U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

31–537 PDF 2007

ICANN AND THE WHOIS DATABASE:

PROVIDING ACCESS TO PROTECT

CONSUMERS FROM PHISHING

HEARING

BEFORE THE

SUBCOMMITTEE ON 

FINANCIAL INSTITUTIONS AND CONSUMER CREDIT

OF THE

COMMITTEE ON FINANCIAL SERVICES

U.S. HOUSE OF REPRESENTATIVES

ONE HUNDRED NINTH CONGRESS

SECOND SESSION

JULY 18, 2006

Printed for the use of the Committee on Financial Services

Serial No. 109–108

(

(II)

HOUSE COMMITTEE ON FINANCIAL SERVICES 

MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa 

RICHARD H. BAKER, Louisiana 

DEBORAH PRYCE, Ohio 

SPENCER BACHUS, Alabama 

MICHAEL N. CASTLE, Delaware 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

ROBERT W. NEY, Ohio 

SUE W. KELLY, New York, Vice Chair 

RON PAUL, Texas 

PAUL E. GILLMOR, Ohio 

JIM RYUN, Kansas 

STEVEN C. LATOURETTE, Ohio 

DONALD A. MANZULLO, Illinois 

WALTER B. JONES, JR., North Carolina 

JUDY BIGGERT, Illinois 

CHRISTOPHER SHAYS, Connecticut 

VITO FOSSELLA, New York 

GARY G. MILLER, California 

PATRICK J. TIBERI, Ohio 

MARK R. KENNEDY, Minnesota 

TOM FEENEY, Florida 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

KATHERINE HARRIS, Florida 

RICK RENZI, Arizona 

JIM GERLACH, Pennsylvania 

STEVAN PEARCE, New Mexico 

RANDY NEUGEBAUER, Texas 

TOM PRICE, Georgia 

MICHAEL G. FITZPATRICK, Pennsylvania 

GEOFF DAVIS, Kentucky 

PATRICK T. MCHENRY, North Carolina 

CAMPBELL, JOHN, California 

BARNEY FRANK, Massachusetts 

PAUL E. KANJORSKI, Pennsylvania 

MAXINE WATERS, California 

CAROLYN B. MALONEY, New York 

LUIS V. GUTIERREZ, Illinois 

NYDIA M. VELA ́ ZQUEZ, New York 

MELVIN L. WATT, North Carolina 

GARY L. ACKERMAN, New York 

DARLENE HOOLEY, Oregon 

JULIA CARSON, Indiana 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

BARBARA LEE, California 

DENNIS MOORE, Kansas 

MICHAEL E. CAPUANO, Massachusetts 

HAROLD E. FORD, JR., Tennessee 

RUBE ́ N HINOJOSA, Texas 

JOSEPH CROWLEY, New York 

WM. LACY CLAY, Missouri 

STEVE ISRAEL, New York 

CAROLYN MCCARTHY, New York 

JOE BACA, California 

JIM MATHESON, Utah 

STEPHEN F. LYNCH, Massachusetts 

BRAD MILLER, North Carolina 

DAVID SCOTT, Georgia 

ARTUR DAVIS, Alabama 

AL GREEN, Texas 

EMANUEL CLEAVER, Missouri 

MELISSA L. BEAN, Illinois 

DEBBIE WASSERMAN SCHULTZ, Florida 

GWEN MOORE, Wisconsin, 

BERNARD SANDERS, Vermont

Robert U. Foster, III, Staff Director 

(III)

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS AND CONSUMER CREDIT

SPENCER BACHUS, Alabama, Chairman

WALTER B. JONES, JR., North Carolina, 

Vice Chairman 

RICHARD H. BAKER, Louisiana 

MICHAEL N. CASTLE, Delaware 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

SUE W. KELLY, New York 

RON PAUL, Texas 

PAUL E. GILLMOR, Ohio 

JIM RYUN, Kansas 

STEVEN C. LATOURETTE, Ohio 

JUDY BIGGERT, Illinois 

VITO FOSSELLA, New York 

GARY G. MILLER, California 

PATRICK J. TIBERI, Ohio 

TOM FEENEY, Florida 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

RICK RENZI, Arizona 

STEVAN PEARCE, New Mexico 

RANDY NEUGEBAUER, Texas 

TOM PRICE, Georgia 

PATRICK T. MCHENRY, North Carolina 

MICHAEL G. OXLEY, Ohio 

BERNARD SANDERS, Vermont 

CAROLYN B. MALONEY, New York 

MELVIN L. WATT, North Carolina 

GARY L. ACKERMAN, New York 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

LUIS V. GUTIERREZ, Illinois 

DENNIS MOORE, Kansas 

PAUL E. KANJORSKI, Pennsylvania 

MAXINE WATERS, California 

DARLENE HOOLEY, Oregon 

JULIA CARSON, Indiana 

HAROLD E. FORD, JR., Tennessee 

RUBE ́ N HINOJOSA, Texas 

JOSEPH CROWLEY, New York 

STEVE ISRAEL, New York 

CAROLYN MCCARTHY, New York 

JOE BACA, California 

AL GREEN, Texas 

GWEN MOORE, Wisconsin 

WM. LACY CLAY, Missouri 

JIM MATHESON, Utah 

BARNEY FRANK, Massachusetts 

(V)

C O N T E N T S 

Page 

Hearing held on: 

July 18, 2006 ..................................................................................................... 1

Appendix: 

July 18, 2006 ..................................................................................................... 37

WITNESSES 

TUESDAY, JULY 18, 2006

Allen, Catherine, CEO, BITS/Financial Services Roundtable .............................. 17

Bohannon, Mark, General Counsel and Senior Vice President, Software and 

Information Industry Association ....................................................................... 20

Harrington, Eileen, Deputy Director, Bureau of Consumer Protection, Federal 

Trade Commission ............................................................................................... 4

Kneuer, John M.R., Acting Assistant Secretary of Commerce for Communications and Information and Administrator of National Telecommunications 

and Information Administration, U.S. Department of Commerce ................... 3

Rotenberg, Marc, Executive Director, Electronic Privacy Information Center ... 22

APPENDIX 

Prepared statements: 

Bachus, Hon. Spencer ...................................................................................... 38

Waters, Hon. Maxine ........................................................................................ 42

Allen, Catherine ................................................................................................ 46

Bohannon, Mark ............................................................................................... 69

Harrington, Eileen ............................................................................................ 82

Kneuer, John M.R. ........................................................................................... 97

Rotenberg, Marc ............................................................................................... 103

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

Statement of the American Intellectual Property Law Association ............. 115

Statement of Lynn Goodendorf ....................................................................... 117

Letter from National Association of Federal Credit Unions ......................... 121

Various letters to Internet Corporation for Assigned Names and Numbers 

(ICANN) ......................................................................................................... 123

(1)

ICANN AND THE WHOIS DATABASE: 

PROVIDING ACCESS TO PROTECT 

CONSUMERS FROM PHISHING 

Tuesday, July 18, 2006

U.S. HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS

AND CONSUMER CREDIT, 

COMMITTEE ON FINANCIAL SERVICES, 

Washington, D.C. 

The subcommittee met, pursuant to notice, at 10:07 a.m., in room 

2128, Rayburn House Office Building, Hon. Spencer Bachus [chairman of the subcommittee] presiding. 

Present: Representatives Bachus, Kelly, Gillmore, Hensarling, 

Pearce, Maloney, Moore of Kansas, Baca, and Clay. 

Chairman BACHUS. Good morning. The subcommittee will come 

to order. I have, in the interest of time, submitted a written statement for the record, but I’m going to shorten my opening statement. 

At today’s hearing, we will focus on proposals before the Internet 

Corporation for Assigned Names and Numbers, ICANN, that would 

limit the public’s access to domain name registrants’ contact information via the WHOIS database. 

This would put many long-standing and valuable uses of this 

data off limits and can make it difficult for law enforcement and 

financial institutions to identify, block, shut down, and in some 

cases, prosecute, the perpetrators of online financial fraud. 

It has always been ICANN’s policy to collect contact information 

from registrants of Internet domain names and make it available 

to the public. 

This policy helps to promote accountability online, since consumers, financial regulators, and others seeking to determine who 

or what entity is responsible for a particular Web site or other online location can obtain this data through a service called WHOIS. 

Financial institutions, which are the focus of this hearing, use 

WHOIS data to combat identity theft and account fraud, particularly as it relates to phishing. 

The financial services industry is currently battling phishing 

scams at an unprecedented level. In May 2006, the Anti-Phishing 

Working Group, which is comprised of financial institutions, ISP’s, 

and law enforcement, reported merely 12,000 phishing sites, which 

on average remained online for 5 days. These sites hijacked the 

brands of 137 companies in an attempt to fraudulently gain access 

to sensitive consumer information. 

2

Notwithstanding the critically essential and legitimate uses of 

the WHOIS database, ICANN is actively considering a policy 

change to restrict WHOIS data to those who resolve, ‘‘technical 

issues.’’ If this change is adopted, public access to most of the data 

now in the WHOIS database would be denied, perhaps including 

data as fundamental as the name of the domain name registrant. 

I am concerned such proposals limiting the use of the information for resolving technical issues will make it difficult for financial 

institutions to respond effectively to identity theft and phishing attempts. 

Timely response to these attacks and identity theft is critical to 

protect financial institutions as well as innocent customers who are 

most often unaware of their victimization. 

In many cases, the only tool financial institutions have for identifying registrants or purported registrants of domain names in a 

timely manner is via the WHOIS contact information. Such uses of 

WHOIS data would become slower, more difficult and expensive, if 

not impossible, were ICANN to adopt the policy now being proposed. 

I am hopeful that today’s hearing will enlighten and inform the 

committee as we address what could be a serious setback for attempts to combat identity theft and fraudulent financial transactions. 

Let me just say the bottom line is that continued full access to 

WHOIS data, I believe, is an important tool in the fight against 

fraudulent activity against consumers online. 

Mr. Moore, I’ll recognize you for an opening statement. 

Mr. MOORE OF KANSAS. Thank you, Mr. Chairman, for convening 

this hearing. I do not have an opening statement. I look forward 

to the statements of the witnesses. Thank you. 

Chairman BACHUS. Let me just say that I want to take this opportunity to thank you for your participation on the committee. 

You are a valuable member and discharge your duties in a very 

professional way. I very much value your advice and input. 

Mr. Hensarling? 

Mr. HENSARLING. [Off microphone] 

Chairman BACHUS. Thank you, Mr. Hensarling. I could very well 

say the same thing about you. I appreciate your participation in 

the hearing. 

Our first panel is made up of Mr. John Kneuer, Acting Assistant 

Secretary of Commerce for Communications and Information, and 

Administrator of National Telecommunications and Information 

Administration, U.S. Department of Commerce, and Ms. Eileen 

Harrington, Deputy Director, Bureau of Consumer Protection, Federal Trade Commission. 

I have reviewed both of your resumes, and they were both very 

impressive. We welcome both of you to the hearing. 

Mr. Kneuer, we will start with your testimony. 

3

STATEMENT OF JOHN M.R. KNEUER, ACTING ASSISTANT SECRETARY OF COMMERCE FOR COMMUNICATIONS AND INFORMATION AND ADMINISTRATOR OF NATIONAL TELECOMMUNICATIONS AND INFORMATION ADMINISTRATION, 

U.S. DEPARTMENT OF COMMERCE 

Mr. KNEUER. Thank you, Chairman Bachus, and members of the 

committee. I am pleased to have this opportunity to address recent 

developments related to ICANN and the WHOIS databases, and 

the role of the Department of Commerce in this critical area. 

The Department strongly supports continued access to an accurate, searchable, and publicly available WHOIS database. This 

data is critical to meeting a variety of public policy objectives, including law enforcement and consumer protection. 

We have been proactively advocating this position at the meetings of ICANN and elsewhere. 

Under the Memorandum of Understanding (MOU) between the 

Department and ICANN, ICANN has agreed to continue to assess 

the operation of the WHOIS databases and to implement measures 

to ensure secured improved accuracy of WHOIS data. 

