ICANN, GDPR, and the WHOIS:
A Users Survey - Three Years Later.

Principal Inves gators
Laurin B Weissinger, DPhil, The Fletcher School and Computer Science, Tu s University
Dave Piscitello, Interisle Consul ng Group
Bill Wilson, M3AAWG Senior Advisor

www.m3aawg.org

ft

ti

ti

www.apwg.org

2
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Table of Contents
Execu ve Summary

3

The WHOIS and the Impact of the Temporary Speci ca on

5Introduc on

5

Key Findings in Context

6

Detailed Analysis

8

Introduc on

8

Methodology

8

Demographics and Use of WHOIS

912Complaints to ICANN

25

Summary

26

ti

25

ti

Disclosure Systems under ICANN considera on

ti

20

fi

Disclosure of Redacted Data

ti

14

ti

E ects of the Temporary Speci ca on on WHOIS Use for Abuse Mi ga on

fi

ti

ti

ti

ff

RDAP Use

3
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Execu ve Summary
The Messaging, Malware and Mobile An -Abuse Working Group (M3AAWG) and The An -Phishing
Working Group (APWG) have again collaborated to conduct a survey of cyber inves gators and an abuse service providers to understand how ICANN’s applica on of the European Union’s General Data
Protec on Regula on (GDPR) has impacted on the distributed WHOIS service and an -abuse work. In
par cular, we are discussing the e ect of the Temporary Speci ca on on an -abuse actors' access andusage of domain name registra on informa on, which is central for various types of inves ga ons.
At its core, the WHOIS is a protocol widely used for accessing data on registered assignees of anInternet resource, in our case domain names. WHOIS services are available via mul ple channels, e.g.
Web-based tools, Port 43, and more recently RDAP.
From our analysis of over 270 survey responses, we nd that respondents report that changes to
WHOIS access following ICANN’s implementa on of the EU GDPR, the Temporary Speci ca on for
gTLD Registra on Data1 (Temporary Speci ca on, adopted in May 2018), con nue2 to signi cantly
impede cyber applica ons and forensic inves ga ons and thus cause harm or loss to vic ms ofphishing, malware or other cyber a acks.
Speci cally, the survey responses indicate that the Temporary Speci ca on has reduced the u lity of
public WHOIS data due to wide-ranging redac ons,3 beyond what is legally required. It also introducesconsiderable delays, as inves gators have to request access to redacted data on a case-by-case basis;o en with unac onable results. Furthermore, with limited or no access to the data that had
previously been obtained or derived from WHOIS data, some inves gators struggle to iden fy
perpetrators and put an end to criminal campaigns. The resul ng delays and roadblocks are a boon toa ackers and criminals, prolonging their windows of opportunity to cause harm during cybercrime
ac vi es such as phishing and ransomware distribu on, or the dissemina on of fake news andsubversive poli cal in uence campaigns.
M3AAWG and APWG observe that there are four issues that ICANN needs to address:
1. Access to some relevant data like contact data of legal persons needs to be readily available
while protec ng natural persons' privacy.
2. Both sporadic WHOIS users who make rela vely few requests, as well as bulk users who use
data-driven approaches for blocklis ng should be accommodated by ICANN.

1 Temporary Specica on for gTLD Registra on Data, h ps://www.icann.org/resources/pages/gtld-registra on-data-

specs-en
2 See report 1 from 2018 for further informa

on. See: h ps://www.m3aawg.org/WhoisSurvey2018-10

3 The Temporary Speci

ti

ti

ti

fi

ti

ti

ti

ti

ti

ti

fi

ti

ti

ti

ti

ti

ti

ti

ti

fi

ti

ti

ti

fi

ti

ti

fi

ti

ti

ti

tt

ti

tt

ti

ti

ti

ti

ti

fi

ti

ti

ti

ti

tt

ff

ti

ti

ti

tt

ti

fl

fi

ti

ti

ti

ti

fi

ti

ti

ti

ti

fi

ti

ti

ti

ft

tt

ca on allows for far reaching redac ons, beyond what the GDPR requires. An Interisle study
concludes that contact data for 57% of all generic TLDs are now redacted, many mes more than necessary. The Interisle
study further notes that registrants of 86.5% of all names cannot be ascertained due to redac ons and the use of privacy
and proxy services. See: h p://interisle.net/ContactStudy2021.html

4
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ti

ti

ti

ti

ti

ti

3. ICANN should establish a func onal system of registrant data access for accredited par es;
such a system needs to be workable for cybersecurity professionals and law enforcement interms of me delays and administra ve burden, and should include strict privacy andsecurity controls.
4. The survey responses indicate that the solu ons currently discussed at ICANN would notmeet the needs of law enforcement and cybersecurity actors in terms of melines

ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

The WHOIS and the Impact of the Temporary Speci ca on

Introduc on
WHOIS records are a key resource used by cybersecurity experts, law enforcement agents, blocklist
providers and others to a ribute criminal ac vity, understand malware campaigns, ag malicious
domains, and more. Users of the WHOIS tend to use the system for di erent reasons but two use
cases seem worth highligh ng.
Inves gators might use the WHOIS to nd informa on on speci c names, for example when theyiden fy a counterfeit shopfront, a er receiving an abuse report, or to be er understand or categorize
tra c pa erns. The majority of our respondents fall in this category, usually making less than 100
daily requests. Another use of the WHOIS involves the analysis of large amounts of WHOIS data todetect pa erns of abuse, and to associate malicious domains with each other, as well as malware,phishing, or spam campaigns:
Criminals regularly register large numbers of domains in bulk, o en in batches of hundreds or
thousands of names at the same me. In case individual names used for their criminal schemes areblocked, detected, or otherwise "burned", the criminals will swi ly switch to new, pre-registerednames from their earlier bulk orders. While not all cybercrimes and a acks require large numbers ofquickly replaceable names, this approach is common.
To respond to cybercriminals that leverage bulk buying and bulk resource use, inves gators query
WHOIS data constantly and at all mes to detect pa erns. Registrant as well as technical data can beused to iden fy sets of likely malicious domains based on their associa on with already known bad
domains or known records: names, email addresses, telephone numbers are likely to be the same fordomains used by the same criminal group or same campaign, while bulk orders might also present
extremely similar me stamps. When matches are found, domains can be analyzed or added towatchlists. If other criteria indica ng abuse are sa s ed, these defenders and blocklist providers
might also add these names to a blocklist.
To ght crime and abuse, large datasets are par cularly powerful: inves gators and analysts can use
them to map out and then dismantle criminal a ack infrastructures, while bulk data enables blue
teams to protect their networks. For this data-driven approach to work, however, high-volume, realme access to WHOIS records is essen ally required. Wait mes, rate limi ng, inconsistent responses,
redacted data, and rota ng fake informa on all decrease response mes and data quality.

ti

fl

ti

ti

ti

tt

ti

ti

ff

tt

ti

ti

ft

fi

ft

fi

ft

ti

tt

fi

ti

ti

ti

tt

ti

tt

ti

ti

tt

fi

ti

ti

ft

ti

ti

ti

ti

ti

fi

tt

ti

ti

ti

ti

tt

tt

ti

ti

ti

ffi

fi

Since the Temporary Speci ca on came into force in 2018 a er years of inac on, redac on ofregistrant data has complicated the work of inves gators working with large amounts of WHOIS data
and those who rely on WHOIS data to a ribute a acks and understand criminal infrastructures.
Partly, this is due to the fact that not only EU data subjects' data are now redacted, as legally required,
but also data belonging to non-EU ci zens and residents as well as data pertaining to commercial
en es, which are not protected under GDPR.

ti

ti

5

ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

The purpose of this report is to be er understand who is a ected by the current redac on regime
based on the Temporary Speci ca on and how. Furthermore, this report explores what issues our
respondents face, and what changes ICANN would have to introduce to address their concerns.
In the following sec on, we will summarize our ndings. The last sec on will provide a deeper diveinto our survey data, discussing individual ques ons, our methodology, and more granular ndings.

Key Findings in Context
The Temporary Speci ca on con nues to lessen defenders' ability to address online crime andabuse. Two-thirds of our 277 respondents indicate that their ability to detect malicious domains has
decreased. This aspect likely contributes to lower detec on capabili es when it comes to malicious
ac vity overall, as reported by 41% of respondents.
Since the Temporary Speci ca on came into force, cyber-inves gators have been signi cantly
impaired in their ability to inves gate rela onships between malicious domains and actors. Someuse cases of WHOIS data leverage unredacted technical informa on solely or predominantly. Thus,
they are less a ected by the redac ons. However, the now-unavailable registrant data, like email andpostal addresses, are extremely relevant to some inves ga ons, notably a ribu on, and haveeviden ary value to private sector inves gators as well as law enforcement and prosecutors.
Unsurprisingly, a ribu on work su ers the most from these redac ons: 94% of our respondents
report that redac on impairs their ability to inves gate rela onships between domains and actors.
Even fraudulently composed, pseudonymous, incomplete, or inaccurate data can be useful for
assigning reputa ons or crea ng correla ons, par cularly for actors that can leverage bulk queries.
While only a minority of actors overall and in our survey have very large query volumes, someinves ga on and mi ga on measures rely on this approach. For example, inves gators might want tond addi onal domains used in a phishing campaign based on email addresses or other registrant
informa on. The requirement to send access requests and wait for responses makes this approachmuch less e ec ve if not useless.
Response mes are signi cantly longer, causing harm. Time is of the essence when responding tomalware, phishing, botnets and other cybercrimes. Over 70% of respondents report that me tomi gate or respond exceeds an acceptable threat threshold due to the limita ons introduced by the
Temporary Speci ca on. Most cybercrime campaigns are the most e ec ve and lucra ve, andtherefore causing most harm, in the rst few hours or days a er they are launched, making
immediate access to WHOIS data par cularly relevant for threat inves gators, blocklist providers, andlaw enforcement. Our data indicate that the need to request access to the non-public data elements
introduces signi cant delays, usually days, in circumstances where mi ga on prior to the adop on of
the Temporary Speci ca on was accomplishable within a few hours. These delays allow malicious
ac vi es to remain ac ve and thus cause harm for longer periods of me.

