The WHOIS: security and privacy issues

Transcription

1 The WHOIS: security and privacy issues Giovanni Seppia CENTR General Manager Network and Information security: political and technical challenges

2 Introducing CENTR

3 What is CENTR? Council of European National Top Level Domain Registries Forum for TLD managers Primarily cctlds Also includes gtlds Mainly European Membership from 5 continents Developed and emerging TLD markets, like.af,.ir Open to all Top Level Domain Registries in the world

4 CENTR s Membership AFGNIC Afghanistan (.af) STA Andorra (.ad) ISOC.AM Armenia (.am) NIC.AC Ascension Is. (.ac), Diego Garcia (.io), St Helena (.sh) NIC.AT Austria (.at) DNS Belgium Belgium (.be) Digital Systems Bulgaria (.bg) CIRA Canada (.ca) CARNet Croatia (.hr) UCY-DNS Cyprus (.cy) CZ.NIC Czech Republic (.cz) DENIC Germany (.de) Dansk Internet Forum (.dk) FICORA Finland (.fi) AFNIC France (.fr), Mayotte (.yt), Reunion (.re), St. Pierre & Miquelon (.pm), Wallis & Futuna Is. (.wf ) GibNet Gibraltar (.gi) GR-Hostmaster Greece (.gr) Island Networks Guernsey (.gg), Jersey (.je) CHIP Hungary (.hu) IEDR Ireland (.ie) IPM Iran (.ir) ISNIC Iceland (.is) ISOC-IL Israel (.il) IT-NIC Italy (.it) JPRS Japan (.jp) LITNET NOC Lithuania (.lt) LATNET, Latvia (.lv) RESTENA DNS-LU Luxembourg (.lu) NIC Malta Malta (.mt) NIC-Mexico Mexico (.mx) SIDN Netherlands (.nl) ISOCNZ New Zealand (.nz) NORID Norway (.no), Bouvet Is. (.bv), Svalbard & Jan Mayen Is. (.sj) Palestinian Registry Palestine (.ps) NASK Poland (.pl) FCCN Portugal (.pt) RNC Romania (.ro) Ros-NIIROS Russia (.ru) RED.ES Spain (.es) ARNES Slovenia (.si) IIS Sweden (.se) SWITCH Switzerland (.ch), Lichtenstein (.li) SITA (.aero) Vatican Holy See (.va) Nominet UK United Kingdom (.uk) NeuStar United States of America (.us) VeriSign (.com,.net) Afilias (.info) Public Interest Registry (.org)

5 CENTR s structure Executive Committee 5 members to steer the organisation in accordance to members wishes Secretariat 4 people to develop the work as requested by members

6 CENTR s output Newsletter, Domain Wire, 2 issues a year Surveys A-level survey, covering the registries management main aspects B-survey, covering legal issues related to registries Other surveys upon request of our members Comments and positions on several topics that may have an impact on our members Outreach programme, providing registries of developing countries with financial and technical support

7 CENTR in the international arena The European Commission participates in CENTR as an observer. Government reps may also attend Regular meetings with: DG INFSO & Media, including the GAC Secretariat, the Cabinet of the Commissioner Reding At present, co-operation with the data protection Unit of DG Justice, Freedom and Security for the WHOIS related topics Associate member of the European Internet Foundation Regular participation in all the international Internet fora and meetings

8 CENTR s long term vision Expanding the dialogue among registries, governments and international bodies Developing best practice by encouraging exchange amongst registries Improving the reliability and stability of Internet through improved DNS practices Working closely with other Internet organisations

9 CENTR and the WSIS-WGIG process Fundamental to distinguish between: Those issues that may require restructuring of the present arrangements Those that can be (and are expected to be) resolved within the existing frameworks Most issues are local and regional: best solved within countries, not globally The free spirit of the Internet crucial for any future development

