Dear Mr. Neuman and Members of WHOIS Task Force 1:
As Director of the Office for Information Technology Policy of The American Library Association (ALA), I am pleased to submit these comments to WHOIS Task Force 1.  The American Library Association (ALA) is the oldest and largest library association in the world with some 64,000 members, primarily
school, public, academic and some special librarians, but also trustees, publishers, and friends of libraries. The Association's mission is to provide leadership for the development, promotion and improvement of library and information services and the profession of librarianship in order to enhance learning and ensure access to information for all.  ALA is also a member of the International Federation of Library Associations, an organization which devotes considerable energies to information policy issues, including privacy and fair information practices.

ALA represents the interests of libraries and archives; we also represent the interests of our patrons.  As an “internet service provider,” our members offer Internet access, services and education to millions of patrons who use the Internet through our library facilities..

ALA has a long traditional of protecting the rights of its member libraries and archives, and our and patrons.  Our commitments include:
 
	-	Resisting abridgement of free expression and free access to ideas
	-	Protecting privacy and personal information
	-	Advancing intellectual freedom.
		See Library Bill of Rights and ALA's Task Force on Privacy and Confidentiality in the Electronic Age http://www.ala.org/ala/oif/statementspols/statementsif/librarybillrights.htm and 
		http://www.ala.org/ala/lita/litaresources/taskforceonpriv/alataskforce.htm
		
Before addressing the specific issues of the TF1 report, we would like to offer a general statement regarding privacy and fair information practices relevant to this WHOIS discussion.

ALA believes that ICANN policies regarding the privacy of personal information in registrar databases should be, at minimum, grounded in the international concept of fair information practices. Over the last thirty years, these principles in one form or other have become the foundation for national privacy laws, international agreements, and voluntary codes of conduct all over the world. It would not only be aberrant for an international organization such as ICANN to establish policies that ignore these principles, it would place registrars in an untenable position between privacy laws of their national governments and ICANN policy. It would put ICANN at odds with a global consensus on the proper and fair treatment of personal information.

Among the principles, ALA particularly points to two as relevant for this Task Force report:

Limitations on Disclosure: Unless compelled by law, data collectors should not disclose personal information to third parties without explicit permission of the data subject. This principle is fundamental to the treatment of transaction records of library users, for example. The example below of this principle in action in the commercial sector comes from the privacy statements on the AT&T web page.

“AT&T will not sell, trade, or disclose to third parties any customer identifiable information derived from the registration for or use of an AT&T online service -- including customer names and addresses -- without the consent of the customer (except as required by subpoena, search warrant, or other legal process or in the case of imminent physical harm to the customer or others).”

Limitation on collection: Only information specifically needed for the intended purpose should be collected, and it should be retained only as long as it is needed for that purpose. Many, if not most libraries, for instance, will destroy lending transaction records when a book is returned, since it is no longer required for library operation. Another example of collection limitation in the case of government agency practice comes from the 1974 Privacy Act (US):

Each agency that maintains a system of records shall-- …  maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by Executive order of the President; Privacy Act of 1974 (US).

ALA believes these international principles are fundamental. Its model library privacy policy (http://www.ala.org/ala/oif/iftoolkits/toolkitsprivacy/libraryprivacy.htm#modelprivacy) contains the following statement:

“In all cases we avoid creating unnecessary records, we avoid retaining records not needed for the fulfillment of the mission of the library, and we do not engage in practices that might place information on public view.”

We believe that personal data collected by registrars should be treated with the same level of privacy consideration, and the Task Force 1 Report does not give these principles sufficient attention or weight in its recommendation.

ALA now responds to specific issues raised in the TF1 report.

A.	Sensitive Data and Port-43

ALA agrees with finding of TF1:  the less sensitive the data in WHOIS, the less value it offers, the less likely it is to be mined, the less the impact on individuals’ privacy rights, and the less incentive the registrant has for making the data inaccurate.
	
ALA also agrees with TF1's conclusion that unless all “sensitive data” can be stripped from the WHOIS database/directory, then access to Port 43 system should be eliminated to the public and “should be available to Registrars solely for the purpose of carrying out its obligations with respect to transfers of domain names between registrars.”

B.	Non-Sensitive and Sensitive Data Categories

In its report, TF1 sets out categories of non-sensitive data.  ALA agrees with the fields that TF1 chose for non-sensitive and sensitive data.  TF1 Report, Footnote 16.   Given ICANN’s mission, the WHOIS database/directory should include technical data and contacts.  But the registrant and administrative contact fields (often the same for smaller libraries, archives and many individuals) rarely run their own name servers or website.   

We note that TF1 included information on the use of the WHOIS data in its report, but did not discuss its misuse and abuse.  ALA asks that TF1, in its final report, include a detailed discussion of the abuses raised by Constituencies and the At-Large Advisory Committee (ALAC).  The concern over harassment and intimidation of a domain name registrant, solely for the controversial or provocative nature of his or her speech, must be discussed.  Obviously, there is a strong need to find and prosecute those who fraudulently sell goods to the public, or masquerade as another, but the rights of the vast majority of Internet domain name registrants must not be abridged in the process. 

C.  	Access to Sensitive Data Should be Highly Restricted

ALA agrees with those in TF1 who state:
“[They] do not believe that any Requestor should be entitled to the Sensitive Data unless retrieval of such information was pursuant to a formal request by law enforcement (i.e., subpoena.”) TF1 Report, Section C(8).