ti

fi

ti

fi

ti

ti

ti

ti

ti

tt

ti

ti

ti

ti

ti

ti

ff

ti

ti

ti

ti

ti

ti

ft

ti

ff

ti

ti

ti

ti

ft

ti

ti

fi

ti

ti

ti

ti

ti

fi

ti

tt

ti

ff

ti

ti

ti

fi

ti

ti

fi

ti

fi

ti

ti

ti

ti

fi

ti

ti

fi

ti

tt

ti

fi

ti

fi

ti

ff

ff

ti

ti

ti

ti

ti

ti

ti

ti

ti

ff

ti

ti

Requests to access non-public WHOIS by legi mate inves gators for legi mate purposes remain
ine ec ve. The data indicate that the disclosure of redacted WHOIS data is inconsistent: requests areo en ignored or denied, and "revealed" data are o en not ac onable. While faked data were an issue

ft

fi

6

7
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

before the Temporary Speci ca on, increased response mes are damaging: if revealed data are
ac onable, me delays o en make them useless for some ac vi es, while fake or unac onable
responses preceded by long wait mes are par cularly problema c. Approximately 65% ofcybersecurity experts indicate they need a full response for non-public registra on data within 1 day
when addressing malware, phishing and botnet/command and controls. In contrast, the latest ICANN
policy (EPDP Phase 2 Policy) de ning a future system for the disclosure of non-public registra on data
sets a maximum response target of 10 business days. Keeping in mind that the rst few hours or daysof a campaign are the most lucra ve and thus the most damaging, e ec ve mi ga on based on
WHOIS registrant data would be essen ally impossible under these rules.

ft

ti

ti

fi

ti

ti

ti

fi

ti

ffi

ti

ti

ff

ff

ti

ti

ti

ti

ti

ti

ti

ti

fi

ti

ti

ti

ti

ti

fi

fi

ft

ti

fi

ff

ti

ti

ti

ti

To summarize, our respondents indicate that WHOIS has become an unreliable and less meaningful
source of threat intelligence. Thus, dealing with malicious domains, and in consequence crime andabuse, has become considerably harder and more me intensive since the Temporary Speci ca on
came into force. The lack of access to accurate WHOIS records inhibits the work undertaken by law
enforcement, cybersecurity professionals, and others. This has an e ect on security on the internet asa whole. To protect customers and society, quick access to registra on data is paramount, and thecurrently discussed ICANN policy measures to restore (some) access are insu cient. Three years a er
the Temporary Speci ca on implementa on, an alarming 70% of responders report that theirinves ga ons are a ected and that threats cannot be addressed in a mely manner. Only 2% of
respondents believe that the Temporary Speci ca on is working.

