People with websites for their company, blog, forum or organisation may soon face restrictions on their ability to keep their personal names, addresses, email contacts and phone numbers private.

Under a controversial proposal by the internet governing body, the Internet Corporation for Assigned Names and Numbers (ICANN), many owners of internet domains may be required to post such personal contact data to the public WHOIS database, an online service that enables anyone to search for the ownership details of a domain.

Currently, privacy service companies as well as many internet domain name registrars offer privacy screens for people who don’t want their home addresses and phone contacts in WHOIS. Instead, the service or the registrar is listed as a proxy contact.

However, in an effort to facilitate prosecutions, the entertainment industry, including film and music industry bodies, as well as other intellectual property interests, have pushed ICANN to change the existing system.

They are requesting a range of potential measures, such as mandatory listings of contact details for domains operated an a commercial basis, and a requirement that registrars hand over domain contact data directly to them on request.

"You have to look at the history of the internet to see how we have ended up where we are," says Michele Neylon, director of Irish domain registrar and internet hosting service Blacknight.

The WHOIS directory originated at a time when few devices were connected to the internet, he says. It was developed to enable the small number of people involved to easily contact each other if there were network or domain problems.

Spammers and scammers

Now, millions of people own domains, and the WHOIS database – full of personal details – is regularly used by spammers and scammers, and to make unsolicited calls or harass people.

“Out of that, a lot of companies started offering WHOIS privacy and proxy services, so if you wanted to hide your personal data, you could,” Neylon says.

However, no regulations or standards for such services were ever put in place. Responsible registrars and privacy services would comply with what Neylon calls “legitimate” requests for personal data, such as examples of obvious misuse, or court orders.

“But because of the lack of rules, some companies just did what they wanted,” he adds. Some serious criminal activities have taken place behind privacy screens, Neylon acknowledges, as well as intellectual property infringements.

ICANN proposed a new programme, published a report, and had an open period for public comment and response, which concluded earlier this month. The report has received thousands of online comments.

Neylon was part of the ICANN working group that drafted the initial report. He says he is concerned that new regulations from US-dominated ICANN will not adequately respect differing privacy laws in the EU and could require that registrars, rather than courts, decide whether requests for client contact data are valid.

“If you have a court order,” he says, then “you’ve gone through the proper channels.”

But many owners of intellectual property, be they big brands or entertainment companies, believe they should be able to more easily tackle the websites selling pirated goods such as software, high-end handbags, films or songs.

"The difficulty IP owners have is identifying who to take action against," says John Whelan, a partner at Irish law firm A&L Goodbody and head of its international technology practice in San Francisco. "The IP owners want a bit more transparency because they want to know the [domain] owners involved."

According to Whelan, IP owners feel they now have some recourse against individuals, having won some controversial court cases that he says has shifted the balance slightly in favour of IP owners.

For example, an Irish music sharing case resulted in a decision granting IP owners the right to make internet service providers tackle users who are illegally sharing music.

Now, Whelan says, IP owners want to address the same issue but at the level of website operators and domain owners.

From a legal perspective, he says, the ICANN proposal centres on determining what a domain name is.

One school views a domain as a virtual property, with associated rights drawn from land ownership. These include a right for a property to be administered through an anonymising trust – in the case of a domain, a proxy service.

There are no regulations under Irish law to disclose the beneficial owner of a property, Whelan notes, which could mean a domain owner has the right to remain anonymous as well.

The other school sees a domain as an asset through which commercial activity may be conducted. That places a domain in the realm of company rather than property law, and means it must operate in as transparent a way as a company.

Companies have ownership details on public record and home addresses are listed for directors. And if their commercial activity infringes on IP, they are subject to prosecution.

The problem, say opponents of ICANN’s proposal, is that “commercial activity” could be interpreted very broadly.

“It’s important to emphasise that [privacy providers] do not want criminals to abuse these services [or] to hide their online activities from law enforcement,” says Savedomainprivacy.org, which opposes the changes. “But some of the proposed changes would treat all users equally, regardless of their intent.”

The website argues that running ads on a blog or accepting charitable donations might qualify as commercial pursuits.

Commercial activity

The Electronic Frontier Foundation (EFF.org), which opposes the changes, says that in a hearing last March, the entertainment industry told the US Congress that it wants to broaden the definition of "commercial activity" on websites.

An industry representative said “privacy for domain registration should be allowed only in ‘limited circumstances’,” the EFF said in a statement. It also noted that sites that run ads have been determined to be commercial sites in domain name disputes.

Neylon says a serious worry is that such broad interpretations could put activists and human rights defenders in danger, by potentially making it easier for authorities to use trumped up commercial disputes as the basis for obtaining personal details.

Jim Loughran, spokesman for the Dublin-based human rights group Front Line Defenders (Frontlinedefenders.org), says the ICANN proposal "is a major concern for us. We are at a tipping point in the spread of repressive legislation, the denial of funding and attempts to shut down the free space of the internet."

Shahzad Ahmad, director of human rights group Bytes for All (Bytesforall.pk), which is based in Pakistan and campaigns against internet censorship, is also alarmed by the ICANN proposal to limit online anonymity, noting it can be a life-or-death issue for activists.

“This is indeed a moment of dire concern,” Ahmad says, “for human rights activists, journalists, and religious and sexual minorities living and working in difficult and repressive regimes that exhibit no regard for fundamental rights, including the right to life.

“In the present day, when technology- driven persecution by state and non-state actors in online and offline spaces is fast becoming a norm, privacy and anonymity form potent protections enabling individuals and communities to carry on their expression and work towards the restoration of their rights.”

Authorities should need a court order to obtain domain ownership details, he says, and people should have the right to utilise anonymising services.

“If such liberties are limited by global players of internet governance,” he adds, “the future of the . . . web may become grim and open to exploitation by political interests of a handful of power brokers.”

The issue is likely to be vigorously discussed at a global ICANN meeting, to be held in Dublin in October. A decision on any changes is expected within the next 12 months, after the working group considers all the comments “and come to some compromise,” says Neylon.