In accordance with those specific provisions, ICANN has published three annual reports that provide information on community 

experiences with the WHOIS database’s problems reporting system. 

While ICANN has full oversight of the WHOIS databases, there 

has been some concern about ICANN’s generic name supporting organization, the GNSO, and the policy development process it has 

initiated, which among other things seeks to re-define the purpose 

of WHOIS data. 

In April 2006, the GNSO Council voted in favor of a new definition of the purpose of WHOIS data that is, ‘‘To resolve issues related to the configuration of the records associated with the domain 

name within a DNS name server.’’ 

This definition is considered by many, including the U.S. Government, as a narrow technical definition. 

We have been working within the ICANN process to address this 

concern. 

It is important to understand that this definition reflects only the 

views of the GNSO Council, and it does not currently reflect a 

change in ICANN policies or procedures. Indeed, before any change 

is contemplated, it must be submitted to the ICANN Board for 

adoption, and before the Board takes any action, other ICANN constituencies, including governments through the Government Advisory Committee, will have an opportunity to express their views 

into the process. 

Just last month in Marrakech, Morocco, at the ICANN Board 

meeting, the U.S. Government submitted a formal statement into 

the Government Advisory Committee expressing our concerns. I 

have included that statement for the committee’s record. 

Our concern is as it is now a technical definition, it would hinder 

continued access to that database for a range of legitimate, critical 

Government uses, including law enforcement, protection of intellectual property rights, and consumer protection. 

I think it is important to note that this statement that we submitted reflects not just the views of the Commerce Department but 

4

the views of the Justice Department, the views of the State Department, Homeland Security, the Federal Trade Commission, the FBI, 

the IRS, and the Patent and Trademark Office. 

In developing this position with the U.S. Government, we have 

also undertaken considerable outreach to other constituencies, including the financial services sector. 

We facilitated a meeting between U.S. agencies and the companies associated with the Financial Services Roundtable, to discuss 

their concerns, and we are continuing to work with these and other 

interested parties to make sure their views are reflected in the 

ICANN decision making process before any formal changes of policy are considered. 

We have also been working closely with other national governments to develop more formal public policy positions, so those 

views on the purpose and use of WHOIS data can also be reflected. 

Finally, I would also note that the ICANN Board passed a resolution in June that acknowledges the open dialogue between the 

Government Advisory Committee and the GNSO Council, regarding the issues covered by the WHOIS Taskforce, as well as an opportunity for public comment. We think this is a strong development, and will certainly be a continued opportunity, not just for 

governments but other interested parties to have their views expressed before ICANN makes any decision on a formal change to 

its policies regarding WHOIS. 

Again, I thank you for inviting me. I look forward to any questions you may have. 

[The prepared statement of Mr. Kneuer can be found on page 97 

of the appendix.] 

Chairman BACHUS. Thank you. 

Director Harrington? 

STATEMENT OF EILEEN HARRINGTON, DEPUTY DIRECTOR, 

BUREAU OF CONSUMER PROTECTION, FEDERAL TRADE 

COMMISSION 

Ms. HARRINGTON. Thank you, Mr. Chairman. Thank you very 

much. I am pleased to present the Federal Trade Commission’s testimony this morning, which has been entered into the record. My 

statement and any questions that I provide reflect my views and 

not necessarily those of the full Commission. 

As my colleague mentioned, ICANN recently met in Morocco to 

continue its consideration of a proposal to narrow the purpose of 

WHOIS databases, and thus limit access to the useful and important information they contain. 

Because this is an issue of great importance to law enforcers and 

consumers, Commissioner Jonathan Leibowitz of the FTC, along 

with officials from several of our consumer protection and law enforcement allies from other nations, attended the ICANN meeting 

to speak about the importance of maintaining access to WHOIS 

databases. 

In the wake of the Morocco meeting, we understand that ICANN 

is re-evaluating its earlier inclination to adopt a narrower purpose. 

The debate over access to WHOIS databases raises at least four 

important considerations. The ability of law enforcers to access information about fraudsters who use Internet Web sites, the ability 

5

of consumers to know who they are dealing with when they engage 

in e-commerce, the needs of some private sector entities, including 

financial institutions, to access WHOIS data to serve important 

public purposes, and individual privacy interests. 

In the brief time I have this morning, I want to elaborate on the 

law enforcement, consumer, and business entity interests in retaining WHOIS access. I know the important privacy concerns will be 

addressed by members of the second panel this morning. 

The FTC makes frequent use of its authority to stop unfair and 

deceptive acts or practices to challenge a variety of Internet-related 

threats, including phishing, spam, and spyware. 

In these cases, our investigators face the sometimes daunting 

task of determining the identity of scoundrels who hide behind the 

electronic shield of the Internet. Sometimes, we unmask the wrongdoers by learning their identities and whereabouts from WHOIS 

databases, but even when scamsters provide false registration information, access to WHOIS databases provides invaluable leads. 

Scammers often provide the same or similar phony information 

for multiple Web sites involving several different schemes, and by 

having access even to that inaccurate information, we are able to 

develop evidence demonstrating critical linkages that ultimately 

can help lead us to the bad guys. 

Consumers also need to know who they are doing business with, 

whether online or in the bricks and mortar world, and continued 

public access to WHOIS data provides the information that can be 

essential to consumer confidence in the online marketplace. 

If consumers do not receive the goods or services that they have 

purchased, they need to know how to reach the vendor that they 

have done business with. We really cannot afford to take away the 

consumer confidence in the marketplace that access to that information provides. 

We know that phishing and identity theft are of particular concern to the committee, and they are to the FTC as well. 

Financial institutions are watchdogs, private enforcers, and 

sometimes victims of phishing schemes. They receive early warning 

from their customers who have received bogus e-mails from 

phishers, and they can warn their customers. They can sometimes 

bring private actions to halt the misappropriation of their good 

names and reputations, and when their customers fall victims to 

phishers, their reputations suffer. 

They, too, are among the private sector entities who need continued access to WHOIS registration information for commercial Web 

sites. Without it, the risks of identity theft add harm to consumers 

and can only grow. 

WHOIS databases are one source of valuable information for the 

FTC’s work to protect U.S. consumers. There are other critically 

important tools that the FTC needs, however, to fight online fraud 

in the global marketplace. 

The FTC has previously recommended that Congress consider enacting the U.S. Safe Web Act, which passed the Senate in March 

of 2006. This act would make it easier for the FTC to gather information about Internet fraud from sources other than WHOIS databases, including our foreign law enforcement counterparts and financial institutions in the United States, and critically, we would 

6

be able to obtain information from financial institutions without 

tipping off the targets of our investigation to the existence of the 

ongoing law enforcement inquiry. 

We thank you for your attention to the FTC’s interests this 

morning and look forward to answering any questions that you 

may have. 

[The prepared statement of Ms. Harrington can be found on page 

82 of the appendix.] 

Chairman BACHUS. Thank you. Mr. Hensarling, do you have any 

questions at this time? If you would like a few minutes, I could go 

ahead. 

Mr. HENSARLING. I am happy to go now, Mr. Chairman. 

Chairman BACHUS. Okay. Thank you. 

Mr. HENSARLING. As often is the issue in the financial concerns 

of this committee, there is always a balance between our privacy 

and our security. I think this issue is re-presenting itself here 

today. 

Mr. Kneuer, if the more narrow definition of the purpose of the 

WHOIS database was adopted, what precisely is going to change 

for law enforcement? How does their job become more difficult? 

Mr. KNEUER. I think it immediately becomes much more difficult, 

as Ms. Harrington was just mentioning, when there is evidence of 

malfeasance on an Internet site, whether it is financial fraud or 

child pornography or other forms of obscenity, whether it be the 

abuse and violation of intellectual property rights, the holders of 

those property rights and law enforcement can go to the site and 

find out the information. 

If the information is unavailable, the Internet potentially becomes an immediate safe harbor for a host of illegal activity that 

can be accomplished over the Internet without any recourse for law 

enforcement to really be able to track down the bad actors in an 

efficient way. 

Mr. HENSARLING. Ms. Harrington, essentially the same question 

for you. How would the FTC be limited by this more narrow definition? 

Ms. HARRINGTON. I agree with what my colleague just said. Specifically, there are hundreds of consumer protection and law enforcement investigations going on at any time at the FTC, investigations that often are spurred directly by complaints from citizens 

and consumers about harm that they have experienced. 

The immediate impact is to make it far more difficult for us to 

find the wrongdoers, and if we cannot find them, we cannot stop 

them. Most importantly, we cannot get money back for consumers 

who have been defrauded. 

Mr. HENSARLING. If I heard your testimony correctly, you said 

something that struck me as a little bit curious, and I think I 

heard you say that even inaccurate information gained from the 

database can be useful by law enforcement. 

If I heard you correctly, could you elaborate on that? 

Ms. HARRINGTON. Let me give you a good example. In a case that 

we brought several years ago in 2002 against a fellow named John 

Zucarinni; he had registered approximately 6,000 domain names 

and most of those mimicked legitimate and popular Web sites. 

7

When consumers mistakenly entered onto his turf, their computers were hijacked, their browsers were hijacked, and they really 

lost control of their computers. It was a horrible situation that he 

caused. 

In that case, we used WHOIS to identify different domain names 

that were registered to him under different alias, and that inquiry 

enabled us to assess the extent—what turned out to be the very 

wide extent—of his bad acts. That was critical evidence in enabling 

us to go into Federal Court, get an order to immediately shut down 

all of his Web sites, and ultimately get a judgment for $1.8 million 

to redress consumers, and then we worked closely with criminal 

authorities who convicted him of criminal acts, and he served 30 

months in prison. 

That evidence from WHOIS, even though it was inaccurate, was 

critical. It told us that we weren’t dealing with some small potato 

operator, but this was a very large scam, and that evidence, in 

turn, was furnished to criminal authorities when we were finished 

with our civil case, and that helped them get a significant sentence 

against him. 

Mr. HENSARLING. You also mentioned in your testimony the U.S. 

Safe Web Act. 

Ms. HARRINGTON. Yes. 

Mr. HENSARLING. On the other side of the Capitol, one of many 

pieces of legislation written by the other body that I have not gotten around to reading yet. 

Could you elaborate somewhat on, I suppose, the tools that you 

feel the FTC is missing today to effectively combat this type of 

fraud, and what are the tools that are provided to you under this 

act that you desire? 

Ms. HARRINGTON. There are several basic abilities that it would 

give us to obtain and share information with our foreign counterparts. Right now, we cannot. 

In addition, a really important provision in U.S. Safe Web would 

enable us to go to court to get an order to shield—to protect information about a subpoena that we send to a financial institution so 

that the financial institution would not be required under other 

privacy acts to notify accountholders that they had received a subpoena from the Federal Trade Commission for information. 

Right now, very important investigations, the existence of them, 

can be revealed and sometimes is revealed by financial institutions 

to the targets. The effect that has is that when we seek in an ex 

parte proceeding an asset freeze on the assets of companies that 

are defrauding consumers, the assets are gone by the time we get 

there. 

It is really important. 

Mr. HENSARLING. I see my time has expired. Thank you. 

Chairman BACHUS. I thank the gentleman. Mr. Moore? 

Mr. MOORE OF KANSAS. Mr. Chairman, I do not have any questions. Thank you. 

Chairman BACHUS. Mrs. Maloney? 

Mrs. MALONEY. I just want to say that 19 States, including my 

home State of New York, have responded to identity theft by enacting laws that allow individuals to restrict access to their credit reports whenever they feel it is necessary to prevent identity theft. 

8

Would that not help break down or stop what you are saying is 

the number one or the highest form, that identity theft comes 

ahead of any other consumer fraud complaint, accounting for somewhere between a third and a half of all complaints filed with the 

FTC? 

Would not this approach of just allowing file freeze by consumers 

on their credit—if they want someone to see their credit, then they 

can release it. It just seems that is the way to crack down on identity theft, which is really an incredible crime. 