8
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Detailed Analysis
Introduc on
WHOIS is a query and response protocol that is widely used for querying databases that store records
concerning the registered assignees of an Internet resource. The WHOIS can be accessed via the web,
Port 43 and the RDAP protocol, which was made mandatory in 2013. WHOIS records include technicaldata like crea on, update, and expira on mes, DNSSEC informa on, and name servers for eachregistered name. Un l the Temporary Speci ca on came into force in 2018, registrant data like email
addresses, names, phone numbers, and postal addresses were usually - but not always4 - available.
Since the Temporary Speci ca on came into force based on an ICANN board decision in 2018,
registrant data have been heavily redacted. Technical data are s ll publicly available.
Cybersecurity professionals, law enforcement and others regularly use WHOIS to access data about
domain name registrants - like names, email addresses, or postal addresses - as well as technical datalike mestamps. WHOIS data. Our data indicate that cybersecurity professionals and other relevant
specialists believe that the Temporary Speci ca on is hur ng their work, with nearly 90% of
respondents repor ng that they have been nega vely a ected by the ICANN Temporary Speci ca onin their ability to address abuse.
This sec on will provide more detailed insights into the demographics of our respondents, how they
use the WHOIS, and the e ect of the Temporary Speci ca on on their inves ga ons. Where apt, thissec on will also compare the responses collected in 2021 with those from the ini al WHOIS users
survey conducted by APWG and M3AAWG in 2018.5 A er providing some insights into themethodology, this sec on will speak to demographics, WHOIS and RDAP use. Then, it will focus on theperceived e ects of the Temporary Speci ca on, and the disclosure of redacted data. This will befollowed by a sec on on our respondents' opinions and ideas regarding a future disclosure systemand complaints to ICANN compliance before concluding.

Methodology
The ques ons that comprised this survey were prepared by M3AAWG members and their Boards of
Directors members. Our survey concentrated on cybersecurity prac oners, which include personnel
responsible for maintaining protec ve services and products, personnel responsible for directly
defending the network of their employers, and academic researchers.
Some ques ons are demographic in nature but no personal data were collected. The remaining
ques ons allow responders to characterize their WHOIS usage and purpose with a focus on issues androadblocks, and to describe whether and how the implementa on of ICANN’s Temporary Speci ca on
for gTLD Registra on Data (Temporary Speci ca on) has a ected their usage. In addi on to the
4 For example, registrants could use proxy services to hide their personal data.

ti

ti

fi

fi

ti

ti

ti

ti

ti

ti

ti

ti

ti

ff

ti

ti

ff

fi

on. See: h ps://www.m3aawg.org/WhoisSurvey2018-10

ft

ti

ti

ti

ti

tt

fi

ti

fi

fi

ti

fi

ti

ti

ti

ti

fi

ff

ti

ti

ti

ti

ti

ti

ff

ti

ti

ti

ti

ti

ti

ti

5 See report 1 from 2018 for further informa

9
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ques ons visualized below, the survey collected various open-ended responses, which are discussed
in text.
Our sample size is 277 responses. We es mate that the mailing lists used to announce the survey
were delivered to a popula on of between 2500 and 4000 cybersecurity inves gators, many of whom
will work for a rela vely small set of key cybersecurity organiza ons. Some but not all of these
individuals are users of the WHOIS system who can comment on the rela vely speci c ques ons inthis survey.
It is important to note that the survey a empts to understand how inves ga ons have been a ected
since ICANN’s applica on of the European Union’s General Data Protec on Regula on by the use of
the Temporary Speci ca on. This report does not comment on GDPR per se but focuses on issues andproblems encountered by security professionals as a consequence of interpreta ons by the ICANN
board, and subsequently the contracted par es, of the GDPR requirements.

Demographics and Use of WHOIS
The respondents of the 2021 WHOIS survey predominantly iden fy as cybersecurity professionals(40%), followed by IP and Legal professionals (25%), and business professionals (14%). Smaller
respondent groups are from Law Enforcement (4%), academic research (4%), and ISP/Hos ng (9%).
This ques on also allowed for text entry and mul ple men on, likely increasing the strong
representa on of cybersecurity professionals.

ff

ti

ti

fi

ti

ti

ti

ti

ti

ti

ti

ti

ti

ti

ti

ti

ti

tt

ti

fi

ti

ti

ti

ti

fi

ti

ti

ti

ti

In comparison to the ini al WHOIS survey conducted by APWG and M3AAWG in 2018, we do see thatthe number of self-iden ed security professionals has decreased by nearly 19%, alongside a 16%

10
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

increase in respondents iden fying as legal or IP professionals. All other groups are presen ng
similarly as in the rst WHOIS users survey from 2018.

ti

ff

ti

ti

ti

fi

ti

tt

fi

ti

ti

fi

tt

WHOIS usage pa erns did change due to the Temporary Speci ca on but remain clustered in the
1-100 requests per day range. No ma er what data are requested and at what me, more than 60%
of respondents report these use rates for any of these ques ons. While usage reports were di erent
in 2018 when APWG and M3AAWG rst studied this issue, they also show that most cybersecurity
professionals request rela vely few records every day, with about 10-15% of heavy users reques ng
over 10.000 records per day.

