View source for False Whois

'''False Whois''' refers to providing incorrect or inaccurate data to the Whois database.<ref>[http://www.mattcutts.com/blog/false-whois-data/ False whois data] (September 1, 2005), MattCutts.com</ref> Whois data is publicly available<ref name="gnso">[http://gnso.icann.org/en/group-activities/other/whois/studies Current Information About GNSO-Approved gTLD Whois Studies] (March 19, 2014), Internet Corporation for Assigned Names and Numbers (ICANN)</ref> and includes information about a domain's registrant, such as "contact information (e.g., mailing address, phone number and e-mail address), administrative and technical contacts, and other information."<ref name="icann">[http://www.icann.org/en/resources/policy/background/whois Policy Issue Brief - gTLD WHOIS], Internet Corporation for Assigned Names and Numbers (ICANN)</ref> This information is collected by the registrar and is meant to provide a means of contacting a website's registrant if there are technical difficulties with the site or if illegal activity has occurred.<ref name="qa">[http://whois.icann.org/en/questions-answers Question / Answers], Internet Corporation for Assigned Names and Numbers (ICANN)</ref> However, it can also be used by unscrupulous people trying to steal the registrant's personal information.<ref name="qa"/> A recent study released by Carnegie Mellon University found that "there is a statistically significant occurrence of WHOIS misuse affecting Registrants’ email addresses, postal addresses, and phone numbers" with 44% of registrants experiencing these types of Whois misuse.<ref>[http://www.icann.org/en/news/public-comment/whois-misuse-27nov13-en.htm Whois Misuse Study Draft Report] (PDF), ICANN</ref>

==Public Perception==
Public perception on using false Whois information is mixed. People tend to be skeptical of how and who uses Whois data, especially with the risk of identity theft.<ref name="qa"/> Additionally, there is concern that Whois data could compromise people's safety by requiring a physical address.<ref name="sec"/> As for paying for a privacy or a proxy service, it can be expensive when compared to simply using false data. The dark side of false Whois information, such as using false credentials to engage in illegal or criminal activity, also remains a large concern. People want the Internet to be an open and public forum but they do not want to be taken advantage of or put at risk.

==Outcome==
The outcome of false whois data is that it conceals the identity of registrants and makes it difficult to contact the registrant if problems occur. Motivations for this activity may be criminal or completely innocuous. 

==Historical Use==
*False Whois data can be used for a number of reasons, namely to conceal the identity or contact information of a registrant without using a registrar's privacy policy or a proxy service. The reasoning behind this misinformation varies. Sometimes people seek to conceal their information because their website is involved in illegal activity while others are concerned that their public Whois data compromises their private identity and will be used by spammers, scammers, or phishers.<ref name="qa"/> To address the concern of improper Whois use, ICANN and the [[GNSO]] are currently sponsoring and conducting research on how the Whois database is being used.<ref name="gnso"/> The Whois database is believed to contribute to [[Phishing|phishing]], [[Spam|spam]], [[Domain Slamming|domain slamming]], and [[Fake Renewal Notice|fake renewal notices]].

==ICANN Policy==
*Whois [[Restored Names Accuracy Policy]]: this policy, enacted in 2004 states that once a name is deleted because of false or inaccurate "contact data, or there was no response to requests for information, the name must remain on hold until the registrant provides updated and accurate WHOIS data."<ref>[http://whois.icann.org/en/history-whois History of WHOIS], Internet Corporation for Assigned Names and Numbers (ICANN)</ref> 

*[[Whois Data Reminder Policy]] (WDRP): this policy, enacted by ICANN in 2003 requires that once a year registrars send out WDRP notices that ask for changes or updates to the registrant's current Whois information.<ref name="warp">[http://www.icann.org/en/resources/registrars/consensus-policies/wdrp Whois Data Reminder Policy], ICANN</ref> This policy is aimed at having correct and up-to-date Whois data; if there are no changes in Whois information, no response is required.<ref name="warp"/><ref name="qa"/>
**View a [http://www.icann.org/en/resources/registrars/consensus-policies/wdrp#modelwdrpnotice Sample WDRP Notice]

