ICANN, the "not-for-profit public benefit corporation" which coordinates the naming system of the internet recently announced some disturbing plans to take over the running of domain privacy services and to stop those services from providing, well, domain privacy.

Here’s a good tl;dr from the NearlyFreeSpeech.net article ICANN’s assault on personal and small business privacy. It is worth reading the whole thing if you have time.

… Driven in no small part by the people who brought you SOPA, they have a three-step plan:

1. They will introduce a new accreditation program for domain privacy providers, complete with fees and compliance headaches. (Meaning higher costs for you.)
2. As a condition of accreditation, require domain privacy providers to adopt privacy-eviscerating policies that mandate disclosure and, in some cases, publication of your private information based on very low standards.
3. They will require ICANN-accredited domain registrars (i.e. all domain registrars) to refuse to accept registrations that use a non-accredited domain privacy provider, thus driving any privacy provider that actually plans to provide privacy right out of business.

Here are some of the great ideas they’re considering:

• Barring privacy providers from requiring a court order, warrant, or subpoena before turning over your data.
• A policy based on the “don’t ask questions, just do it” model of the DMCA. Except that with the DMCA your site can be put back after an error or bogus request; your privacy can never be put back.
• Requiring privacy providers to honor law enforcement requests to turn information over secretly, even when under no legal obligation to do so.
• Outright banning the use of privacy services for any domain for which any site in that domain involves e-commerce.

An open letter

Here is my stiffly worded open letter to ICANN.

Perhaps if enough people tell them how deeply misguided they are, they might listen. Add your voice by emailing ICANN about it before 7 July.

Subject: Please do not take away effective domain privacy services at the behest of copyright extremists

Hi ICANN,

Your plans to require privacy proxy services to register with ICANN and to require them to hand over personal data at the behest of anyone who can write a convincing looking letter (with no effective redress) are deeply misguided.

For some people on the internet, anonymity and privacy are literally a life or death matter. Think, for example of:

• Dissident bloggers critical of totalitarian regimes
• Websites run by and for survivors of domestic abuse
• QLGBT poeple writing about their experiences of oppression
• People of colour speaking out about their victimization by the police
• Whistleblowers criticizing multinational corporations

Demanding that privacy measures are ineffective and seeking to circumvent the normal legal process (for example by not requiring a court order before releasing information related to domain registrations) could endanger lives as well as being in fundamental conflict with principles of data protection, privacy and anonymous free speech that democratic societies hold to be essential.

The right of copyright extremists to demand personal information with menaces does not trump these fundamental democratic rights. And even if it did, it is certainly not ICANN’s role to decide who is allowed to exercise their right to privacy or anonymous free speech. That’s why democratic societies have courts.

The requirement that "domains used for commercial purposes" should be ineligible for privacy registrations is also misguided.

What if I am a VPN provider in Asia, used by people in China to access information prohibited by the Chinese state? I might be charging for my services -- that sounds commercial. Your proposal will make me an easy target for the human rights abusing Chinese state.

Instead of merely serving the panopticonist interests of the music and film industry, the working group should recommend the continued provision of strong privacy protections -- perhaps stronger than now.

Privacy services should require due legal process before releasing private data and those whose data is being requested should be informed and given the right to defend their privacy in court.

Privacy proxy services should remain independent, and not regulated, monitored or governed by ICANN -- already something of a monopoly and not suited to making unilateral decisions about internet privacy. ICANN should stick to its intended purpose and stop trying to extend its powers.

Cheers, Charlie Harvey