11
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ft

ti

ti

ti

ti

fl

ti

ti

tt

ti

fi

tt

ti

The Temporary Speci ca on appears to have caused less use by non-bulk users and small shi s inusage pa erns among the high-volume consumers of WHOIS data. Non-bulk users are typicallyreques ng records for a small number of names, to pursue par es that are suspected of individual
instances of infringement, reported incidents, or sites selling counterfeits. Bulk users are usuallyinterested in macro-level pa erns across large sets of domains, for example to iden fy all of thedomains associated with a spam campaign, phishing scheme, or malware they are inves ga ng.
However, where such bulk users are concerned, it must be noted that due to the small number of
respondents (and the overall popula on of such bulk users), these uctua ons can be caused bysampling and error.

12
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Our respondents use di erent methods to gain access to WHOIS data: while WHOIS web queries areused by the majority (37%), commercial query tools and Port 43 queries (both 21%) are also rather
common, while fewer par es use internally developed tools (15%). Unsurprisingly, those who reportfrequent and high volume tend to use la er approaches. RDAP sees rela vely li le regular use at thispoint, with only 6% of respondents using RDAP regularly.

RDAP Use
The Registra on Data Access Protocol (RDAP) is a successor to the WHOIS protocol. RDAP is used tolook up registra on data. Unlike the WHOIS protocol, RDAP relies on machine readable data. The
protocol also allows transport encryp on and other security features.6 RDAP has been available since2013.
A majority of 39% of respondents who regularly use or have tried RDAP report their sa sfac on to be
neutral, i.e. similar to other methods, with 36% being sa s ed or very sa s ed, while 25% aredissa s ed. Users of RDAP report various issues, chief among them being data completeness (34%).
Rate limi ng (26%) and accuracy (22%) are also faced by many, with 18% also repor ng performanceissues. Rate limi ng and performance are related to the implementa on of RDAP speci cally, whiledata accuracy and completeness can both be general concerns due to redac on but also speci c to

fi

ti

fi

ti

ti

tt

ti

fi

ti

ti

ti

fi

ti

tt

ti

ti

ff

tf

ti

ps://datatracker.ie .org/doc/html/rfc7481

ti

ti

ti

fi

ti

tt

6h

13
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

RDAP, as respondents report that the data served by di erent services (Web, Port 43, RDAP) can
indeed be di erent.7

7 Our data are in line with the

ff

ti

fi

ff

tt

ndings of a March 2020 Interisle study, which concludes that RDAP is not technicallyreliable. See: h p://www.interisle.net/domainregistra ondata.html

14
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

E ects of the Temporary Speci ca on on WHOIS Use for Abuse Mi ga on
An overwhelming majority of 89%, i.e. close to 9 in 10 respondents, report that their use of WHOIS
has been a ected by ICANN's Temporary Speci ca on in some way. In this context, it is important tonote that depending on use case, redac ons based on the Temporary Speci ca on have more or lessof an impact. Those cybersecurity professionals who do not need access to registrant data and only(or predominantly) rely on technical data like crea on dates will face far fewer obstacles than thosetrying to iden fy actors behind DNS abuse. Unsurprisingly, we nd that those respondents who deal
with a ribu on and the iden ca on of real persons are most a ected by the changes. Of the three
relevant groups, about 60% report being strongly a ected. However, blocklist and reputa on
providers also face issues and those reques ng mi ga on are also repor ng issues, with over 60% of
either group repor ng to be a ected or strongly a ected.

ti

ti

ti

ti

ti

fi

ti

ff

ff

fi

ff

ti

ti

fi

ff

ti

ti

ti

ti

ff

tt

fi

tt

ti

ti

ti

fi

ti

fi

ff

ti

ff

ti

ti

fi

ti

ti

ff

ti

tt

ff

The redac on of records due to the Temporary Speci ca on also impacts on how regularly
respondents do use the WHOIS. While a majority s ll queries WHOIS services similarly to before theTemporary Speci ca on was introduced, there is a considerable di erence between registrant andtechnical data, with the query volume of the la er being less a ected by the redac ons. This makes
sense, as those data are not redacted and can thus be used as before. However, compared to our2018 results, weaker e ects on query volume are being reported for both technical and registrant
data, with the former less impacted than the la er.