We have many cases come to my office. Sometimes they think 

they even make up the numbers, but by the time they find out 

about it, their credit is ruined really for the rest of their life. They 

cannot really get it replaced. It is just a very difficult thing. 

I guess my question to you is what about file freeze? Would not 

file freeze work? It stops the thieves from getting the new credit? 

Ms. HARRINGTON. We are right with you on the seriousness of 

the identity theft problem. Consumers now can put fraud alerts on 

their credit reports, which are a pretty effective hurdle to the 

issuance of new accounts in their names, and also give consumers 

pretty much real time information about who is making inquiries, 

and what is happening with their credit record. 

The freeze issue is an interesting one. I think we can argue certainly the pros, as you have very eloquently. One of the concerns 

with freezes, and when consumers ask us whether they ought to 

put a freeze on their account, we need to tell them also that what 

this means is they are not going to be able to access credit in the 

ways they often want to. 

I think it is a balancing act, really. 

Mrs. MALONEY. Any other comments? 

Mr. KNEUER. Just to stress the importance of WHOIS data for 

law enforcement; it goes beyond just consumer protection. It is critical for law enforcement in a host of areas. 

The FBI feels strongly enough about this that they send representatives to ICANN meetings around the world to ensure that 

WHOIS data is protected. 

Mrs. MALONEY. In late June, in Morocco, ICANN specifically 

stated that they would continue to provide access to law enforcement in adopting the new rules. Are you aware of this position? 

Mr. KNEUER. I think that reflects the view of the Board of 

ICANN that the views expressed by the GNSO Council were the 

views of one ICANN constituency, and that law enforcement remains a very important constituency as well, and that before they 

make any decision on a change in WHOIS policy, the views of law 

enforcement will be considered. 

Mrs. MALONEY. At this forum, they said they would provide access to law enforcement. If law enforcement has access, does that 

affect your views? It seems that solves it if law enforcement has access. 

Mr. KNEUER. I would have to see the full text of the statement, 

but I believe that is a reflection of the fact that the current WHOIS 

policy and the current WHOIS procedures of ICANN have not 

changed. 

Law enforcement gets access through the publicly available 

searchable accurate WHOIS database. They do not intend to make 

9

changes that would adversely affect the ability of law enforcement 

to continue to have access. 

Mrs. MALONEY. I think we all agree that law enforcement should 

have access. I think we can also agree that the widespread availability of personal information is clearly contributing to the problem of identity theft, which the FTC has reported as the top consumer complaint. 

Have you undertaken any studies to determine whether unrestricted access to WHOIS data might not actually contribute to the 

problem of identity theft and online fraud? 

Has the FTC looked at whether spammers are obtaining e-mail 

addresses and other contact information from the WHOIS database? 

Ms. HARRINGTON. We are very concerned about protecting the 

privacy of individuals’ personal information. That is why we have 

called for public access to registration information about commercial databases, not non-commercial databases. We strongly support 

continued public access to commercial information. 

We did a study. In Internet time, it is probably ancient at this 

point. It was done a couple of years ago. At that time, it did not 

appear to us that there was significant use being made by 

spammers of WHOIS data. 

More recently, I have read other more current work that has 

been done that suggests that may be becoming a problem, and it 

is something that I think we will be looking at again to update our 

older work. 

Mrs. MALONEY. Have you contacted your colleagues overseas that 

are operating under privacy rules? Have you spoken with your colleagues in other countries about how the FTC could investigate 

fraud and still safeguard privacy? 

Ms. HARRINGTON. Yes. People from the FTC are in very regular 

contact with our colleagues in other countries. As the private interests and laws pertain to WHOIS, it is our understanding that, for 

example, the position that we are taking on continued access to 

WHOIS registration information for commercial Web sites for the 

public is not inconsistent with those privacy laws. 

Chairman BACHUS. Thank you. Mr. Pearce? 

Mr. PEARCE. Thank you, Mr. Chairman. I suspect I would ask either one of you, how big a problem is the identity theft coming 

from the other side? I tend to fall on the side that if someone is 

seeking access to me to do business, that I ought to be able to have 

full access to information to them. 

What drives the concern on the other side? Is it based on fact or 

is it just the concern that we are going to give away information 

about Web site operators? 

I will let both of you take a stab at that. 

Chairman BACHUS. Could I ask the gentleman to yield? 

Mr. PEARCE. Sure. 

Chairman BACHUS. I will ask unanimous consent to give him an 

extra minute. 

I think what Mr. Pearce has just said, I would like to associate 

myself with his remarks. What he said is if someone has assumed 

an identity and is contacting me over the Internet and telling me 

10

they are my financial institution or American Express or the Red 

Cross. 

We have a letter from the Red Cross that after Katrina, millions 

of people were contacted, and after the tsunami, millions of people 

were contacted, and told it was the Red Cross, and were given a 

Web site address to send contributions. 

As far as privacy, I think the privacy arguments are where Mr. 

Pearce says, with the consumer, who the identity of the person he 

is dealing with, he is being told it is his bank. 

I will say this. Even the FTC, which says we are going to give 

law enforcement these rights, but we are not going to give them to 

individuals, it is the individuals who are being contacted and 

ripped off. 

When you deny the individuals the right to know who they are 

dealing with and who is coming into their computer and communicating with them and corresponding with them, I think you take 

away a right that we have had on the Internet since this database 

started. 

They are now saying they want to make changes. It is a radical 

change that I do not think the American people realize. 

A bank robber could claim that taking his fingerprints is an invasion of privacy. I would equate these people who masquerade as my 

bank or as the Red Cross are criminals. Protecting their identity 

is sort of like protecting a bank robber’s identity. 

Ms. HARRINGTON. Mr. Chairman, if I could just clarify. The Federal Trade Commission supports full access by law enforcement to 

all WHOIS database registration, including— 

Mr. PEARCE. That is not my question. My question is for me as 

a consumer. 

Chairman BACHUS. Right. I think in his question, that is maybe 

what you missed. He is saying as far as privacy and as far as somebody communicating with me, if they are coming on and telling me 

they are somebody and I am opening up my database and I am giving them information, not only law enforcement, but this is an important tool that consumers have had. 

I hope that the FTC, in trying to compromise with WHOIS and 

ICANN, does not give away important rights of consumers. 

What Mr. Pearce is saying, when he deals with somebody over 

the Internet, they are asking him for sensitive information, and 

representing themselves as his bank or something. 

The fact that the FBI or the local police have a right to that information— 

Ms. HARRINGTON. We agree. All of those examples that you have 

given would fall in the category of commercial Web sites. If someone is posing as your bank, someone is trying to collect money from 

you, that is information that we believe that you as a consumer, 

registration information, should have access to. 

We draw a distinction between commercial and non-commercial 

Web sites. On the non-commercial side, some have suggested a 

tiered access system. There is a lot of debate going on at ICANN 

about that. 

The concern is that if you as an individual have set up your own 

personal Web site for some non-commercial purpose, if you are a 

dissident living in some totalitarian regime and have put informaVerDate 0ct 09 2002 16:36 Feb 01, 2007 Jkt 031537 PO 00000 Frm 00016 Fmt 6633 Sfmt 6633 F:\DOCS\31537.TXT HFIN PsN: TERRIE
11

tion on the Web site that could subject you to very serious consequences, should your personal information be widely searchable 

in a WHOIS database by anyone or not? 

That is where the personal— 

Mr. PEARCE. That was my question. What is the whole question 

of personal privacy? If my granddaughter is on a Web site that begins to explore pieces of conversation with her that I would rather 

not have occur, that is not a commercial transaction, and yet I 

think, for myself, I would sit here in full transparency, there ought 

to be a click on every communication that allows you to go straight 

to and find out who it is that really is operating. 

I am wondering what drives the debate? You are talking, Ms. 

Harrington, about the debate being driven by privacy concerns. 

You are out here in a full operation requesting information from 

somebody, commercial or non-commercial, and I just believe that 

transparency is the better rule. Let’s open it all up. Let’s shine the 

light in there. I do not think there ought to be protections of any 

kind if you are out on the Web trying to get access to my house, 

my business, or my granddaughter. 

I do not understand that. Could you help me understand the 

legal concerns of privacy? 

Mr. KNEUER. If I might, sir. The U.S. Government’s submission 

to the Government Advisory Committee of ICANN makes no distinction between commercial and non-commercial addresses. 

It is the view of the U.S. Government, like I said, the views of 

the State Department, the Justice Department, Homeland Security, 

the Commerce Department, the Patent and Trademark Office, the 

IRS, and the FBI, that there should be no distinction between the 

two of these, and for precisely the reasons you are talking about. 

I think Ms. Harrington’s views from a commercial standpoint, 

the equities that the FTC is concerned with, is consumer protection 

in commercial situations. There are other significant Government 

equities that have broader concerns, the ones you mentioned. 

If a Web site is up that is not necessarily doing commercial 

transactions, it can be violating laws in a variety of different ways. 

It could be abusing intellectual property rights. There could be 

child pornography or other obscenity, where there is recourse to the 

laws. 

We do not make that distinction. We believe that the WHOIS 

database ought to be publicly available, accurate and searchable for 

all domain registrations. 

Mr. PEARCE. Ms. Harrington, do you have any other ideas or 

comments on that? What would you say to a link on every communication on a Web site that takes you right to that? 

Ms. HARRINGTON. To the registration? 

Mr. PEARCE. To the Web site, let you know who it is that has 

set this particular site up. 

My wife serves on a bank board. Just recently people were intercepting communications intended for the bank, representing themselves as the bank. Actually, transactions were occurring. 

If that e-mail had access to whoever is originating, the consumer 

could click on it, take a look and say that is not my bank, this is 

somebody in Indonesia or somewhere. 

12

Ms. HARRINGTON. I have not thought about that particular mechanism, Congressman. You raise indirectly another really interesting challenge in this whole area, and that is accuracy, which is 

something that the U.S. Government, including the Federal Trade 

Commission, has consistently raised as a concern in connection 

with WHOIS databases. 

We want to make sure that there is access to the registration information. We also want to make sure domain registrars do everything they can to ensure the accuracy of that information. 

Our experience is oftentimes people who are up to no good include in their no-good activity the providing of false information. 

Mr. PEARCE. Thank you, Mr. Chairman. 

Chairman BACHUS. Thank you. I appreciate your remarks. 

Congresswoman Kelly has been very active on this issue. I have 

been going back and forth. Mr. Moore? 

Ms. KELLY. Are you in the first or second round of questions? 

Chairman BACHUS. Actually, he did not ask questions. Go ahead, 

Ms. Kelly. You have been a leader on this issue. 

Ms. KELLY. It certainly is the floor for Mr. Moore. 

Chairman BACHUS. He is fine. 

Ms. KELLY. Thank you. I think the public’s concern on a lot of 

this is the fact that on Web sites, when you log on to certain Web 

sites, there are things there that are down right errors. There is 

misrepresentation. 

Apparently, you are supposed to look at who has what Web site, 

if I understand. Is that correct? 

Once you do that informational piece to find out who has established a Web site, do you have any further duty to make sure that 

what is on that Web site is accurate? 

Mr. KNEUER. On the WHOIS database, to test the accuracy of 

that? 

Ms. KELLY. Right. 

Mr. KNEUER. The registrars are supposed to ensure the accuracy 

of it. Given the millions and millions of Web sites, I think it is one 

of the reasons it is important that it not just be law enforcement 

but consumers who have access, this really is a collaborative effort, 

whether it be law enforcement or a consumer who does the initial 

inquiry, if they see information that appears to be inaccurate or 

based on that information, they do a follow up and find it leads to 

a dead end, they can then report that problem, and the registrars 

can correct the problem or eliminate the Web page. 

Ms. KELLY. How would a broad consumer use change that? 

Mr. KNEUER. I think broad consumer use is what helps that process along. I think eliminating that broad consumer use makes it 

much more difficult for the registrars and others to maintain the 

accuracy of the database. 

