Subject: Clinton Adviser: Internet, Regulate Thyself

From: Sascha Ignjatovic <[email-masked]>
Date: Thu, 19 Feb 1998 14:10:00 +0100 (MET)

http://www.techweb.com/wire/story/TWB19980218S0011

Clinton Adviser: Internet, Regulate Thyself
                    (02/18/98; 6:38 p.m. EST)
                    By John Borland, Net Insider 

                    A senior technology adviser renewed the Clinton
                    administration's call for self-regulation in online
                    industries and said the federal government was
                    ill-equipped to keep up with changes online at the
                    Computers, Freedom, and Privacy conference in Austin,
                    Texas, on Wednesday.

                    Brian Kahin, senior policy analyst in the White House
                    Office of Science and Technology, said the government
                    is
                    betting on industry self-regulation in e-commerce and
                    consumer privacy, but needs to see some proposals
                    soon.

                    "If the private sector would come to some agreement,
                    that would transcend national boundaries, and we'd all   
                    be
                    a lot better off," Kahin said in his keynote at the
                    conference, which is hosted and attended by online
                    privacy and security advocates. 

                    Since late 1996, Clinton and his technology advisers
                    have
                    pressed industry leaders to come up with their own
                    proposals to regulate Net commerce transactions and
                    protect the privacy of online consumers. While the
                    private
                    sector has largely welcomed this hands-off approach,
                    business leaders are still far from reaching any kind
                    of
                    consensus on the issue. A group of senior
                    administration
                    officials warned late last month that industry leaders
                    needed to establish some momentum before midsummer
                    or risk Congress taking control of the issue. 

                    But Kahin said the administration was still fairly
                    confident
                    an industry solution would emerge. "We have more
                    confidence that self-regulation can work in the
                    privacy
                    sphere," he said. "There are strong incentives for
                    self-regulation."

                    In addition to the threat of U.S. government action,
                    he
                    cited the European Union's strict new privacy
                    guidelines,
                    which are scheduled to take effect in October. These
                    laws would bar exporting an individual's data --
                    perhaps
                    even personnel information between branches of a
                    single
                    multinational company -- out of Europe to a country
                    without "adequate" privacy protections. 

                    Since the U.S. does not have strict laws governing
                    private
                    use of individual information, corporations that do
                    business on both sides of the Atlantic could put
                    themselves at risk if they don't create their own
                    standards. "Europe could cut off the data flow to the
                    U.S.," warned Peter Swire, an Ohio State University
                    law
                    professor who is writing a book on the European
                    regulations. Swire spoke on a pre-conference panel
                    Wednesday.

                    To avoid disruptions in business, U.S. companies need
                    to
                    come up with privacy standards this year, Kahin said.
                    "If
                    self-regulation doesn't work, we may be in for a
                    serious
                    international problem," he said.

                    Kahin said government needed to maintain an oversight
                    role, to keep business focused on policy questions.
                    "There
                    are limits to self-regulation," he said. "Businesses
                    will
                    look at their business needs first. They'll focus on
                    the
                    strategic environment and not the policy environment." 

                    But the speed of technological and commercial change
                    on
                    the Net makes it difficult for policy makers and
                    regulators
                    to retain their traditional hands-on approach, he
                    noted.
                    "In this kind of space, policy-making might just be
                    too
                    hard," he said. "Following it is too fast for the
                    usual
                    government processes, let alone trying to anticipate
                    where it's going."

---

From: Karl Auerbach <[email-masked]>
Date: Thu, 19 Feb 1998 13:43:29 -0800 (PST)

> But Kahin said the administration was still fairly confident an industry
> solution would emerge. "We have more confidence that self-regulation can
> work in the privacy sphere," he said. "There are strong incentives for
> self-regulation." 

Too bad the US Government does not respect its own laws on the privacy of
computerized information.

For example, the National Science Foundation uses contrived argumentation
to attempt to wiggle its way out of compliance with the Privacy Act of
1974 (5 USC 552a) with regard to the protection of the privacy of domain
registration information.

See http://www.cavebear.com/nsf-dns/ for more details.

	--karl--

---

From: "Timothy Glenn Stockstill" <[email-masked]>
Date: Fri, 20 Feb 1998 03:55:53 -0500

The position taken by the NSF on this matter is correct.

You are only required to give this information if you
are registering a domain name.  If you do not want
to give this information to NSI you have options
available to you.

ONE: DO NOT REGISTER A DOMAIN.

By registering a domain, you are making your self
responsible for the domain, at that point it is
necessary that the Internet community be able to
contact you.  I have at least 10 or so domains
registered where I am either the technical or
administrative contact for.  I understand the
importance of having my information available.
If you do not want to release your information do
not register a domain.  This does not prevent you
from being on the internet, just from being the
administrative, technical, or billing contact
for a domain.  This does not prevent you from
having your own domain, just have your ISP,
register it.

TWO: REGISTER THE DOMAIN IN THE NAME OF
     AN ORGANIZATION

Create an organization to use to register all of
your domain names.  This organization does not
have to be a Incorporation, it could be a
Partnership, Sole Proprietorship or un-incorporated
Association.  Register you domain using the
organizational information for all the contact
information.  For the address, use the physical address
of your server, or the PO Box of the organization.
Use your title in the organization rather than your
name, and use the phone number of the organization
for the number of contact.

Of course under current law in almost every state, you
will have to give your Name, and address information
to the State when you apply for your occupational license.
This information is of course avalable to the public.

If you have not registered a domain you are not in
the NSI database.  If you have registered the
information then you are.  You are not required by the
Government of the United States or any other to register
a domain name.  You have the choice not to register,
If you want to register a domain, that you have to take
the responsibility of making your self available to the
members of the Internet community (you are responsible
for the domain and the activities of it).