15
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Focusing on inves ga ons and mi ga on mes, our data suggest that the e ect of the Temporary
Speci ca on on security is nega ve. Only 8% of respondents are either una ected or never relied on
now redacted data. On the other hand, 21% of respondents report that their inves ga ons area ected but not badly enough to exceed threat thresholds. For a decisive majority of 71%,
inves ga ons are a ected and their me to mi gate is too long.

ti

ti

fi

ff

ff

fi

ti

ti

ti

ti

ti

ti

ff

ti

ff

ti

fi

ti

ti

fi

ti

ff

Indeed, this gure has worsened slightly in comparison to the rst WHOIS study. Considering that the2021 survey used a di erent sample and therefore this change is not overly signi cant per se. What is

ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

signi cant and troubling, however, is that these numbers have not at all improved in over two years,
underlining that no alterna ve data sources exist that can replace what the WHOIS provided.

ti

fi

ti

ti

ti

ti

ti

ti

ff

ff

tt

ti

tt

ti

ti

ti

ti

ti

ti

fi

ff

ti

fi

When it comes to blocking and mi ga on e orts, the majority of our respondents have either foundalterna ve methods or data to conduct their ac vi es but a sizable minority has been unable to doso. Furthermore, considering previous replies, having found alterna ves to WHOIS data does notnecessarily mean that ac vi es are una ected. Alterna ves might be more cumbersome, take moreme, or cost more. When it comes to a ribu on, 89% of our respondents underline that their ability
to a ribute is impaired. This is up from 73% repor ng similarly in the rst WHOIS study. Nearly ¾ havebeen unable to nd alterna ve data sources, while more than half are deploying alterna ve, but
overall, less e ec ve, methods to a ribute.

tt

ti

16

17
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Only 2% of respondents believe that the temporary speci ca on is working as is, down from 6% who
reported that the Temporary Speci ca on "is ne as is" in the previous WHOIS study. 56% believe that
redac ng legal en es is excessive, down from 67% in the rst WHOIS study. 51% of respondents also
consider the redac on of data pertaining to non-EU ci zens or residents to be excessive, down from
65% reported in the rst itera on of this survey. Disclosure of non-public WHOIS data is reported as
an issue by 43% of respondents, and nearly 14% have complained to ICANN about inaccurate data. In
the last study 45% reported that the "reveal of non-public WHOIS is not mely nor uniformly
supported", sugges ng that a er two years, the situa on has not improved.8

8 For further

ti

ti

fi

fi

ti

ti

fi

ti

fi

ti

ti

ft

tt

fi

ti

ti

ti

ti

fi

ti

ndings, see: h ps://www.ndss-symposium.org/ndss-paper/from-whois-to-whowas-a-large-scalemeasurement-study-of-domain-registra on-privacy-under-the-gdpr/

18
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

A large number of respondents report that they cannot determine changes in the volume of malicious
ac vity (38%) or malicious domains (36%).9 Those who have that ability and visibility overwhelmingly
see an increase in malicious domains (48%) and abuse in general (49%) "as a result of theimplementa on of the Temporary Speci ca on", with only 15% or 12% seeing the volume decreaseor staying the same. This means that within the group of those with the needed data and visibility,
80% have seen online malicious ac vity increase, 19% see no change, and 0.01% have reported adecrease. Regarding the volume of malicious domains, 76% see an increase, 21% see no change, and
0.03% see a decrease. Our report cannot provide an answer if these numbers are due to changes
brought by the Temporary Speci ca on, or if we are seeing a general pa ern of increased abuse andcybercrime on the internet that is visible overall and in the domain space.

9 Con

tt

tt

ti

fi

ti

ti

fi

ti

fi

ti

dently determining these developments on a global scale is non-trivial, requiring visibility across large parts of theinternet. Not all cybersecurity professionals or actors (a empt to) do this.

19
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ti

ti

ti

tt

ti

ti

ti

ti

When it comes to detec ng online malicious ac vity overall, the picture is more varied. WHOIS use is
one of many tools cybersecurity professionals use, and progress in detec ng and mi ga ng abuse isconstantly being made. Therefore, it is unsurprising that while the majority of 41% see that the ability
to detect malicious ac vity overall has decreased, 25% report that their ability to detect has
increased. For 17% it has stayed the same, while 18% report that they cannot determine if their ability
to detect malicious ac vity has changed. However, when domains are concerned, the picture is muchclearer: more than two out of three respondents underline that their ability to detect malicious
domains has decreased, while 14% report no change and 3% report be er results. 15% answered thatthey cannot determine if their ability to detect malicious domains has changed.

20
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

The picture is even clearer when it comes to mi ga on rather than detec on. More than 80% reportthat the me to address abuse has increased. This means that cybercriminals are able to keep theira acks and campaigns online for longer, increasing exposure mes and the harms in icted on internet
users. Speci cally, 83% report that the me to address malicious domains has increased, while 84%
state that mi ga on overall has become harder. About 10% of respondents felt they could not
determine changes in either case. Only small minori es of 5% (malicious ac vity overall) and 8%(malicious domains) see be er response mes or no change, with the la er group being considerablylarger in either case. Response mes are a considerable problem when it comes to mi ga on: various
cybercriminal campaigns (like BEC) are short lived, making money during the rst day, if not hours.