10 Industry statistics

11 Domain name base growth 2001 Q2 2005* At the end of the second quarter 2005, there were 82,9 million domain names registered worldwide. This represents a nearly 8% growth over the first quarter of 2005 and a 28% increase over last year..com remains the largest Top Level Domain (TLD) in terms of its total base of registrations. Followed by.de (Germany),.net and.uk (United Kingdom) *courtesy of VeriSign

12 Industry growth and composition* Over 8 million new domain names were registered in the second quarter of The cctlds as a group count for 35% followed by.net at 7%. *courtesy of VeriSign

13 cctld breakdown 2002 Q1 2005* Out of the more than 240 cctlds, the top ten account for 71% of all cctld registrations. cctlds compete with gtlds and each other. *courtesy of VeriSign

14 Top cctld registries by domain name base, Q de (Germany) 2..uk (United Kingdom) 3..ar (Argentina) 4..nl (Netherlands) 5..it (Italy) 6..us (United States) 7..br (Brazil) 8..ch (Switzerland) 9..cn (China) 10..jp (Japan)

15 WHOIS and security issues

16 CENTR and WHOIS In 2004, CENTR members started to work on a document that was meant to provide information on: WHOIS Policies on WHOIS services Administrative and technical aspects of WHOIS services WHOIS checklist

17 Originally: What is WHOIS? A simple network protocol for sharing contact information relating to a domain Designed to aid network engineers in contacting domain administrators to maintain the stability of the Internet Over time, taken on a second meaning: The database of contact information relating to domains, no matter how it is presented i.e. over WHOIS, via a web page, using other methods Now there are over 80 millions domain names registered worldwide Uses for WHOIS services has expanded

18 WHOIS and cctlds Country Code Top Level Domain registries are accountable to the local communities they serve Relations between cctlds and their registrars are generally made through bilateral agreements Each cctld must establish and enforce any privacy policy in accordance with applicable laws

19 Who uses WHOIS? The OECD stated that WHOIS data is a critical source of information that assists in accurately identifying the registrants of domain names WHOIS is generally used by: Network operators Registries and registrars Registrants (i.e. consumers) Business users Law enforcement personnel

20 Information availability For gtlds, public availability is requested by ICANN through the Registrar Accreditation Agreement, which require registrars to collect data directly from the registrants Information to be available: Name of authoritative name servers Identity of the registrar Date of initial registration Current expiration date Name and postal address of the name holder Name, postal address, address, telephone and fax numbers of the technical contact for the registered name Name, postal address, address, telephone and fax number of the administrative contact for the registered name

21 Data accuracy The survey undertaken by the WHOIS taskforce of ICANN in 2002 revealed that a high percentage of the WHOIS data is incomplete, inaccurate or outdated The cctlds have established some methods to improve the accuracy of the WHOIS data

22 Administrative aspects of a WHOIS service Registries and registrars need to consider the impact of complying with relevant data protection requirements Declarations of data collection and usage Source for legislation about data protection The controller of the data Usage of personal data Transfer of data to third parties Information on the rights of the registrant and its ability to enforce them The right to refuse data to be displayed on the WHOIS The possibility to access its own data Ability to correct or delete held data

23 Technical aspects of a WHOIS service Registries may have put in place some technical measures to run a WHOIS service in compliance with administrative requirements: Data security Access to data Tiered access Opt-in/opt-out provisions Searchability

24 Security issues summary Level of data in the database Controls on queries Indirect vectors to get into WHOIS Primary goal: Run the service, protecting the rights of the registrant

25 CENTR WHOIS paper Developed as a reference document of guidelines Not mandatory for CENTR members Provides a framework to help them develop suitable policies and procedures that comply with international legislation and regulations Highlights some basic aspects of the WHOIS services, offering a checklist

26 Create a privacy policy WHOIS checklist Make the privacy policy available at all times Ensure that you can get a specific consent from the registrant Give the registrant the possibility to read, rectify or remove personal data contained in the registry database Use the data strictly in accordance with the policy Third party access Maintaining the database

27 Questions? Thank you for your attention Giovanni Seppia CENTR General Manager