There are limited resources for the ability to spot check and go 

through millions and millions of sites. 

Having the opportunity for consumers and for others to exercise 

their rights to get into the WHOIS database to follow up on that 

information is much more likely to uncover inaccuracies and uncover illegal or otherwise inappropriate activity. 

Ms. KELLY. Getting into that database, if I were a consumer, 

could I change information on the database at my will? 

13

Mr. KNEUER. No. Only the registrant can change the information 

by submitting it to the registrars, and the registrars maintain the 

database. 

If you go to one of the registrars and clock on WHOIS and you 

put in a field, I want to know who owns what site, that pulls up—

you do not then have rights to edit that field. It is a read-only file. 

Ms. KELLY. Do you think that there is an adequate—that we 

have maximum data and you have so many different Web sites, 

what do you think is the best thing that you can do to make sure 

you get the maximum data security and consumer protection without harming the people who are likely to be using those sites, especially small businesses? That is one of my chief worries here. They 

do use the Web sites. 

Mr. KNEUER. I think transparency and consumer education. 

When I talk about consumers, I am not just talking about individual consumers, but businesses as consumers. As long as there 

is transparency in the process, more people are aware they have 

this tool at their disposal. 

If you are a small business and you are engaging in business online, you are trying to use the power of the Internet to leverage 

your small business nationally or even globally and in doing that, 

you are looking to find business partners, the more ability for those 

small businesses to access the WHOIS data to find out more about 

the potential partners that they may be looking at, too, I think the 

better for it. 

To the extent that the WHOIS data, as I said, is itself transparent, when you register a domain name, it is very clear that part 

of the deal is you are going to publish this information to the 

world. If you want to publish your Web site to the world, you are 

going to publish this information to the world. 

It is a deal that you make, and it is transparent. This information is not being publicized without the registrant’s understanding 

that it is being publicized. 

Ms. KELLY. I’m going back to what I asked before. If the registrar registers the site, does the registrar ever go back and check 

to make sure that site has not been altered and changed in some 

way? 

The reason I am asking this is I logged onto a Web site which 

then automatically put me into a second Web site. This was a Web 

site that is used by private detectives and people like that. People 

can also get on the site, but when you pay through the second site 

to get more information, but logging onto the registered site took 

me immediately to a second site. That second site, when I was 

happy to pay, because I wanted to see what was on it, had misinformation. 

That is what concerns me. The transparency is great. Unchecked 

transparency can possibly lead to abuse. I am wondering if there 

is any kind of a screen there that can stop that. 

Mr. KNEUER. As far as the ability of a registrant to submit their 

WHOIS data and then to change it after the fact, I would have to 

get back to you. I believe those updates are made by the registrars, 

that you have to submit that to the registrar and have them make 

the change. 

14

I will get back to you for the record on whether or not I am correct in my understanding of the way that operates. 

As far as successive sites, when you get into a site that sort of 

scrolls down to other sites, you should still have the actual address 

of the site, even when you default into and you are redirected, the 

address should be there, should be visible and transparent to you, 

and then you can do a WHOIS search on that again. 

I certainly concede that is sort of the kind of thing that presents 

a challenge, not just to consumers, but even sophisticated users. It 

is not real clear sometimes unless you are really ever vigilant. 

I concede that is a problem. 

Ms. KELLY. Thank you. 

Chairman BACHUS. Thank you. Let me first say, Mr. Kneuer, I 

would like to associate myself with your remarks in the dialogue. 

I think both of you recognized that there is a real key role for the 

consumers here. 

It is a role they are playing today. The status quo today is transparency. What this proposal would do is take rights away from consumers, everyone that uses the Internet. 

There are many legitimate rights that consumers have now, essential rights, to protect themselves, that if this proposal in my 

mind goes through, then yes, the commercial firms, your bank, they 

may have rights, and law enforcement may have rights, but the 

first line of defense, and Mr. Kneuer, you said this, the first line 

of defense ought to be the consumer. 

We say the consumers are responsible for protecting their own 

information. If we deny them a right that they have presently, this 

right to know the domain name and the identity, then we are denying them the ability to protect themselves. 

There are other things in your testimony that you talked about, 

Ms. Harrington. I was trying to find it here. You talk about how 

consumers now have the ability to resolve problems with online 

merchants directly through the use of WHOIS databases. 

They find out who it is and they resolve their problem. Government does not have to deal with it. 

You are talking about consumers and legitimate businesses, that 

if this changes, they are going to come to you and say we do not 

know who these people are, we have a complaint, you need to find 

out who they are. You are going to throw a whole lot more work 

on the Government and individuals, which they are doing now. 

You would throw a whole lot more work—I would just like you 

all to respond to that. I think you put the burden on the Government and law enforcement, the banks and the financial institutions, that consumers could legitimately say if this goes through, 

I no longer have the ability to resolve this myself. 

Ms. HARRINGTON. Mr. Chairman, I think that is right, although 

I would hasten to add that we are here to serve consumers. We 

welcome their complaints. We hope they do not have problems, but 

when they do, we are in the business of serving them. 

I think an equal problem here is that consumers will lose confidence in this marketplace if they do not know who they are dealing with. I think that would have very serious implications. 

Chairman BACHUS. In fact, we had talked about that on many 

occasions. Our policy, if they lose—when we talk about identity 

15

theft, we said it is very important for us and the FTC and law enforcement to act against identity theft because it diminishes the 

use of the Internet. It diminishes people’s confidence in the Internet. 

To me, the more I look at this, the more I see it as a serious 

threat to confidence on the Internet, to know who you are dealing 

with. 

Mr. Kneuer, what is the relationship between the Department of 

Commerce and ICANN? It is my understanding within the ICANN 

organization, there is a weighted voting by different interested parties. 

Could you describe how that works and how it impacts the process? Does that weighted voting bias the process toward certain 

views? 

Mr. KNEUER. The relationship between the Department and 

ICANN is memorialized in this Memorandum of Understanding. 

ICANN is the private sector entity that was established to take 

over the management of the domain name system. It used to be a 

U.S. Government function, and a long history of the Internet going 

back to DARPA and its development as an U.S. Government network. 

The MOU is intended as a transitional document for us to provide some oversight over ICANN as they get themselves stood up 

and become a sustainable secure organization. 

As far as the weighted voting goes, that is not in the decisionmaking of ICANN itself. These are not final decisions of the Board 

of ICANN. These are in some of the subgroups of ICANN, the 

GNSO being one of them. 

When the GNSO was established, they determined that weighted 

voting to reflect different constituencies in that subset would be appropriate, so there is weighted voting in that Council, in that organization. 

That does not carry over into the final decisionmaking of ICANN. 

The Board of ICANN is elected and representative, and there are 

not weighted votes in final decisions of ICANN. It is in this subconstituency, this GNSO Council. 

Chairman BACHUS. You mentioned GNSO. That states that the, 

‘‘Current definition of WHOIS data is related to the service that 

provides public access to some or all of the data that is collected, 

and is not a definition of the purpose of the data itself.’’ 

That seems to me like a definition that believes the WHOIS 

database service, that their only purpose is maintaining the Web 

site, which there is another purpose, legitimate purpose; is there 

not? 

Mr. KNEUER. Absolutely. ICANN by its definition, by its by-laws, 

is supposed to be a consensus driven organization that takes lots 

of different views. That is one view of the GNSO. 

It is clear the governments feel that there are different uses and 

different purposes for the WHOIS data. Consumers may feel very 

differently. 

The reason ICANN is organized the way it is, is so there is the 

ability to get the views of all of these different constituencies and 

all these different equities are represented and weighed going into 

it. 

16

While one subgroup may have one view, that is not reflective of 

the overall Internet community as a whole, and it certainly does 

not reflect the U.S. Government’s position or the views of many 

other governments, as have been reflected in the Government Advisory Committee meetings. 

I think you will see much more of that, of the view that the purpose of the data should not be decided by any one group. The important thing is that the data is available, and you can make what 

use of it that you will. 

Chairman BACHUS. I agree. I think ICANN actually ought to consider ways to protect the consumer and ways to protect an individual’s privacy. 

I will just say this another way. It is almost as if there are all 

these essential legitimate uses that consumers are taking of the 

WHOIS data, and it is all of a sudden that ICANN wants to sort 

of put the genie back in the bottle and stop a lot of these, what 

we take for granted every day, as our legitimate uses of that data 

by consumers. 

Mr. KNEUER. I think that gets back to not having a narrowed 

definition of the purpose. For some varieties of malfeasance, whether it is consumer protections, the fraud, we want to make it stop 

and making it stop may be—you want to recover assets to the extent you can, but making it stop is the important thing. That is not 

happening anymore. 

Other areas of law enforcement have much different concerns, 

whether it is cyber security and cyber terrorism, or child pornography. You do not want to make it stop. You want to catch those 

guys. 

The more difficult it is for bad actors to hide behind inaccurate 

WHOIS data, the harder it is for them to continue to commit 

crimes on the Internet, the easier it is for law enforcement to pursue them. 

We need to reflect the broad interests and equities of the community as a whole and not be too focused on one constituency or another constituency. 

Chairman BACHUS. I agree. In fact, it is almost, ‘‘the public be 

damned.’’ This is a better way, a more efficient way, to manage the 

system. If anything, the people who benefit are the people who are 

committing the crimes. 

Mr. KNEUER. Just to be fair as well to ICANN, the proposal from 

the GNSO has been submitted, but as the ICANN Board stated in 

Marrakech, and I would refer back to my testimony for the exact 

quoted language, they do not intend to make any decision to 

change the current status quo policy without having the opportunity of governments to give their counter view to the GNSO’s 

narrow definition, without having the opportunity for the public to 

make their comments. 

The status quo today still exists. There has been no change in 

the policies or the procedures, and there will not be any changes 

until a broad cross section of interested stakeholders have an opportunity to make their views known. 

Chairman BACHUS. I have talked to Secretary Gutierrez about 

this issue. A lot of people think it is just an arcane issue dealing 

with a technical issue. 

17

In fact, it has very serious implications and consequences for everyone who uses the Internet. It would change the status quo. 

Although my words may seem sort of harsh, if consumers are denied some of these rights, the consequences on them are going to 

be harsher still. 

I will close by just asking is the Commerce Department, and is 

the FTC, committed to watching out for the best interests of consumers, and are they committed to preserving consumers’ present 

rights to the WHOIS data? 

Mr. KNEUER. Yes. 

Chairman BACHUS. Ms. Harrington? 

Ms. HARRINGTON. Absolutely. 

Chairman BACHUS. Thank you. I think that is very important. I 

very much appreciate that. 

Does anyone want to ask any other questions of this panel? 

Ms. KELLY. Mr. Chairman, I just would ask the Commerce Department to work closely with ICANN, to try to make sure the information is absolutely as accurate as it possibly can be. 

Chairman BACHUS. Thank you. 

Mr. KNEUER. We will certainly do that. 

Chairman BACHUS. That is a good point, Ms. Kelly. 

Thank you very much. The first panel is discharged. 

Ms. HARRINGTON. Thank you, Mr. Chairman. 

Chairman BACHUS. Good morning to our second panel. Our second panel is made up of Ms. Catherine Allen, CEO of BITS/Financial Services Roundtable. We welcome you. 

Also, Mr. Mark Bohannon, general counsel and senior vice president, Software and Information Industry Association, SIIA, and 

Mr. Marc Rotenberg, executive director, Electronic Privacy Information Center, EPIC. 

Ms. Allen, we will start with your testimony. 

STATEMENT OF CATHERINE ALLEN, CEO, BITS/FINANCIAL 

SERVICES ROUNDTABLE 

Ms. ALLEN. Thank you very much. Good afternoon, Chairman 

Bachus, and members of the subcommittee. 

My name is Catherine Allen, and I am the chief executive officer 

of BITS, part of the Financial Services Roundtable. 