Disclosure of Redacted Data
Domain registra on contact data is now widely unavailable, including large numbers of records not
linked to EU data subjects. As stated previously, recent studies by Interisle Consul ng Group10 andacademic research11 corroborate this nding, repor ng that the majority of large WHOIS data
providers redact non-EEA records.
Thus, reques ng disclosure of redacted WHOIS from Whois providers in these circumstances is now a
cri cal need for inves gators. A er more than two years since the Temporary Speci ca on came into
force, 13% of our respondents are unaware that doing so is possible, while 4% are aware of thepossibility but unaware of the process. This is a signi cant change from the previous study conducted
in 2018, when 49% reported that they were unaware of the possibility. 24% of respondents submit
10 h

p://interisle.net/ContactStudy2021.html

11 h

ti

ti

ti

fl

fi

ti

fi

ti

ti

tt

ti

ti

fi

ti

ti

ti

ti

ti

fi

ft

ti

tt

ti

ti

ti

ti

ti

fi

ti

ti

tt

ti

tt

tt

ps://www.ndss-symposium.org/ndss-paper/from-whois-to-whowas-a-large-scale-measurement-study-of-domainregistra on-privacy-under-the-gdpr/

21
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

disclosure requests up from 17% in 2018, while 18% do not. An addi onal 8% do not rely on redacted
data. Over one third of the respondents consider such requests to be overly laborious or not worth
their me, however.

In 2018, 51% reported that they are regularly being denied access to redacted data with no
explana on given. 28% were regularly told to seek a court order, a lengthy process that is unrealis cfor many an -abuse actors. About ⅓ were usually given access.
In the 2021 survey, more answer op ons were available and the picture also appears to be morevaried. Uniform responses, i.e. always being granted access or always being denied, are rather
uncommon. Instead, respondents' reports suggest that behaviors are diverging: one request will behandled di erently from the next, leading to uncertainty. However, it is clear that the majority ofrequests are not handled appropriately: the overwhelming majority of requests are notacknowledged, denied without explana on, or answered with fake or otherwise non-ac onabledata.
Our data are in line with data reported by Appdetex: For the period from September 1, 2020 throughFebruary 28, 2021, only 10% of their over 4575 disclosure requests resulted in responses that
included registrant data. They further state that "of the 182 registrars to whom we made requests,
121 registrars provided registrant data. Sixty-one registrars were completely unresponsive to ourrequests for registrant data. While the majority of registrars acknowledge requests for data, they
provide NO data."12

ti

ti

ti

ti

ps://www.appdetex.com/appdetex-whois-requestor-system-awrs-3/

ti

ti

ff

ti

ti

tt

12 h

ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

In 2018, disclosure requests were answered more quickly on average than they are being dealt with in
2021. While 11% received responses within 24 hours in 2018, that number fell to 6% in 2021. Answers
within seven days were more common in 2018 as well, with 53% receiving answers within a week.
Now, this number fell to ⅓ of requests. In consequence, the number of requests answered in morethan seven days has reached 61% up by 24.5% from 2018's 36%.

In short, the current system to disclose redacted informa on is dysfunc onal. Not only are responsemes far too long to enable mi ga on but they have, on average, increased considerably in the past
two years. Combining this with the divergent responses, and the resul ng uncertainty about what
data will be disclosed, if it is disclosed at all and disclosed in me, it is unsurprising that over one thirdof our respondents consider disclosure requests a waste of me and e ort.

ti

ff

ti

ti

ti

ti

ti

ti

ti

fi

ti

The ICANN policy de ning “reasonable access” to non-public registra on data (EPDP Phase 1
Recommenda on #18) allows up to 30 business days for a full response from the Registry or Registrar,
while the latest ICANN policy (EPDP Phase 2 Policy) envisages a future system for the disclosure of
non-public registra on data sets a maximum response target of 10 business days for requests related
to cybersecurity. An overwhelming majority of responses indicate that a 30-day wait is too long fornearly all use cases surveyed.

ti

ti

22

23
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ti

ti

ti

fi

ti

fi

ti

ti

fi

ti

ti

fi

A 10-day wait is s ll unacceptable for most respondents: overwhelming majori es of respondents inlaw enforcement, including those dealing with Child Sexual Abuse Material (CSAM), and in an phishing, an -malware, and an -botnet occupa ons report that they need responses faster. About ⅘
of spam ghters would nd 10 days acceptable as well as roughly 40% of IP enforcers. Outliers are
academic and security research, where close to 50% of respondents would nd wai ng that longacceptable, as well as IP cases where over 25% would nd wai ng for responses for 30 days to be
acceptable.

ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Our respondents report that responses are needed in less than three days for all ma ers ofcybersecurity (spam, malware, botnets) and all law enforcement ma ers to be useful. IP enforcementnds responses within 6 days to be acceptable on average, while researchers would be content with10 days.

tt

ffl

ti

tt

ti

ti

This means that the currently proposed approach for "urgent" requests is not considered workable bya majority of respondents. According to ICANN policy, urgency is limited “to circumstances that posean imminent threat to life, serious bodily injury, cri cal infrastructure (online and o ine) or child
exploita on". Nearly two thirds of the respondents believe that this restric on would limit theirability to respond to abuse and crime. Thus, according to our data, ICANN's policy proposals are notyielding a workable solu on.

ti

fi

24

25
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Disclosure Systems under ICANN considera on
At this point, future disclosure systems are being discussed at ICANN, and the idea of a paid system is
one of these approaches. Six out of ten respondents do not have the ability or resources to pay such
fees. As o en when it comes to fees, it is likely that such a system would be discriminatory; e.g., thosewith limited funding or means, and especially those from poorer regions of the world will face moreissues gaining access to data. Furthermore, government actors report to not have the authority or
ability to pay, while qualita ve responses also suggest that paying such fees might not be legallyfeasible in general. Mul ple respondents also underline that such a system is wholly inappropriate,
as it makes vic ms, taxpayers (in the case of Law Enforcement, NCerts, NCsirts, etc), or legi mateenterprises pay money to deal with abuse that could and should be dealt with and/or internalized
by contracted par es who o er the service.
Of those who indicate that they are able to pay fees, 78% would be willing to pay a yearlyaccredita on fee. Based on our data, such a fee should be below USD100 however. Furthermore, if
fees were to be paid, real- me access would be required to make it worthwhile. 61% of respondents
who are able to pay would accept ered or per volume pricing of such a system, again underliningthat such fees would have to be reasonable. Again, however, our qualita ve data underline that doing
so would be inappropriate and against common sense.

Complaints to ICANN

fi

ti

ti

ti

ti

fi

ti

ti

ti

ti

ti

ff

ti

ti

fi

ti

ti

ti

ft

ti

fi

ti

77%, close to four out of ve, responses express dissa sfac on with ICANN compliance. 41% of those
who encountered issues with disclosure requests and reported these to ICANN are "very dissa s ed"
with ICANN Compliance's response.36% who are "somewhat dissa s ed''. Only 5% report to be verysa s ed and 15% report to have had a neutral experience. Most of the responses in the "other"category refer to not being personally involved or other forms of the ques on not being applicable.

26
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

Our respondents overwhelmingly report that dealing with ICANN compliance is a lengthy andine cient process that too frequently results in no ac on. Our respondents generally believe that
ICANN Compliance not enforcing the policy and not taking ac on against its contracted par es.
Mul ple respondents underline that they stopped submi ng complaints to ICANN, as this cons tutes
a waste of their me.

Summary

ti

ti

ti

ti

ti

ti

tt

ti

ti

tt

tti

ti

ti

ti

ti

Dealing with ICANN compliance is a lengthy and ine cient process that too frequently results
in no ac on

ffi

-

tt

The system to access redacted data appears to fail regularly. Wait mes are too long, while
requests are being ignored, denied, or responded to with useless informa on

ti

-

tt

The lack of WHOIS access increases the me it takes to address various types of abuse andleads to a higher volume of abusive domains and abuse more generally. Many cybercrimes rely
on resources like domain names for a short me only, making quick response paramountwhen trying to reduce harm. While some security work does not, or only sporadically requires,
access to redacted data, those trying to a ribute malicious ac vity are impacted the most.

ti

-

ti

ti

ti

ffi

To summarize, our data paints a bleak picture of the current state of the WHOIS. Many users in law
enforcement, public safety, and cybersecurity of the WHOIS require mely and predictable access toaccurate records. This is not only true for those a ribu ng a acks but also for par es relying on bulk
data analysis to map cybercriminal infrastructures or detect pa erns of abuse. The survey responses
corroborate or are consistent with other studies that have concluded that the changes to WHOIS haveundermined cybersecurity and impeded cyber inves ga ons generally. According to the respondents,

27
ICANN GDPR and WHOIS Users Survey
A Joint Survey by M3AAWG and the APWG, June 2021

ti

ti

© 2021 Jointly copyrighted by the An -Phishing Working Group (APWG) and Messaging, Malware andMobile An -Abuse Working Group (M3AAWG)