WHOIS Task Force 2 -- Proxy Registration (and related) Services

Introduction

The present document discusses several services that permit registrants to avoid listing their personal contact information in WHOIS. In the "proxy setting," a third party enters into the registration agreement (and is, from the registrar's point of view) the "registrant"; the site is then licensed to the "actual registrant." This setting is regulated by section 3.7.7.3 of the RAA:

3.7.7.3 Any Registered Name Holder that intends to license use of a domain name to a third party is nonetheless the Registered Name Holder of record and is responsible for providing its own full contact information and for providing and updating accurate technical and administrative contact information adequate to facilitate timely resolution of any problems that arise in connection with the Registered Name. A Registered Name Holder licensing use of a Registered Name according to this provision shall accept liability for harm caused by wrongful use of the Registered Name, unless it promptly discloses the identity of the licensee to a party providing the Registered Name Holder reasonable evidence of actionable harm.

Frequently, these "proxies" are associated with registrars. In a different setting, the registrar directly provides replacement contact information to the registrant, without using an intermediary.

Constituency Input

The Intellectual Property Constituency points to section 3.7.7.3 of the RAA (see above). "It is the IPC’s understanding that the proxy registration services seek to fall within this provision. It appears that the proxy registration services with which IPC members are familiar operate under terms and conditions that permit the disclosure of registrant contact data in the circumstances contemplated by RAA 3.7.7.3. However, we have gathered only very limited anecdotal data about how these services work in practice."

The Non-Commercial Users' Constituencypoints out in its submission that the standard proxy situation means that an additional, and possibly unscrupulous, intermediary is introduced into the contractual relationship between registrar and registrant. That party then has the ability to do whatever it wants with the registered domain name. The NCUC also points out that proxy services are not providing anonymity suitable to protect free speech. Domains By Proxy is discussed in detail; the NCUC concludes: "Therefore we submit that the proxy services offered at present are necessarily insufficient, since they cannot really protect registrants against mere legal threats, because of the liabilities incurred by those offering these services."

ALAC's response to the survey points out that proxy services technically do not provide anonymity, but pseudonymity, in that the intermediate entity knows the end-user's identity, but publishes its own information in the WHOIS registry instead. According to ALAC, "the chief problem with these "masking" services is that they may unmask their users on slight provocation; an allegation of wrongdoing is not the same as proof that unlawful activity has occurred, and there are many ways to stop even ongoing wrongdoing short of revealing the name of someone who may later turn out to be innocent of all charges." ALAC also points to the risks caused by the proxy situation.

The ISPCP's input contained some pointers to proxy and similar services that were quite helpful in assembling the following table.

Overview of Various Providers' Terms and Conditions

Anecdotal Evidence

Anonymity Terms: Domains By Proxy.

Since the terms under which Domains By Proxy lifts anonymity appear to have been a model for other players in the industry, we reproduce them here for reference purposes:

a.  You understand and agree that DBP has the absolute right and power, in its sole discretion and without any liability to You whatsoever, to either:  (i) close Your account (which means You then become the Registrant of the domain name registration); (ii) reveal Your name and personal information that You provided to DBP when required by law, in the good faith belief that such action is necessary in order to conform to the edicts of the law, or to comply with a legal process served upon DBP; (iii) resolve any and all third party claims, whether threatened or made, arising out of Your use of a domain name registered by DBP on Your behalf; or (iv) take any other action DBP deems necessary:

·        In the event you breach any provision of this Agreement or the DBP Anti-Spam Policy;

·        To protect the integrity and stability of the applicable domain name Registry;

·        To comply with any applicable laws, government rules or requirements, subpoenas,  court orders or requests of law enforcement;

·        To comply with ICANN’s Dispute Resolution Policy;

·        To avoid any financial loss or legal liability (civil or criminal) on the part of DBP, its parent companies, subsidiaries, affiliates, shareholders, agents, officers, directors and employees;

·        If the domain name DBP registers on Your behalf violates or infringes a third party's trademark, trade name or other legal rights;

·        If it comes to DBP’s attention that You are using DBP’s services for purposes of engaging in, participating in, sponsoring or hiding Your involvement in, illegal or morally objectionable activities, including but not limited to, activities which are designed, intended to or otherwise:  (i) appeal purely to the prurient interests of third parties; (ii) defame, embarrass, harm, abuse, threaten, or harass third parties; (iii) violate state or federal laws of the United States and/or foreign territories; (iv) involve hate crimes, terrorism and child pornography; (v) are tortious, vulgar, obscene, invasive of a third party’s privacy, racially, ethnically, or otherwise objectionable; (vi) impersonate the identity of a third party; (vii) harm minors in any way; or (viii) relate to or transmit viruses, Trojan Horses, access codes, backdoors, worms, timebombs or any other code, routine, mechanism, device or item that corrupts, damages, impairs, interferes with, intercepts or misappropriates any software, hardware, firmware, network, system, data or personally identifiable information.