I also want to acknowledge Congressman Pearce from my home 

State of New Mexico, where there are a few of us around. 

I am pleased to appear before you today on behalf of BITS, the 

Financial Services Roundtable, and our member financial institutions, with respect to the topic of a proposed change to the WHOIS 

database within the ICANN. 

Thank you, Chairman Bachus, for meeting with executives from 

Am South representing BITS earlier this year on this issue and 

taking such an avid interest in it. 

BITS is a non-profit industry consortium of 100 of the largest financial institutions in the United States. We are the non-lobbying 

division of the Financial Services Roundtable, and work as a strategic brain trust to provide intellectual capital and address emerging issues around operations and technology for the industry. 

Working groups share successful strategies and best practices for 

managing risks, reducing fraud, managing IT service provider relaVerDate 0ct 09 2002 16:36 Feb 01, 2007 Jkt 031537 PO 00000 Frm 00023 Fmt 6633 Sfmt 6633 F:\DOCS\31537.TXT HFIN PsN: TERRIE
18

tionships, and managing risks in the changing payments’ environment, and work with the heads of security, heads of fraud, and 

heads of payment in these organizations. 

Financial institutions have always been a favorite target for perpetrators of fraud. Institutions have long answered this challenge 

with reliable business controls, advanced technology, information 

sharing, and cooperative efforts with the Government and law enforcement agencies. 

With the growth of the Internet and its fundamental role as the 

foundation of electronic commerce, including financial services, the 

role of ICANN and its significance has grown exponentially. 

It is therefore with great concern that our member institutions 

have become aware of the proposed change in the type of information to be collected and maintained in the ICANN WHOIS database. 

The WHOIS database, just as a background, is very important in 

that it has three types of information, and all three of these types 

of information are used when we work with law enforcement to 

track down fraud. 

The registrant contract, which includes those registered for domain names, IP addresses, who owns the name, who paid for the 

name, and the owner’s name and address. Secondly, the administrative contact who you call for billing information. Again, their 

name, phone number, address, and the technical contact who may 

or may not be associated with that Web site, who specifies if there 

is a problem with the Web site and does the technical attributes. 

As part of their efforts to combat fraud, financial institutions are 

constantly watching for incidences of domain name fraud. Sometimes we call it cyber squatting or typo squatting. These are people 

that will create and register domain names that are very similar 

to financial institutions, but they might have one slight change to 

them. In some cases, a changed vowel or a changed name. In any 

sense, they look very familiar to the consumer and they think they 

are talking to an actual legitimate financial services company. 

In one case, one of our financial institutions found a Web site 

with a name that was identical to their own, except for the one 

vowel change. Going to the home page, they saw that it was not 

only an example of theft of intellectual property, but of course, they 

were trying to commit fraud against consumers. 

Using the registrant information from WHOIS, the financial institution in this instance was able to contact the Web site owner 

and send a cease and desist letter to have the site removed. 

One of the other key uses for the WHOIS database is for shutting down phishing sites. As part of investigating phishing 

incidences, financial institutions sometimes discover that a legitimate Web site has been taken over by phishers, without the Web 

site owner’s knowledge. 

With cooperation of the WHOIS technical contact and the registrant’s contact, and the hosting site, they were able to shut down 

a phishing site. Again, they needed at least two of the three kinds 

of information. 

In early 2006, a financial institution discovered it was being 

phished from a site in Taiwan. Efforts to have the Web site shut 

down using the technical contact information was unsuccessful. In 

19

fact, it took the full WHOIS information provided to the U.S. Secret 

Service and the Taiwanese police, who made local contact with the 

Web site owner and the ISP and got the phishing site shut down. 

These are just a few examples of the reasons that financial institutions and others who are combating fraud find the WHOIS database so important as a tool for fighting fraud and protecting the 

public. 

All of the WHOIS information is currently freely available to 

anyone with Internet access, and while it may be prudent in some 

cases to restrict some access, we do believe it needs to have what 

we call permissible access by all players—law enforcement, businesses, or people who have legitimate reason to try to track down 

for fraudulent reasons who owns this database. 

It is a matter of public confidence. We agree with the discussion 

that happened with the previous panel, that the more transparency 

there is, the better it is for all of us, including consumer access to 

this information. 

As you are aware, on January 18th, the ICANN WHOIS Task 

Force report contained two opposing formulations for the purpose 

of WHOIS. Under formulation one, which is severely restrictive 

and just a technical issues’ configuration, we believe adoption of 

that would make it more difficult and time consuming for financial 

institutions to identify and stop domain based scams and identity 

theft and account fraud. It will also hinder our ability to respond 

to identity theft and phishing. Timely response to phishing attacks 

and identity theft is critical to protect customers, financial institutions, and innocent consumers. 

In most instances, many unsuspecting consumers are contacted 

by a financial institution to learn that they may have been a victim 

of identity theft and they may not have known it because a Web 

site had been set up in their name, which turns out to be a fraudulent Web site. 

Giving the consumers the opportunity to remedy the effects of 

the identity theft sooner rather than later is critical, not only to 

law enforcement, to the financial institution, but most importantly, 

to the consumer. 

Most innocent victims have been, and continue to be, extremely 

helpful to financial institutions in taking down or transferring 

these domain names to the financial institution that is the target 

or potential target of a phishing attack. 

Financial institutions need the WHOIS information to address 

all of the forms of fraud noted above. 

For these reasons, we have urged ICANN to adopt formulation 

two. Formulation two would provide financial institutions, law enforcement and others open access, continued open access, to the information they need to respond to identity theft and account fraud. 

It is our understanding that during the ICANN meetings in Marrakech, the decision to choose between formulations one and two 

was postponed for additional deliberation. 

On behalf of BITS and our financial industry, recognizing that 

the ICANN Board has the ultimate decision, we encourage Congress to strongly support the adoption of formulation two. Thank 

you for the opportunity to testify before you, and I will be happy 

to answer any questions. 

20

[The prepared statement of Ms. Allen can be found on page 46 

of the appendix.] 

Chairman BACHUS. Thank you, Ms. Allen. 

Mr. Bohannon? 

STATEMENT OF MARK BOHANNON, GENERAL COUNSEL AND 

SENIOR VICE PRESIDENT, SOFTWARE AND INFORMATION 

INDUSTRY ASSOCIATION 

Mr. BOHANNON. Mr. Chairman, members of the committee, I appreciate the opportunity to appear before you today and testify on 

ICANN and the WHOIS database. I particularly want to thank 

you, Mr. Chairman, for your opening statement, which was very 

strong and very clear about the importance of this issue, and we 

want to continue to work with you and the committee to pursue the 

right policy here. 

My organization has been engaged in the issue of WHOIS policy 

for many years, primarily through our involvement in the Coalition 

for Online Accountability, which includes most of the major organizations and members of the copyright community. 

We see firsthand how the WHOIS database is a key tool to combat copyright and trademark infringement, cyber squatting, fight 

phishing attacks, as well as combat the pernicious effects of 

spyware and illegal downloads. 

In my prepared remarks, I document how I believe all Internet 

users, consumers, as well as leading groups such as TRUSTe and 

the Center for Democracy and Technology, who are committed to 

promoting privacy network security, depend on the WHOIS database, and I would ask that it be submitted for the record. 

I really want to focus on two issues in my verbal comments. One 

is I want to talk about why the proposed policy is misguided, and 

secondly, why we have to ramp up and step up efforts to make 

WHOIS reliable and accessible. 

When SIIA and other members of the intellectual property community heard about the move to restrict access in the purposes of 

WHOIS data, we were obviously greatly concerned. 

The formulation that was put forward, so-called formulation one, 

it is important to understand that it represents only a very, very 

small proportion of the current critical public interest uses of 

WHOIS data. 

In fact, virtually all the ways that WHOIS is now used to protect 

intellectual property rights, investigate cyber crimes, fight fraud 

and phishing and protect privacy online would in our view fall outside the scope of this definition. 

When the discussion became more broad, it was becoming quite 

apparent that the change would be devastating to businesses, consumers, and everyone who uses the Internet in a positive way. 

It galvanized many concerns about ICANN’s stewardship of the 

WHOIS system. At the early stage, more than 50 organizations, 

coalitions, entities, and individuals from over 12 different countries 

filed comments with ICANN arguing against the narrow formulation of the purpose of WHOIS, and as I believe you, Mr. Chairman, 

pointed out, even the American Red Cross pointed out that it would 

have definitely have restricted their ability to go after the frauduVerDate 0ct 09 2002 16:36 Feb 01, 2007 Jkt 031537 PO 00000 Frm 00026 Fmt 6633 Sfmt 6633 F:\DOCS\31537.TXT HFIN PsN: TERRIE
21

lent Web sites that were trying to take money from citizens all in 

the name of helping those who were victims of Hurricane Katrina. 

After the Council vote in April, I would say an even more remarkable broader sector of business and other interests became 

quite concerned. 

I would like to submit for the record letters from diverse sectors, 

such as financial services, and hotel/lodging, as well as intellectual 

property and anti-counterfeiting groups. 

Chairman BACHUS. Without objection, that will be allowed. 

Mr. BOHANNON. Finally, Mr. Chairman, I wanted to directly acknowledge and thank you for your leadership. Your letter to Secretary Gutierrez earlier this year provided very important impetus 

and urgency to the development of a strong U.S. Government position going into the ICANN meeting in Marrakech. We want to 

thank you for that. 

We also want to take the opportunity to acknowledge the position 

that was presented by the U.S. Government delegation at the 

ICANN meeting. Fortunately, their view was reinforced by other 

governments that were in attendance, including the consumer protection authority in The Netherlands, as well as the representative 

from the Japanese Ministry of Information and Communications. 

While most of our discussion has really focused on public access 

and why that is critical, we also want to make it clear that it is 

essential, absolutely essential, to dramatically improve the accuracy and reliability of WHOIS data. 

The situation and the problem has been very well documented. 

In a study released by the Government Accountability Office last 

December, they estimated that the WHOIS data on over 5 million 

domain names in .com, .net, and .org, is either obviously false, incomplete, or simply could not be found. 

This high level of inaccuracy, in our view, significantly undermines the purpose, the role, and the value of WHOIS to consumers, 

to businesses, and to law enforcement. 

The GAO study also clearly shows that the system that ICANN 

put in place to address the problem simply is not working. GAO investigators submitted complaints about blatantly false data to the 

system, but after more than a month, the contact information had 

been corrected in only one quarter of the cases. At least half of the 

time, the phony data remained unchanged and the domain name 

remained as active and accessible as before the complaint was 

made. 

This hearing comes at a critical juncture in the relationship, in 

our view, between the U.S. Government and ICANN. As you know 

and as we discussed, the MOU between them ends on September 

30th. 

When the Memorandum was renewed 3 years ago, ICANN 

pledged to take steps to improve the accuracy of WHOIS data. It 

also promised to put in place an enhanced system for ensuring domain name registrars and registries live up to their contractual obligations. That is making the WHOIS data publicly accessible and 

dealing directly with complaints about inaccurate data. 

We understand that ICANN believes that it has fulfilled these 

pledges under the MOU. Candidly, we do not agree with this assessment. While we believe ICANN has taken some steps to imVerDate 0ct 09 2002 16:36 Feb 01, 2007 Jkt 031537 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 F:\DOCS\31537.TXT HFIN PsN: TERRIE
22

prove the system for receiving and processing complaints, ICANN’s 

own reports show that the system does not work as it was designed 

to do. 

ICANN has consistently shied away from taking on the more difficult challenge of requiring registrars and registries to take 

proactive steps, any steps, in our view, to actually verify the information they are collecting to ensure that it is accurate and reliable. 

Mr. Chairman, as we look forward and ahead to working with 

you on how best to ensure that ICANN does not set off down a 

path that would lead to a reversal or substantial erosion of the 

long-standing policy regarding making registrant contact data accessible in real time without charge via the Web and without substantial restrictions on use, we thank you for this hearing. 