If you do not think the FoIA is a valid point in this
argument.  Which considering the person registering the
domain is taking responsibility for the domain is a
ridiculous position.

LET US EXAMINE A FEW PLACES WHERE FoIA has already been
proven, and held up.

ONE:

If you want to apply for a patent, copy right, or
trade mark you have to make the same information
available (except for the e-mail address) to any
one who want to search through the database.

TWO:

If you want to open a business, in every state
that I am aware of you have to give this same
information (except for e-mail address) when
you apply for your occupational license, this
registration is also available for searching.

THREE:

If you purchase a house, this same information
(except for e-mail and telephone) is registered
with the state (at least every state i am aware
(Thus available to anyone who goes to the Clerks
office and looks it up).

FOUR:

If you are sited (not convicted but just sited)
with a traffic ticket, this same information is
made available (except for e-mail address) to
anyone who searches the database.

FIVE:

If you file for a devoice this same information
is made available (except for e-mail address
and phone number) to anyone who searches the
database.

There are of course more, but I think the point
has been significantly proven.

If you still have a problem with this policy then
just Register a domain, and sue NSI in civil
court, like the RPA provides for (You will loose
and it will cost you a lot of money, but you have
that right) and quit sending annoying e-mails
whining about the situation.

--
Timothy Glenn Stockstill
The Ultimate Software Group
mailto:[email-masked]

The opinions expressed here are my own and do not represent
the views or opinions of the Ultimate Software Group, Inc.

---

From: Karl Auerbach <[email-masked]>
Date: Fri, 20 Feb 1998 11:07:22 -0800 (PST)

> The position taken by the NSF on this matter is correct.

Which position?  You mean the one in which they say that the contact
information for domain names is the sole and private property of Network
Solutions, Incorporated, a private, for-profit corporation?

You mean the position where they say that even though the NSF paid NSI to
collect this contact information, aggregate it, and publish it, that it is
not the property of either the NSF/US Gov't or of those individual who
provided it? 

They did say these things, you know, in their response to my Privacy Act
request.  See these statements from NSF at:
		http://www.cavebear.com/nsf-dns/nsf_dec24.htm

That's how they evaded the issue of whether the information is covered by
the Privacy Act -- they simply said, that information is not our's, it is
NSI's. 

(That position will, of course, make it very difficult for the US
Government to get to those records as needed to implement NTIA's "green
paper".)

(And it gives NSI an exclusive ownership of a rather valuable and high
quality collection of names, addresses, phone numbers, company
affiliations which they can sell or license to spammers, telemarketers, or
those who build profiles about individuals [such as the Lotus CDROM of a
couple of years ago].) 

You, unlike NSF, are dealing with the correct issues: How much information
should be gathered and where should it be allowed to flow.

But I do disagree with your analysis of those questions. 

> ONE: DO NOT REGISTER A DOMAIN.

Sure, one can avoid registering a domain.

But if one does chose to register a domain then one must provide
information to a government contractor, operating under a government
contract to gather, aggregate, and publish contact information.

The basic notion of privacy is that to take advantage of a government
offered service one should not have to reveal excessive amounts of
personal information to the whole world, or even beyond the agency.

In other words, the purpose of the privacy act is to prevent situations in
which one must chose between foregoing use of a service or giving up ones
privacy.

> contact you.

No one is saying that contact information isn't useful.  But the Privacy
Act requires an agency to create and publish an explicit statement that a
database exists, who controls it, and what policies are used to protect
it.  NSF has done none of that.

The agency must also gather only the minimal information needed to do its
task.  In the domain name case, that would be probably one of either the
tech or billing contact, but certainly not the admin contact.

Moroever, the Privacy Act requires that gathered information not be made
available beyond its direct use.

Yet NSF has required NSI to publish the whois database.  That is a direct
violation not only of the inter-agency use restrictions in the Privacy
Act, but also the provisions in the Act against using the list for a
mailing list.

The point is that NSF hasn't even bothered to come up with a policy in
which they justify gathering what is being gathered.  Perhaps they can
justify gathering it.  But they didn't even try.  They didn't even bother
to note the existance of the whois database among the dozen of databases
that NSF does list in its Priv. Act notices in the Federal Register. 

And when one asks NSF, they don't even give arguments which pertain to the
data, as you did.  Rather they simply say "not our data, it's the property
of NSI".

In other words, not only has NSF not thought about the privacy aspects of
domain name contact information, but they have abandoned that information
into the hands of a private, for-profit, corporation which can then feed
it to spammers and telemarketeers.

> your domain names.

You have just contradicted yourself.  You are saying, "cloak youself"
before you register.  That indicates that you clearly don't really think
that the contact information is really all that important to running the
net.

In addition, you missed the point that when there is a human name, the
Privacy Act requires protection of that information.  Just because you
might want to register your contacts as "the anonymous corporation" should
not vitiate the rights of those who have registrations giving useful
contact information.

> This information is of course avalable to the public.

You are incorrect.

Information given to the Federal agencies is protected by the Privacy Act.
States have privacy laws of their own.  In California, the right to
privacy is in the state constitution.

I am a member of the California State Bar, an organization chartered by
the State of California.  I had to give them a data sheet bigger than I
had to give the DoD when I got my security clearance.  Nearly all of
that information is not made public.

Moreover, in many cases, when databases are visible to the public, those
who wish to examine a record must present identification and logs are kept
of who accesses what record.

> argument.

Who said Freedom of Information Act?  I'm talking Privacy Act.  They are
different statutes, with different sections.  FOIA is 5 USC 552 and
Privacy Act is 5 USC 552a.  That little "a" makes a world of difference.

Take some time to read it.  It's not long (at least not compared to
something like the Internal Revenue Code.)

		--karl--