*[[2013 Registrar Accreditation Agreement]] (RAA): in the new RAA, registrars are required to validate a large amount of the personal information supplied by registrants in addition to actively verifying their phone number or email address.<ref name="raa">[http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm#whois-accuracy 2013 Registrar Accreditation Agreement: WHOIS ACCURACY PROGRAM SPECIFICATION], Internet Corporation for Assigned Names and Numbers (ICANN)</ref><ref>[http://domainincite.com/12182-registrars-and-icann-hit-impasse-on-new-raa Registrars and ICANN hit impasse on new RAA] by Kevin Murphy (March 8, 2013), Domain Incite</ref> Falsifying the Whois information provided to registrars results in a 15 day period where the registrant is asked to correct the errors; if the registrant does not respond, it can "constitute a material breach of the Registered Name Holder-registrar contract and be a basis for cancellation of the Registered Name registration"<ref name="raa"/> 
**Some limitations associated with these ICANN policies are that registrars possibly have disincentives to delete registrations even if deadlines are missed and that different registrars may have individual policies when it comes to privacy or proxy services and dealing with Whois complaints.<ref name="sec">[http://www.securityweek.com/icanns-rolling-controversy-verification-whois-registration-data ICANN's Rolling Controversy: Verification of WHOIS Registration Data] by Brian Prince (November 30, 2012), SecurityWeek.com (Wired Business Media)</ref>

*ICANN released a Draft Implementation Plan that would create a Whois program to report the accuracy of Whois information.<ref name="announce">[http://www.icann.org/en/news/public-comment/whois-accuracy-reporting-11mar14-en.htm Draft Implementation Plan for the WHOIS Online Accuracy and Reporting System], Internet Corporation for Assigned Names and Numbers (ICANN)</ref><ref name="plan">[http://www.icann.org/en/news/public-comment/whois-accuracy-reporting-11mar14-en.htm WHOIS Online Accuracy Reporting System Implementation Plan: Section III: Document and Resource Links] (PDF), ICANN</ref> The report is available for public comment until April 1.<ref name="announce"/> The next step in implementing this program is an ICANN request for an official proposal.<ref name="announce"/>
**This plan is based on an experimental study performed by NORC and [[SSAC]] recommendations.<ref name="plan"/>
**ICANN would sample Whois information in gTLDs rating them on this scale: "No Failure, Minimal Failure, Limited Failure, Substantial Failure, and Complete Failure."<ref name="plan"/>
**Whois entries would be judged in three major categories: syntactic accuracy, operational accuracy, and identity.<ref name="plan"/> Syntactic accuracy would involve validating that all the fields are filled out and in the correct format. Operational accuracy would address whether or not the information is "applicable," and the identity category refers to validating that the Whois information "can be used to confirm the identity of the registrant."<ref name="plan"/>
**ICANN would also notify registrars with false or inaccurate Whois information.<ref name="plan"/>

*An Expert Working Group (EWG) is also working on a proposal to replace the current Whois system with the Registration Directory System (RDS).<ref name="sing">[http://singapore49.icann.org/en/schedule/mon-gtld-directory-services Exploring Replacements for WHOIS - The Next Generation Directory Services] (March 2014), ICANN</ref> The RDS would hopefully better protect registrant data and could possibly lead to less inaccurate registrations.<ref name="sing"/>

==Legislation==
*There is currently no legislation that directly addresses false Whois information.

*In 2004, the Fraudulent Online Identity Sanctions Act (FOISA) was introduced in Congress.<ref name="track">[https://www.govtrack.us/congress/bills/108/hr3754 H.R. 3754 (108th): Fraudulent Online Identity Sanctions Act], Govtrack (Civic Impulse, LLC)</ref> The act would have increased penalties for people who used false Whois information in order to facilitate criminal activity on the Internet, such as trademark violations like [[cybersquatting]] or [[typosquatting]].<ref>[http://www.sans.org/reading-room/whitepapers/legal/federal-computer-crime-laws-1446 Federal Computer Crime Laws] by Maxim May (June 1, 2004), SANS Institute</ref> FOISA would have amended the Trademark Act of 1946; however, it was never passed.<ref name="track"/>

==Additional Resources==
*Report false Whois data using a [http://www.icann.org/en/resources/compliance/complaints/whois/inaccuracy-form Whois Inaccuracy Complaint Form]
*Read [http://gnso.icann.org/en/group-activities/other/whois/studies Whois Use Reports and Studies]
*Look into the [http://whois.icann.org/en/what-whois-data Specific Elements of Whois Data]
*Read [http://www.icann.org/en/news/public-comment/whois-accuracy-reporting-11mar14-en.htm ICANN's Draft Implementation Plan]

==Relating Articles==
*[[Whois Audits and Verification]]
*[[Whois Misuse]]

==References==
<references/>

[[Category: Bad Practice]]