We think that the policies are in our national interest, in the interest of consumers and businesses worldwide, and in the interest 

of promoting the healthy growth of the Internet as a safe place to 

work, to play, and to do business. 

[The prepared statement of Mr. Bohannon can be found on page 

69 of the appendix.] 

Chairman BACHUS. Thank you. 

Mr. Rotenberg? 

STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, 

ELECTRONIC PRIVACY INFORMATION CENTER 

Mr. ROTENBERG. Thank you very much, Mr. Chairman. I appreciate the opportunity to testify today. I ask that my complete statement be entered into the record. I will summarize for you the key 

points. 

Chairman BACHUS. Without objection, all of the panelists’ full 

written testimony will be entered into the record. 

Mr. ROTENBERG. Thank you, Mr. Chairman. 

My organization, the Electronic Privacy Information Center, 

EPIC, has been involved in the WHOIS debate pretty much since 

the beginning. I, myself, am also the former chairman of the Public 

Interests Registry, which manages the .org domain. We developed, 

in fact, one of the best WHOIS practices, we believe, of any of the 

domains operating on the Internet. 

I am here this morning to present a view on behalf of consumer 

organizations and non-commercial users of the Internet, which is 

very much in support of the effort that ICANN is currently making 

to protect the privacy of Internet users. 

I need to be clear about this point. I believe there was some confusion on the first panel as to what the consumer interest is regarding unrestricted and unaccountable access to the WHOIS database. 

Under the current ICANN policy for WHOIS, anybody who has 

a connection to the Internet can go to this database and get the 

personal contact information of anyone operating a Web site, a political organization, an arts organization, a human rights organization, a group of hobbyists who have set up a Web site possibly in 

their living room or their basement—any person can get access to 

that information and use it for any purpose. 

That means that under the current ICANN policy, which the 

other panelists appear to favor, the person who is committed to 

23

fraud and spam and phishing has the exact same right of access 

as the law enforcement agent or the consumer protection official 

who is investigating crime. 

This is clearly not a sensible approach to protecting the interests 

of Internet users. 

The problem is so serious, in fact, that as the other panelists 

have noted, identity theft has become the number one consumer 

complaint in the United States. 

What did the Federal Trade Commission urge consumers to do 

to protect themselves against this crime? They said be very careful 

about putting your personal information on the Internet, because 

it is your personal information, your home address, your telephone 

number, and your e-mail address, that makes it possible for others 

to commit types of fraud and crime against you. 

ICANN, taking into account the growing concern about identity 

theft, while recognizing that law enforcement will need access to 

investigate crime, has appropriately decided to revise their policies 

for access to the WHOIS database. 

The chairman of ICANN, Mr. Twomey, and the various interest 

groups participating in this process, have not objected to law enforcement access. That is not what the debate is about. 

The debate is about whether there should be appropriate safeguards to ensure that the millions of individuals who provide information when they register an Internet domain will not find that 

their personal information is being improperly disclosed to others. 

Just to make very clear how serious the link is between the unrestricted access to WHOIS data and the problem of phishing, 

which I gather to be a central concern of the hearing this morning, 

the top phishing investigation and prosecution that was pursued in 

the United Kingdom was against an individual who took advantage 

of access to e-mail addresses that he could obtain from the WHOIS 

Directory to commit the type of financial crime that the other witnesses this morning are understandably concerned about. 

It is our view that a sensible and effective approach to the use 

of WHOIS data is one that will allow people who register Internet 

domain names to protect the privacy of their personal information. 

It will still be made available to the registrars. We are not saying 

contact information should not be provided. We do believe it should 

be provided, but we think the circumstances under which it should 

be disclosed should be limited to appropriate and legal circumstances. 

There is a very simple analogy here, Mr. Chairman, and that is, 

of course, the driver’s license and driver’s record information that 

all of us provide to the State DMV’s as a condition of the right to 

drive a car on a public roadway. 

We make this information available to the Government, and the 

Government needs to make use of that information oftentimes to 

investigate crime and theft and accidents. 

We would not say that the information in the State DMV databases should be widely available to the general public for any purpose it might choose. In fact, the Congress has wisely chosen on 

several occasions to protect the privacy of just that type of information so that it is not improperly used. 

24

My point is simply this. If we protect the privacy of the information that is collected to register an automobile and it can still be 

accessed for law enforcement, for appropriate use, should we not 

similarly protect the privacy of the information that is provided to 

register a Web site? 

It will still be available for appropriate use, but we do not want 

it widely available to the public. It is contributing to the problem 

of identity theft. 

Thank you. 

[The prepared statement of Mr. Rotenberg can be found on page 

103 of the appendix.] 

Chairman BACHUS. Thank you, Mr. Rotenberg. 

My question is simply going to be, Mr. Bohannon, Mr. Rotenberg 

gave a different view from the first panel or Ms. Allen and you. 

Would you respond to his arguments? Are they valid? How do 

you deal with that? 

Mr. BOHANNON. Mr. Chairman, of course, Mr. Rotenberg and I 

have worked on a number of things together. Sometimes we agree. 

Sometimes we do not agree. I think on this one, we do not agree 

on either the nature of the potential problem that he was describing, much less the overall balance that is trying to be struck here. 

Let me try to address—if I miss a point, let me know. 

Chairman BACHUS. I will give Mr. Rotenberg the right to respond. 

Mr. BOHANNON. I think the question no one on this panel is arguing is that there are not real problems to address with regard 

to identity theft and how we combat that. I think in this Congress 

we have seen lots of discussion of that across the board. 

The question is whether the kind of information regarding the 

kind of entities that are on the WHOIS database in fact contributes 

in any way, much less in a meaningful way, to identity theft, fraud, 

and anything else. With all due respect to Mr. Rotenberg, I do not 

believe the evidence is there. 

In fact, if you look at the kind of registrant technical and administrative data that is on WHOIS, registrants, in fact, their e-mail 

address are not publicly available. The only thing you have to put 

as a registrant is your name and postal address. Technical and administrative contacts, that is different. 

When you are talking about the actual registrant, we are not 

talking about the kind of information that would be associated with 

identity theft and leading to those kinds of things. 

Our view is that the overall balance to be struck here is when 

my member companies get thousands of complaints in an hour that 

they are getting fraudulent e-mail and being directed to deceptive 

Web sites. What within minutes or hours can companies do to shut 

those down and give their customers confidence that they can do 

business? 

At this point, there is no silver bullet. WHOIS becomes an essential step in combating that. If we were to rely only on law enforcement, we believe that it would dramatically hinder our ability to 

go directly and help our customers when they are being confronted 

with these kinds of attacks. It simply cannot be done in minutes 

or hours. 

25

As you know, Mr. Chairman, our organization has a long history 

of working in a public/private partnership with law enforcement to 

combat cyber crimes, intellectual property theft. They do great 

work, but they cannot operate within minutes or hours like our security offices and our customer relationship folks are required to 

do. 

Chairman BACHUS. Thank you. The WHOIS data, are you disputing that it is being used today to protect consumers and to advance confidence in the Internet? 

Mr. ROTENBERG. I believe it is being used in both ways, Mr. 

Chairman. I believe that the WHOIS data can be useful to investigate certain types of activity. I think you have to be a fairly sophisticated user to use the WHOIS data for that purpose, because 

a person who intends to commit a crime online is usually pretty 

good at concealing their actual identity, and that includes the information they would provide for the WHOIS database. 

Chairman BACHUS. Would you restrict some of the present rights 

that consumers have? 

Mr. ROTENBERG. I am encouraging an approach that ensures—

it is the consumers’ information, by the way, that is being disclosed. There are two sides to this coin. 

Chairman BACHUS. If you operate a Web site and if you communicate with someone and give them that Web site, then they have 

a right, but if you didn’t want them to have that information, you 

just simply would not communicate with them; is that right? 

Wouldn’t that solve your problem? 

Mr. ROTENBERG. That could be. 

Chairman BACHUS. You obviously have some motivation for communicating with that consumer. 

Mr. ROTENBERG. You may also be a non-commercial entity. As I 

said, there are many people who register Internet Web sites for 

non-commercial purposes. There are many human rights organizations, I should point out, that have found that the Internet is the 

most effective way they have for expressing their political views 

and trying to bring democratic reform to some of the governments 

in this world that need reform. 

They are concerned that if their personal information were made 

available to the governments in which they are operating, they 

would be at serious personal risk. 

If I may, Mr. Chairman, because I know other witnesses had 

asked that certain information be entered into the hearing record, 

on this particular point with Mr. Bohannon, I would like to ask 

that an article that my staff found be entered into the hearing 

record. 

This concerns the spammer in the United Kingdom, if I could 

just read two sentences. 

It begins, ‘‘Britain’s most prolific spammer, currently behind bars 

and facing a number of charges, has also just been fined 81,000 

pounds.’’ 

It goes on to say he, ‘‘Used Nominet’s WHOIS database to send 

out fraudulent domain name renewal invoices under the name of 

Domain Registry Services.’’ 

He had access to the WHOIS data, which made it possible for 

him to commit the fraud. 

26

Chairman BACHUS. Is that the only case you are aware of? 

Mr. ROTENBERG. I am sure we could find many more, sir. I just 

thought it was remarkable. He is the most well-known spammer in 

Great Britain. 

Chairman BACHUS. You would agree there are literally thousands, or tens of thousands, of examples of people who have misrepresented their identity to consumers and thereby committed 

identity theft or entered into fraudulent practices? 

Mr. ROTENBERG. Yes, sir. We certainly support those prosecutions. As I said, we have worked with the Federal Trade Commission and encouraged prosecutions of fraud that does jeopardize the 

interests of consumers. 

We do believe that the interests of consumers are also jeopardized when their personal information is made available online. 

Chairman BACHUS. Since this WHOIS database was set up, since 

day one, consumers have had this information that you are now advocating be withheld from them; is that right? 

It’s a change to the status quo. 

Mr. Bohannon and Ms. Allen are basically arguing for the status 

quo, and as I understand it, you are arguing that the consumers’ 

right to know be limited. 

You have given as a legitimate reason the protection of the privacy of the Web site operators. 

Am I wrong? 

Mr. ROTENBERG. From our perspective, Mr. Chairman, the consumer right here is the ability to control the disclosure of their personal information. 

Chairman BACHUS. Are the Web site operators, I would say 90 

percent—it is my understanding you are limiting the right of consumers to get that information which they presently have. Am I 

right? 

Mr. ROTENBERG. We would certainly allow access for appropriate 

purposes, as I mentioned at the beginning. I was chairman of the 

.org domain. We are the third largest generic top level domain 

name. There are millions of people who register .org domain addresses. Many of them are for non-commercial purposes. 

Chairman BACHUS. Thank you. Mr. Bohannon? I’m sorry. My 

time has expired. Mrs. Maloney? 

Mrs. MALONEY. Thank you. I would like to ask all of the witnesses. I think we all agree that access to the database can be useful, but can also be a tool for identity theft. 

Why not segregate the most sensitive information and keep that 

private so a consumer might still be able to see who contacted 

them, but might not get the sensitive personal data that could 

allow them to set up a fake account in their name? 

Could you respond to that? In other words, limiting the amount 

of information. You can get a name but not the address, so you cannot use that sensitive information. 

Ms. ALLEN. Maybe I will start by responding. I think when we 

are talking about access to the WHOIS database, the only sensitive 

data is their name, address, telephone number, and in the case of 

the administrative contact, their e-mail, but there is no financial 

information that is available. 

27

As the financial industry, we are looking to be able to track back 

who owns a Web site or maybe the genesis of an e-mail that may 

be used for phishing to go capture that information from a bank 

or from consumers. 

In the WHOIS database, there is no sensitive data other than 

the name, address, and e-mail of who owns that database. 

Mrs. MALONEY. Any other comments? 

Mr. BOHANNON. I think it is important to understand that, in 

fact, the WHOIS database is already carefully balanced to make 

sure that sensitive information like billing information the registrars get from the registrants, that is clearly not put on the Web 

sites. I think we need to recognize that is already a limitation. 

