to add a little headline to IC.

-- 
Thomas Roessler                        <roessler@does-not-exist.org>

Title:

Accuracy of WHOIS Data

I. Enforcement of existing contractual obligations (in the Registrar Accreditation Agreement) regarding accuracy of WHOIS data

A. ICANN should work with all relevant parties to create a uniform, predictable, and verifiable mechanism for the enforcement of the WHOIS-related provisions of the present agreements.

1. Adequate ICANN resources should be devoted to enforcement of the Whois-related provisions of these agreements.

2. ICANN should ask registrars to identify, by a date certain, a reliable contact point to receive and act upon reports of false WHOIS data. ICANN should encourage registrars to (i) provide training for these contact points in the handling of such reports, and (ii) require re-sellers of registration services to identify and train similar contacts.

3. ICANN should post registrar contact points on its web site (perhaps on the list of accredited registrars). It should also encourage registrars to take reasonable steps to make their own contact points publicly available, such as by posting this information on the registrar’s home page, including it on the page displayed in response to a query to the registrar’s Whois, and/or in other ways.

4. ICANN should continue to maintain an optional and standardized complaint form on this issue in the internic.net site. Registrars, registries and re-sellers should be encouraged to provide a link to this site. In order to better ensure follow up, the complaint form should supply a "ticket number" for the complaint and should be designed so ICANN receives a copy of the registrars' response to the complaint (i.e., the form should incorporate a simple, automated mechanism for the registrar to report back to ICANN on the outcome of complaints).

B. ICANN should modify and supplement its May 10, 2002 registrar advisory as follows:

1. ICANN should remind registrars that "willful provision of inaccurate or unreliable information" is a material breach of the registration agreement, without regard to any failure to respond to a registrar inquiry. A functional definition -- based on the actual usability of contact details -- should be used for “inaccurate or unreliable”.

2. ICANN should clearly state to registrars that "accepting unverified 'corrected' data from a registrant that has already deliberately provided incorrect data is not [not "may not be," as the advisory now states] appropriate." Accordingly, where registrars send inquiries to registrants in this situation, they should require not only that registrants respond to inquiries within 15 days but that the response be accompanied by documentary proof of the accuracy of the "corrected" data submitted, and that a response lacking such documentation may be treated as a failure to respond. The specifics of acceptable documentation in this situation should be the subject of further discussions.

3. There is not a consensus on the Task Force (taking into account comments received) that 15 days without a response is a sufficient time period to establish a material breach in all cases. ICANN should work with registrars, over the next 6 months, to monitor and collect more extensive data on the specific impact of the 15 days period in RAA 3.7.7.2, and its actual implementation by registrars, on good faith registrations, in particular from developing countries, that are subject to accuracy inquiries.

C. Additionally, the Task Force recommends.

1. ICANN should encourage registrars to take steps to remind registrants of their obligations to submit and maintain complete and accurate contact data at appropriate points, including but not limited to the time of renewal of a registration.

2. Registrars should also be responsible for ensuring that their agents provide such reminders.

3. ICANN should also take steps to include information about this obligation on its websites at appropriate locations, and consider other ways to educate registrants on this issue.

4. Registrars should be encouraged to develop, in consultation with other interested parties, “best practices” concerning the “reasonable efforts” which should be undertaken to investigate reported inaccuracies in contact data (RAA Section 3.7.8).

II. Further work.

The following interim recommendations for improved enforcement of Whois obligations require further discussion by this Task Force or another appropriate body. Item (A) would, and item (B) might, require the development of a new policy or specification under RAA 3.7.8. We recommend this discussion be undertaken within the next :

A. Instructing registrars to use commonly available automated mechanisms to screen out obviously incorrect contact data.

B. Treating a complaint about false WHOIS data for one registration as a complaint about false WHOIS data for all registrations that contain identical contact data.

III. RAA changes

The following proposed changes to the agreements to enhance Whois data accuracy are recommended (and therefore are proposed as consensus policies):

A.  Registrants should be required to review and validate all WHOIS data upon renewal of a registration. The specifics of required validation remain to be determined by this Task Force or another appropriate body.

B.  When registrations are deleted on the basis of submission of false contact data or non-response to registrar inquiries, the redemption grace period -- once implemented -- should be applied. However, the redeemed domain name should not be included in the zone file until accurate and verified contact information is available. The details of this procedure are under investigation in the Names Council's deletes task force.

IV. The following proposed changes to the agreements need further discussion

A. Responses to the interim report indicate interest in placing registrations for which accurate or updated contact data has not been received in an appropriate hold status for some period of time prior to the eventual deletion of the registrations (see item III(B) above). Registrations in this hold status would be returned to operational status upon provision of accurate and verified contact information. Further research by this Task Force or an other appropriate body, in consultation with registrars and other interested parties, is needed to determine whether the benefits of adding this additional step outweigh the potential costs.

B. Adding a regime of graduated or intermediate sanctions for patterns of violations by a registrar of the WHOIS obligations of the agreements. (This would supplement the current sanction of revocation of accreditation.)

C. Requiring registrars to spot-check a sample of current registrations in order to validate the accuracy of submitted contact information, using semi-automated methods to the extent feasible.

V. Recommended priorities for further work

1. Issues discussed in items I(B)(3), IV(A) (15-day period, hold period)

2. Issues discussed in II(A), II(B), III(A) specifics, IV(C) (screening/spot checking mechanisms, provision for block complaints against registrations with identical Whois data, validation specifics)

3. Issue discussed in IV(B) (intermediate sanctions)