Subject: [Ietf-not43] -02 requirements draft

From: [email-masked] (Paul Stahura)
Date: Thu, 7 Nov 2002 13:57:31 -0800

This will cost money to develop.
Who will the development costs be passed to?
Unless something changes,
I find it interesting that the costs will be passed to the people supplying
the information (registrants in the form of higher registration fees) 
not to the people requesting and using it for fun and profit.
It would probably be cheaper (not just dollars but cpu cycles)
 for registrars/registries to just give
their information to a single "law enforcement", 
say daily via an FTPed XML file, than to implement 
and maintain a complex distributed query scheme.
IPR community would then just ask law enforcement to run their queries.

Paul

-----Original Message-----
From: Rick Wesson [mailto:[email-masked]] 
Sent: Wednesday, November 06, 2002 4:04 PM
To: Leslie Daigle
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-not43] -02 requirements draft 

Leslie,

> As for the "all domains owned by Joe Example", we've heard this
> requirement from both IPR and law enforcement communities.

at issue is that this same style of query is exactly what direct marketeers
want too. while i have herd from the IPR community I don't see them
offering to fund the development and deployment of such services.

though we may have some actors that desire these services I see no reason
to offer them for free. This is why I have proposed a requirement for
settlements.

I also can't see how we can tell the diference between an authorized user
that is a Direct Marketer and one that is from law enforcement.

best,

-rick

_______________________________________________
Ietf-not43 mailing list
[email-masked]
http://lists.verisignlabs.com/mailman/listinfo/ietf-not43

---

From: [email-masked] (Ted Hardie)
Date: Thu, 7 Nov 2002 14:22:16 -0800 (PST)

> IPR community would then just ask law enforcement to run their queries.

Paul,
	I am not a lawyer, and I do not play one on the net.  I would
suggest, however, that you might want to ask one about the wisdom of
the approach you suggest.  Over the course of years, different
jurisdictions have built up quite a bit of case law which relates to
privacy and the limitations to discovery (in civil cases) and
investigative search (in criminal cases).  These might well
have an effect on the workability of your suggestion.
	To repeat, I am not a lawyer; I am merely suggesting you
might want to consult one.
			regards,
				Ted Hardie

---

From: [email-masked] (Mark Kosters)
Date: Thu, 7 Nov 2002 17:15:27 -0500

Paul

It seems to me if you look at this stuff more closely, I'm sure you will
see that that the resultant end product will have a lot more functionality 
than the existing whois protocol. Since the new protocol will have more 
functionality (its hard to imagine one having less that whois does), I'm
sure there will be ways that creative business people will find to make 
money off of it.

Mark

---

From: [email-masked] (Patrick)
Date: Fri, 8 Nov 2002 00:14:09 +0100

> have an effect on the workability of your suggestion.

Because there are no privacy problems with current open to all whois
or its successor that will surely provide something equivalent ?

I do not believe that they should be a public non-authenticated
offered to all for free service listing all personal information and
what not about me and my domains, and even less a need for anyone
else than me to find all domain names using my nameservers or
anything like that. Or to find all domain names under my name.
I just do not see who can have such a need. For real and valuable
purposes, of course.

To go along the road to Paul suggestion, there is no need for
the data to be automatically given to a third party doing law
enforcement. It is only when the law enforcement party has a need for
the data that it asked for, and then is given the data to.

I believe that it is currently like that in all other maters
(ISP log connections, phone companies, etc...) : ISP do not forward
all their connection log to a third party, but they reply to requests
coming from police. I still do not understand why the domain name
industry should behave in any other way than that.

Sorry for this lame post. I would sure would like to take more time
to involve myself in the technical part and commenting on various
current drafts, but I'm on travel (ok, lame excuse too).
However this open public whois thingy is just driving me nuts.

Regards anyway,
Patrick Mevzek.

---

From: [email-masked] (Eric A. Hall)
Date: Thu, 07 Nov 2002 18:49:49 -0600

[top-posting to keep the context]

My personal vision is that some third-party will emerge to offer catalog
servers. Think Google/AltaVista and the like, and apply it here. Law
enforcement will need to do the same kind of thing, although probably on a
much smaller scale, and probably on different terms.

A few VERY important considerations here... First is that the owners of
the source databases will almost certainly have to give their permission
for this model to work. The owners of the data have all of the power here.
They can limit the number of queries or they can simply filter all queries
from that third-party if they choose, thereby forcing the third-party to
request higher access on some kind of limited terms, including privacy
controls, query rates, or anything else thate the original providers may
or may not be subject to. They can also demand some kind of payment for
this access, if they want.

This goes for every operator of any partition in the mesh. Wheras the
Swedish NIC may have a bunch of issues that need to be resolved, I'd
probably let Google have guest access to my local server (but not
privileged access) without asking for anything.

This also means that if law enforcement wanted to get anything special
they would also have to go to the source for permission, which may or may
not be allowed or justified, depending on the issues at hand.

I honestly believe that this is the only model that will survive the
myrida cross jurisdictional issues we are looking at, and I also think it
satisfies the concerns below for reimbursement.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/