I will reiterate my point from earlier, which is you will not find 

the sensitive information of registrants on WHOIS. You will find 

their name and postal address. What you will find is contact information for either technical or administrative contacts. In that context, the Nominet example, I think, is very useful. It was a very 

well-publicized case about 2 years ago. 

The system worked. The individual was engaging in illegal spam. 

Illegal because the registrar accreditation agreement that ICANN 

has in place precludes use of the information for precisely the kinds 

of activities the gentleman in the Nominet situation was engaging 

in. 

Our view is that ICANN needs to do more to enforce those agreements, to make sure that the limitations on WHOIS data that already exist are meaningful and are not abused. 

When we hear the word, ‘‘individual,’’ we need to be careful here. 

What was involved in almost 99.9 percent of those cases were individuals who were not there as consumers, but individuals who were 

there in a corporate capacity. 

Take me, for example. I have my name and e-mail address on 

our Web site. Is that me as an individual? Yes. It is me in my capacity representing my members. That is, in fact, the kind of information that this gentleman used, and to reiterate, he engaged in 

violation of existing ICANN policies, and we think ICANN should 

be doing more to make sure those policies are enforced. 

Mr. ROTENBERG. I think what you have outlined is, in fact, a sensible and effective approach that many organizations and experts 

and Government officials who are participating in this process at 

ICANN hope will result. 

As the other witnesses have indicated, this policy is still under 

discussion and a number of different approaches have been put forward. I think there has been very good input. 

I believe that a sensible solution is one that will restrict access 

to personal information and still leave some point of contact for accountability and investigations when appropriate. 

Mrs. MALONEY. I would like to ask each of you whether you 

agree there should be different standards for accessing WHOIS depending on whether an Internet registrant is commercial or noncommercial. 

Mr. ROTENBERG. I will say on this point that I know the Federal 

Trade Commission has proposed this distinction. I think there is 

certainly some support for this. 

28

A business that holds itself out should be accountable and there 

should be a point of contact for a business, and we wouldn’t necessarily have the same expectation for a non-commercial entity on 

the Internet. 

I think as a broad solution to the WHOIS issue, as my testimony 

suggests, there will need to be a point of contact for all registrants. 

One approach may be to allow proxy registrations so that individuals, for example, will have a buffer, if you will, so that it is still 

possible to reach someone when necessary, but they won’t be directly exposed online. 

Mr. BOHANNON. I think the discussions that are underway about 

the subject are very helpful, and we are participating actively in 

them. 

Congresswoman, I think at this stage, there is little that provides comfort that this could be put into place either operationally 

or from a practical point of view. 

I think even the FTC has acknowledged in its statement that 

until those are resolved, everything should be publicly accessible, 

and that there needs to be more information gathered. 

Let me just say that the question of commercial versus non-commercial is a tricky one. My organization, SIIA, is a 501(c)(6). Technically, we are a non-profit under the tax laws. 

Am I therefore a non-commercial entity who should have my information restricted? That makes no sense whatsoever, since we 

are actively engaging and holding ourselves out to the public, even 

though we do not pretend to make a profit. 

I think you need to be very careful about the language of noncommercial and commercial when in reality, entities, individuals, 

organizations that are using a publicly available Web site to promote themselves, to engage in education, and to do other things, 

are holding themselves out to the public. 

I think one point that has been missed, if I could just take a second, if an individual wants, for political or other purposes, to be 

able to communicate in a meaningful way, getting a Web site, in 

my humble opinion, is probably the last thing you want to do. 

There are lots of ways you can do it through blogs and others 

that are not registered at the top level domain that I think can be 

doing exactly the kind of things Mr. Rotenberg talked about, but 

which avoid, I think, some of the points that are being made. 

Quite frankly, if I were engaging in political dissidence, the last 

thing I would want is a Web site. I would want to figure out how 

to use an appropriate proxy service or something else, and those 

are all provided under very clear rules under the ICANN. 

This notion that Web sites are nothing, I think we need to get 

pass that in terms of addressing some of the communication issues 

that have been discussed here. 

Mr. ROTENBERG. Could I respond to that? 

Mrs. MALONEY. Absolutely. 

Mr. ROTENBERG. I am actually really struck by Mr. Bohannon’s 

comment. I find it extraordinary that an association that represents leading technology companies in the United States would 

discourage political speakers from taking advantage of the Internet 

and establishing Web sites. 

29

Mr. BOHANNON. I am sorry. That is not what I said. That is incorrect. 

Mr. ROTENBERG. I believe that is exactly what you— 

Mr. PEARCE. [presiding] Could the gentlemen suspend? 

Mrs. MALONEY. Ms. Allen, if you would respond to the commercial and non-commercial. 

Ms. ALLEN. I would. We draw no distinction. In fact, we support 

the Department of Commerce’s position, and believe in transparency. A lot of it has to do with going after the bad guys. 

BITS just had a conference last week on anti-money laundering. 

We were looking at the growth of fraud on the Internet and concerns about the bad guys, and the correlation that has with the 

charities that sometimes are fronts for terrorism groups, and that 

they are using that as one of the ways that they do funding. 

I think it is important that we have transparency and that it 

could be a not-for-profit or a for-profit or an individual who has a 

Web site that may be a bad guy, and we want to be able to have 

access to that. 

Mr. PEARCE. The gentlelady’s time has expired. I would request 

unanimous consent to enter into the record a statement by Lynn 

Goodendorf. She is the vice president for information privacy protection for the Intercontinental Hotels group, and then also a letter 

from Mr. Fred Becker, Jr., National Association of Federal Credit 

Unions. Without objection, those will be entered into the record. 

Mr. Rotenberg, on page six of your testimony, you declare that 

governments are trying to crack down on human rights groups by 

extending identification requirements for Internet users. 

I suspect that is something you would object to. 

Mr. ROTENBERG. We do, sir. We work with human rights organizations all around the globe. We are particularly concerned about 

those organizations that are pursuing democratic reform— 

Mr. PEARCE. Sir, if I can go ahead and ask you the question. 

What position did you all take when Google went ahead and decided to cooperate with China? 

It is my understanding they were providing information on who 

searched the word, ‘‘democracy,’’ who searched for words. 

What did you all publicly do? What did your organization say 

about that publicly? What was your position? 

Mr. ROTENBERG. We took no formal position and we were not 

asked to appear before the committee that held the hearing on this 

issue. We did express our opposition to Google’s support for the 

Chinese based search engine, .cn. 

The practice impact of that search engine is to restrict access to 

information on the Internet that the Chinese Government does not 

want the Chinese people to receive. 

We did not support that. 

Mr. PEARCE. You took no public position, but you are taking a 

public position now that would provide consumers with access to 

information? Am I characterizing that accurately? 

Mr. ROTENBERG. Sir, I would be happy— 

Mr. PEARCE. I am asking a question. You are taking a public position on restricting access to consumers. Is that your position? 

Mr. ROTENBERG. We do not believe we are restricting access to 

consumers. 

30

Mr. PEARCE. If I could then go to page three of your documentation, you quote from the Public Interest Registry that, ‘‘As the 

Internet and the number of its users has grown, the justification 

for making WHOIS data publicly available is no longer applicable.’’ 

Did you quote something you did not believe? 

Mr. ROTENBERG. I do. I very much support that statement. 

Mr. PEARCE. My position still stands. It appears that you are 

supporting restricting access to consumers, but you are not unwilling to speak to Google publicly when they identify people for the 

government of a fairly repressive regime. 

I really want to get my feet underneath me as far as your positions are concerned. 

Mr. ROTENBERG. I certainly appreciate the question, and if I can 

clarify my response, I apologize if I have not been clear. 

We were opposed to what Google did with respect to the search. 

Mr. PEARCE. You did not take a public position, right? 

Mr. ROTENBERG. To the extent that we were asked our views, 

that is what we said. As to the public availability and the statement from the Public Interest Registry, which we cite in our statement, we think it is an excellent point that was made in support 

of WHOIS privacy. 

Mr. PEARCE. Can I ask you, in that same quote, ‘‘As the Internet 

and the number of its users has grown, the justification for making 

WHOIS data publicly available is no longer applicable,’’ how does 

it affect privacy concerns if we affect the privacy of more rather 

than fewer, the logic of that position is a little bit untenable. It 

seems like we would be interested in protecting the privacy of even 

a single individual, yet the quote specifically states now that the 

number of people is larger, now we have cause for concern and we 

are going to take a position. 

I am not following that logic. 

Mr. ROTENBERG. I believe the point that is being made in the 

statement and is one that is generally understood at the ICANN, 

is when the data was originally available, it was to technologists 

for the technical purpose of maintaining the security and stability 

of the Internet. 

What has happened over time because it is more widely accessible to more people, it is creating new privacy risks that did not 

previously exist. 

That is why we have the problem of identity theft and phishing 

and spam. 

What the Public Interest Registry is expressing here is the recognition, which I believe ICANN is agreeing with, that in this environment, the unrestricted access to personal information poses new 

privacy risks. 

Mr. PEARCE. I had asked the previous panel if it were possible 

if all Web sites had a link straight to the WHOIS database. I suspect you would be opposed to that. 

Mr. ROTENBERG. I think it could be helpful for consumers who 

are dealing with businesses online. 

Mr. PEARCE. No, I did not ask about businesses. I said, ‘‘all.’’ It 

goes back to the discussion about my granddaughter, what Web 

sites might be misleading my granddaughter. 

31

I think there would be a very good reason to have the capability 

for a parent to go in and check to see who exactly is talking to a 

daughter in non-commercial means. 

You would oppose that? 

Mr. ROTENBERG. I would be concerned that the same policy 

might be applied to a Web site that your granddaughter would 

choose to create on the Internet. I think she would have a privacy 

interest in protecting— 

Mr. PEARCE. If my granddaughter wants to go on the Internet 

and begin to represent herself as someone, I think she should be 

responsible enough to be asked who she is and where she is located. I do not fear that at all. It is part of transparency. 

Mr. Baca, it is time for you to ask questions. 

Mr. BACA. Thank you very much. Let me ask all three of you just 

a simple question at the very beginning, and you can just answer 

it yes or no. 

Dealing with identity theft, it seems like individuals now can obtain any kind of information, more information, using the Web 

sites and the Internet. It has become a serious problem because 

some people may give out a little bit more information, so therefore, they have access. 

Is that true? Just for the record, yes or no? 

Mr. ROTENBERG. I would say yes, it is a risk when people make 

more information available online. It can be misused. 

Mr. BOHANNON. I am not sure I understand your question, Congressman. 

Mr. BACA. Right now, since we have a lot of identity theft, is 

there a probability that now more individuals are at risk because 

they are using the Web sites, they are using the Internet, that they 

are giving out a lot more information, so therefore, other individuals may have access to that information? Yes or no? Just a simple 

yes or no. 

Mr. BOHANNON. I apologize. The question you are asking is of 

course, way beyond the scope of this hearing. I am trying to make 

sure I give you— 

Mr. BACA. We are talking about theft, fraud, the Internet. 

Mr. BOHANNON. If I make more information available online or 

offline, yes. 

Mr. BACA. Thank you. 

Ms. ALLEN. The answer is yes, and right now, more identity theft 

comes from off line, from dumpster diving, than online. 

Mr. BACA. Thank you. The next question is what steps can consumers take to protect themselves against phishing, which is number one? This question is for Mr. Rotenberg. 

Is there a one-stop-shop of information that I can refer them to? 

Mr. ROTENBERG. The main advice we give to consumers is to 

know the Web sites that they are dealing with, and to limit the 

amount of personal information they provide, but when they do run 

into trouble, we encourage them to visit the Web site of the Federal 

Trade Commission, the Privacy Rights Clearinghouse, and also the 

Identity Theft Resource Center, all very good resources for consumers. 

Mr. BACA. Thank you. 

32

Mr. BOHANNON. I think Mr. Rotenberg outlined a number of very 

important steps. The other thing that virtually every company that 

does business has developed is a means to get from their customers 

examples. 

