Domain Name Accuracy Bill Taken to US Congress.

By Kevin Murphy 

A committee of the US House of Representatives yesterday considered a law that would mandate jail time or increased civil penalties for people who break the law and use a fraudulently registered internet domain name to do so.

The Fraudulent Online Identity Sanctions Act, HR 3754, would stop short of actually making it an offense to register a domain with inaccurate data, but it would allow it to be considered during sentencing or the damages phase of a civil trial.

FOISA is sponsored by Texas Republican Lamar Smith and California Democrat Howard Berman. Both are senior members of the House subcommittee on intellectual property, which met yesterday..

Smith reportedly said the government must play a greater role in punishing those who conceal their identities online, when they are committing a federal criminal offense or in violation of a intellectual property right.

The law would add a maximum of seven years to a felony jail sentence, if the convict "knowingly provided material and misleading false contact information to a domain name registrar, domain name registry, or other domain name registration authority".

In civil cases, such as a copyright or trademark infringement, inaccurate data provided at registration or not updated as necessary, would be a sign of "willfulness", which in US law means the court can triple the monetary damages.

"This is like sentencing guidelines for intellectual property law," according to Susan Crawford, an assistant professor specializing in intellectual property law at Cardozo Law School, in an opinion piece published at CircleID.com.

Mike Steffan, policy analyst at the Center for Democracy and Technology, said CDT is concerned that inaccurate contact data would be used to show willfulness even when the reasons for the inaccuracy are unrelated to the alleged infringement.

The introduction of FOISA is drawing attention to the ongoing debate over privacy versus completeness and accuracy in the so-called Whois databases maintained by registrars, which list who registered which domain name.

Whois databases have been around for many years, but the increase in domain ownership among internet users recently has prompted calls for change from some participants in the DNS management body, the Internet Corp for Assigned Names and Numbers.

Currently, when a person registers a name in any of the ICANN-regulated domains, such as .com, they have to agree to provide their name, address, e-mail address and telephone number. The registrar is contractually obligated to make that data publicly searchable.

Big copyright interests, such as the movie and music industries, are frequently frustrated by inaccurate Whois data making it harder to track down suspected pirates who publish their copyrighted works online.

"ICANN takes these issues very seriously and will be reviewing the newly proposed bill," an ICANN spokesperson said in a statement. "ICANN policy clearly requires that accredited registrars obtain from all domain name registrants contact information."

Privacy advocates say people should be able to register a domain and publish online without fear of recrimination. There has been anecdotal evidence over the years about domain registration data being used for stalking or other nefarious purposes.

"It is already unfair to force registrants to provide all this data, and as a result many registrants do lie," Crawford wrote. "It costs far too much money for registrars to verify this data, and individuals will, predictably, continue to lie."

"We're not opposed to this bill, but we would be concerned if it proposed some kind of pre-verification [of registrant data] provision that would impose costs on us," said Elana Broitman, director of policy at Register.com Inc, a top-five registrar.

ICANN's Generic Names Supporting Organization, a policymaking body comprising most domain name industry stakeholders, has an ongoing task force tasked with discussing Whois privacy and accuracy problems.

According to records of task force meetings, non-commercial interests and many registrars are in favor of more user privacy, while intellectual property interests suggest broadening Whois to include such things as historical registrant data.

"Registrants may be willing to provide more accurate contact information if they know their privacy is going to be protected," said Broitman. Register.com is currently fighting a lawsuit with Verio Inc over mining Whois for marketing purposes.

CDT's Steffan agreed. "At a time when consumers are very concerned about things such as identity theft, the best way to provide accuracy in Whois is to also provide privacy protection," he said. "These are not necessarily irreconcilable."

Other leading registrars, including Networks Solutions Inc and Go Daddy Software Inc, have anonymous registration services, where customers pay an extra fee to have the registrar hide their real contact info by providing a post office box type service.

ICANN has not publicly objected to these services, which typically promise to hand over the registrant's name and address if the question of illegal activity emerges. Some anti-spammers say these proxy services are often abused by spammers.

The current proposed legislation could also make for some interesting jurisdictional debates, given that there are more than 240 top-level domains (TLDs) in the world, and most of them are not bound by ICANN's policies on Whois accuracy.

Even though it does not specify that registrant data should be public, FOISA as it is currently written would apply to registrations under all TLDs, including domains that are bound by stronger national privacy laws, such as those in Europe.