My weekly Law Bytes column (Toronto Star version, BBC version, homepage version) examines the recent agreement between ICANN and the U.S. government. Late last month, ICANN took a major step toward addressing some ongoing concerns by signing a new agreement with the U.S. government entitled the Joint Project Agreement. ICANN immediately heralded the JPA as a "dramatic step forward" for full management of the Internet's domain name system through a "multi-stakeholder model of consultation." It added that the agreement grants it unprecedented independence by removing many of the U.S. government’s oversight controls. These include the elimination of a twice-annual reporting requirement to the U.S. Department of Commerce (ICANN will instead release a single annual report targeted to the full Internet community) and a shift away from the highly prescriptive policy responsibilities featured in the original ICANN contract.
While the JPA may indeed represent an important change, a closer examination of its terms suggest that there may be a hidden price tag behind ICANN newfound path toward independence – the privacy of domain name registrants.
Given that a newly independent ICANN might continue to pursue WHOIS reform, the U.S. government included a specific provision on the issue within the JPA. It mandates ICANN to "continue to enforce existing policy relating to WHOIS, such existing policy requires that ICANN implement measures to maintain timely, unrestricted and public access to accurate and complete WHOIS information, including registrant, technical, billing and administrative contact information."
The implications of this clause seem clear – the U.S. government has undone five years of policy work that the Internet community has undertaken by requiring ICANN to enforce current WHOIS policies. As discontent over the WHOIS issue mounted late last week, ICANN CEO Paul Twomey offered a strained interpretation of the clause, suggesting that he did not believe that it restricted future WHOIS reforms.
A more realistic take is that ICANN and the U.S. government have once again undermined the confidence of the Internet community and have provided a clear signal that the U.S. government is still reluctant to transfer its oversight authority. In its zeal to obtain independence, it would appear that ICANN has bartered the privacy of millions of domain name registrants around the world.