This “legal process” solution if adopted would quickly solve many of the other problems associated with WHOIS database/directory.  Registrars would know where and to whom to disclose the data.  Registrants would know that a judge or magistrate reviewed the allegation and found at least some basis for breach or illegality.  Balance and limits of abuse would be a result of such a system. 

D.	Further questions of TF1, including White List, Individual Use, and Notification

	1.  White List vs. Individual Use 
As discussed above, neither the White List nor the Individual Use proposal meet ALA’s free speech and privacy concerns.  However, should ICANN move in this unfortunate direction, ALA expresses these further concerns and views.

A White List approach for access to the sensitive data fields of registrant and administrative contact fields is unacceptable.  The idea that a “known user,” such as a big business, law firm, publishing house or reporting company having essentially unlimited access to the WHOIS data (including access regulated by cost), is unreasonable, tied to no protection of privacy, and beyond the scope of what TF1 and ICANN can and should recommend.   

The Individual Use method, where the data requestor makes a single request, is the better option. This method does not provide the data requestor with a sense of entitlement to the sensitive data of the WHOIS database/directory.  It requires that the data requestor specifically identify itself, the specific need for the sensitive data for a given domain name, and agree to limitations on the reuse of the data (e.g., resale).  

The Individual Use method raises concerns for privacy and free speech, but at least provides a method for accountability and oversight of those who request and use the sensitive WHOIS data.  

	2.  Notice to Registrants regarding Reason for Request

TF1 posits the need for notice to Registrants.  ALA strongly agrees.  Domain name registrants need to know that their sensitive data has been disclosed.  Those requesting sensitive data must be required to give a clear, detailed and specific explanation for their legal needs for this data.  This explanation, data requestor identity, and time and date, must be transmitted to the domain name registrant in a timely manner.   Should access short of subpoena be allowed, then timely notice is a critical part of its balance and fairness.

TF1 asks a specific question regarding notice and the reason for the sensitive data request: 
“If entities on the White or Individual Use List must give the reasons for their queries, how does (or can) that information be delivered to registrants?”  

Email is the most likely solution. Even if the sensitive data request system is an automated one, the template must ask questions regarding the detailed and specific legal reason that sensitive data is needed.  That field string, through an automated process, can be easily placed into a software-generated email and transmitted to the registrant. 

We urge TF1 to place such obligations in its final report.

E.	National law
ALA seeks to respond to the question posed by TF1 to comments in section C(3) on national law.  TF1 writes:
“All Registries and Registrars are currently required to provide access to WHOIS information via web-based access and Port 43 regardless of their applicable national laws on privacy.  In fact, some have argued that complying with their ICANN Agreements placed them in a position of choosing whether to violate their ICANN Agreements or violating national. Law.  On the other hand, the Task Force did note that allowing each registrar or registry to rely on its own “national law” could have significant impacts on competition among registrars and even within the registries.  Comment is sought by the Task Force on how to balance the requirements of national law with the ICANN mission of promoting competition.”  

We see no real dilemma here.  Markets of all kinds operate within a framework of existing laws and regulations, and the registration industry must do the same.  It is ICANN who must harmonize with existing free speech and privacy laws, not require that these laws be waived or set aside online.  

According to data provided by TF2, half of ICANN’s accredited registrars operate in countries with comprehensive data protection legislation.  Therefore, promoting competition requires ICANN to create a baseline for the collection and disclosure of sensitive data that is consistent with these rules, not opposed to it. 

F.  A Missing Part of TF1's Work
ALA notes that TF1's work lacks any discussion of the fundamental right to communicate anonymous. Obviously the domain name system, with its ability to create places online that can be bookmarked and linked to with clear and easily circulated URLs, is a critical part of worldwide communication today.

The US Supreme writes that anonymous speech is a crucial part of not only US communication, but world history:

"Anonymous pamphlets, leaflets, brochures and even books have played an important role in the progress of mankind." Talley v. California, 362 U.S. 60, 64 (1960). Great works of literature have frequently been produced by authors writing under assumed names.  Despite readers' curiosity and the public's interest in identifying the creator of a work of art, an author generally is free to decide whether or not to disclose her true identity. The decision in favor of anonymity may be motivated by fear of economic or official retaliation, by concern about social ostracism, or merely by a desire to preserve as much of one's privacy as possible. Whatever the motivation may be, at least in the field of literary endeavor, the interest in having anonymous works enter the marketplace of ideas unquestionably outweighs any public interest in requiring disclosure as a condition of entry. 

McIntyre v. Ohio Elections Comm'n (93-986), 514 U.S. 334 (1995).   Accordingly, ALA advises ICANN and TF1 to find a way to protect anonymous speech.  Creating protections for sensitive data and privacy is a good start, but ICANN must do more.  

ALA asks TF1 to recommend creation of a process to review domain names being canceled for inaccurate data and failure to update.  Such a process might include creation of a group empaneled from public interest organizations which would review the domain names, the available websites, and content associated with that domain name, and the reason for the complaint filed against the domain name.  If the panel finds that the use of the domain name is protected under traditional values of free speech and human rights, then it would remove the domain name from the delesion list.  

After all, 
“.... anonymous pamphleteering is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent. Anonymity is a shield from the tyranny of the majority. See generally J. S. Mill, On Liberty, in On Liberty and Considerations on Representative Government 1, 3-4 (R. McCallum ed. 1947).

McIntyre v. Ohio Elections Comm'n.

Conclusion

ALA thanks TF1 for this opportunity to comment on its work. 

Frederick Weingarten
Director, Office for Technology Policy
American Library Association
1301 Pennsylvania Avenue NW, Suite 403
Washington, DC 20004