I, for one, use a very popular online payment service personally. 

I send to spoof@ that entity so many times a day that I think it 

helps them keep up with what is going on. 

I think it is very important in addition to the examples that Mr. 

Rotenberg talked about, to be in direct contact with the company 

that you are doing business with so that they know and they can 

tell you whether or not it is legitimate or not. 

Mr. BACA. Ms. Allen? 

Ms. ALLEN. The same thing, consumer education and knowing 

who you are doing business with. 

Mr. BACA. My next question is is there some kind of educational 

program that we could put out to our consumers right now? All 

three of you suggested some ideas. The problem is that many of our 

consumers are not aware there is this information that they could 

access or go through. 

How can they find out information, or is something we should be 

doing even here at the national level, developing some kind of educational consumer awareness? 

Mr. ROTENBERG. I think the Federal Trade Commission has done 

some good work in this area. I think the businesses are also doing 

a fairly good job trying to encourage consumers to learn more about 

doing business online. 

Part of the problem, Congressman, is that things are changing 

very quickly. Technology is changing quickly. Businesses are 

changing quickly. A year ago, no one had heard of MySpace. Today, 

it is the number one Web site. It has a big impact on the privacy 

of our children. 

It takes a lot of time and effort to stay up to date with these developments. 

Mr. BACA. One other question. A lot of us, under the identity 

theft and fraud that is going on, a lot of us sit home, it doesn’t matter who we are, and get a lot of the telemarketers who call us almost on a daily basis. Now, at least we have developed a block 

number so we can block some of those out. 

Is there a computer type system available where we can actually 

block some of this out? That is where a lot of the identity theft and 

fraud also occurs, and I don’t know if our consumers are aware if 

there is some type of a system that is available that can block out, 

like we do block out numbers. Right now, anybody can get into the 

Web site, the Internet, e-mail. 

Is there such a system that is being developed, and if there is, 

some of us need to be educated. Maybe I am not aware. 

Mr. ROTENBERG. Congressman, as you indicated the Do Not Call 

legislation was extremely successful. There were more than 100 

million consumers who signed up for that. It did reduce the amount 

of telemarketing and the phone calls at dinner time. 

There have been proposals since for a Do Not E-Mail list, but it 

is not clear those would be effective. Most of the efforts to restrict 

the amount of spam that consumers receive are working forward 

on the technology front and not so much on the legislative front. 

33

Mr. BACA. Could you elaborate? Why would it not be effective? 

You said it may not be effective? 

Mr. ROTENBERG. There are many reasons. One of them is that 

e-mail addresses can be imprecise. They can change. It can be difficult to identify the originator of an e-mail communication. It is 

also very inexpensive to send millions and millions of e-mails. 

It turned out that it worked, the Do Not Call list worked particularly well for telemarketing because of the structure of the industry 

and the ability with legislation to limit some of the more invasive 

practices. 

Mr. PEARCE. The gentleman’s time has expired. Ms. Kelly? 

Mr. BACA. Could I have Mr. Bohannon’s answer? 

Mr. PEARCE. One moment, Ms. Kelly. We have one more answer. 

Mr. BOHANNON. Again, Mr. Rotenberg and I often agree on many 

things, and this is one. I would just refer to the Congressman and 

the committee a very thoughtful study that was done by the FTC 

in response to Congress on this very question, where they identified not only many of the practical issues that Mr. Rotenberg identified, but you can imagine a hacker—a hacker would spend every 

night for a year trying to figure out how to hack this database. 

A, he knows or she knows they are legitimate e-mail addresses. 

If he ever gets ahold of them, he could spam everyone in the world. 

I think there are a number of issues that come up with a registry 

like approach and Do Not Call, but the other point I would add to 

the very thoughtful comments is I think there are some good tools 

out there to help you in managing some of this. They are not perfect. Some of them are my members. 

I do think it is important to know the tools that are out there, 

keep them up to date, and know how to use them so you become 

as sensitized and are as aware of what is trying to get to you, both 

good and bad. 

Mr. BACA. As we do that, we have to simplify it for some of us 

who are not technology connected. It needs to be very simple. 

Mr. BOHANNON. I can tell you some suggestions. I am not allowed, of course, to promote particular products here. 

Mr. PEARCE. Thank you. Ms. Kelly? 

Ms. KELLY. Thank you very much, Mr. Chairman. 

You three were in the room when I was asking a question of 

ICANN and the Commerce Department. My question to you is do 

you think the Commerce Department ought to require ICANN to 

carry out random audits of the register and the WHOIS data procedures? 

Let me start down at the other end, Mr. Rotenberg. 

Mr. ROTENBERG. Thank you, Congresswoman. I think audits 

could be helpful, if you were trying to encourage accuracy, but I 

also think that our privacy safeguards would encourage accuracy. 

One of the reasons that people provide inaccurate information or 

incomplete information is because they understand that it will be 

widely available to anybody, including stalkers, spammers, and 

phishers. 

I think the Department of Commerce, which has an understandable interest in promoting accuracy, could advance that goal 

through support for better privacy. 

34

Mr. BOHANNON. Thank you for your question, Congresswoman. I 

think it is our view that, as the MOU is reviewed and ICANN’s 

commitments under the MOU are evaluated, I think those kinds of 

concrete things that ICANN under the existing arrangement has 

set out to do to improve accuracy and reliability need to be clearly 

documented, and I think as the MOU is renewed and reviewed, 

there may be a need to get more specific in terms of the Department of Commerce’s expectations, and I think audits, random audits, is one example. 

Ms. ALLEN. I agree there could be more that ICANN does in 

terms of positive reinforcement, proactive audits. There is more 

that others in the community, such as ISP’s, could do, that could 

also help to stop the fraud. 

Also, by having transparency, there is a self-policing effort, the 

fact that as consumers and/or businesses see there are fraudulent 

sites, report them and help to shut them down. That is part of the 

process as well. 

Ms. KELLY. I noticed in some of the testimony, you were talking 

about the privacy of users and not the accuracy of information. 

One of the questions I have is whether or not there should be a 

procedure in place of some sort so that people can appeal to the 

registrar on something that is a decision, some sort of a registrar 

decision on not to act on a false WHOIS data that is reported to 

it, because the registrar can make that choice right now. 

It looks to me as though there is no penalty attendant to misinformation or to privacy theft at the present moment, in terms of 

whether or not the registrar acts. 

I am wondering if we could again start with you, Mr. Rotenberg. 

Mr. ROTENBERG. I think for the most part, the registrars have 

tried to stay out of the role of enforcing accuracy requirements. I 

think it could certainly be in the context of RAA’s, which is the 

agreements that the registrars sign to sell the domain names, to 

impose accuracy requirements is one way to accomplish that goal. 

As I said, I still think the privacy safeguards would work, because individuals would be less likely to provide inaccurate information. 

Ms. KELLY. For anyone to plead a right to privacy, people need 

to remember there is no right to privacy on inaccurate information. 

Mr. ROTENBERG. Congresswoman, if I may give an analogy, to 

the white pages and the phone books. I used to look at those. I was 

interested in how people protected their privacy in a very similar 

directory. A lot of people do not list their home address. A lot of 

women give a first initial instead of the complete first name. 

You can say that is incomplete maybe, not inaccurate, but it is 

clearly done with the goal of protecting privacy. 

I think some of that happens with the WHOIS directory as well. 

Ms. KELLY. That is not misinformation. That was my point. 

Mr. ROTENBERG. Okay. 

Ms. KELLY. Mr. Bohannon? 

Mr. BOHANNON. I think you are asking a very important question, Congresswoman. I think our view is that 3 years ago, ICANN 

made very specific commitments in these areas. 

35

I think in my prepared remarks, I am very clear that while 

ICANN believes it has met those commitments, we feel they have 

really come up short. 

They, in fact, did implement a process called the WHOIS data 

problem reporting system. It was supposed to address many of 

these questions. 

As the GAO study found, it simply is not proving effective. The 

GAO found that less than a quarter of the complaints they filed—

that they intentionally submitted and filed—were taken care of, 

and much of the misinformation or inaccurate information was 

never corrected. 

Our view is that we have a framework in place. Let’s make sure 

it is effectively enforced by ICANN and we do not have to go out 

and re-invent the wheel. Let’s get the existing system working 

right. I think that does require some responsibility on the part of 

ICANN to do that. 

Ms. KELLY. Do you think that penalties of some sort imposed by 

the Commerce Department might be of benefit there? 

Mr. BOHANNON. I think my view is what we need to do is get 

ICANN to recognize that in its role, it needs to be in direct relationship with the registrars and use that relationship. 

It needs to find, I think, a creative way, other than just de-certifying the registrar, which quite frankly right now is the only thing 

they can do. That may be too much of a response. We need to find 

some gradations here. 

We are prepared in working with the registrars and all the communities of interest to find appropriate ways so that we can make 

these realistic commitments enforceable and workable and to everyone’s interest. 

Ms. KELLY. Thank you. Ms. Allen? 

Ms. ALLEN. I wanted to distinguish between misinformation or 

inaccuracies with criminal intent, which I think that is why we 

want law enforcement and financial institutions to be able to have 

access to this information, to go after those players. 

It is the second part of it, misinformation, that may be from marketing or a misrepresentation from a business point of view, but 

looking for responsibility in enforcement. There are some mechanisms in place that ICANN has not lived up to, and I think that 

is something that needs to be communicated in the contracts and 

MOUs. 

Ms. KELLY. Thank you very much. My time is up, Mr. Chairman. 

Thank you. 

Mr. PEARCE. I thank the gentlelady. The Chair notes that some 

members may have additional questions for this panel, which they 

may wish to submit in writing. 

Without objection, the hearing record will remain open for 30 

days for members to submit written questions to these witnesses, 

and to place the responses in the record. 

I thank the witnesses from both panels. With that, this hearing 

is adjourned. 

[Whereupon, at 2:02 p.m., the subcommittee was adjourned.] 

(37)

A P P E N D I X

July 18, 2006

38


31537.001
39


31537.002
40


31537.003
41


31537.004
42


31537.005
43


31537.006
44


31537.007
45


31537.008
46


31537.009
47


31537.010
48


31537.011
49


31537.012
50


31537.013
51


31537.014
52


31537.015
53


31537.016
54


31537.017
55


31537.018
56


31537.019
57


31537.020
58


31537.021
59


31537.022
60


31537.023
61


31537.024
62


31537.025
63


31537.026
64


31537.027
65


31537.028
66


31537.029
67


31537.030
68


31537.031
69


31537.032
70


31537.033
71


31537.034
72


31537.035
73


31537.036
74


31537.037
75


31537.038
76


31537.039
77


31537.040
78


31537.041
79


31537.042
80


31537.043
81


31537.044
82


31537.045
83


31537.046
84


31537.047
85


31537.048
86


31537.049
87


31537.050
88


31537.051
89


31537.052
90


31537.053
91


31537.054
92


31537.055
93


31537.056
94


31537.057
95


31537.058
96


31537.059
97


31537.060
98


31537.061
99


31537.062
100


31537.063
101


31537.064
102


31537.065
103


31537.066
104


31537.067
105


31537.068
106


31537.069
107


31537.070
108


31537.071
109


31537.072
110


31537.073
111


31537.074
112


31537.075
113


31537.076
114


31537.077
115


31537.078
116


31537.079
117


31537.080
118


31537.081
119


31537.082
120


31537.083
121


31537.084
122


31537.085
123


31537.086
124


31537.087
125


31537.088
126


31537.089
127


31537.090
128


31537.091
129


31537.092
130


31537.093
131


31537.094
132


31537.095
133


31537.096
134


31537.097
135


31537.098
136


31537.099
137


31537.100
138


31537.101
139


31537.102
140


31537.103
141


31537.104
142


31537.105
143


31537.106
144


31537.107
145


31537.108
146


31537.109
147


31537.110
148


31537.111
149


31537.112
150


31537.113