Schneier on Security

Clive Robinson • June 22, 2018 11:46 AM

@ Bruce, Even, me,

Speaking of illegal acts with regards Domain Names, have you looked into what ICANN has been upto with regards compleatly failing despite well over two years warning to become Compliant with the GDPR?

Apparently ICANN decided that a good prevarication approach having been rejected several times by the EU is taking legal action against a subsidury of Tucows that is a Internet Register for ICANN and thus pays the supposed “non-profit” income.

The German court unsprisingly took little or no time to reject ICANN’s delaying tactic as it was an obvious “hot potato” issue.

ICANN are now trying to rather dumbly “double down” on their failings basically chalenging the German judiciary to push it up to the ECJ…

All that it will take to destroy ICANN will be for one European to make a formal complaint about the ICANN Whois service, and a big fat fine will be on it’s way…

Oh and if the US Gov or other entity tries to bail out ICANN that leaves ICANN open to further EU legislation that is backstopped not by fines but prison time…

ICANN by failing to take any proactive action before the GDPR deadline then trying to prevaricate subsequently have basically not just shot themselves in the foot they have also given the European courts sufficient rope to “hang’em high”…

It’s no secret that the real driver behind ICANN’s position over the Whois service is the data agrigators that aid the US Gov IC in it’s “collect it all” policy and the worst floating scum “shysters” pretending to be legitimate IP lawyers, that send out all sorts of “shakedown” letters as a way of earning a living.

Interestingly the only arguments being made by the security researchers and journalists like Brian Krebs are identical but opposit to a subset of privacy campaigners thus actually cancel out, leaving the privacy campaigners ahead of the game.

The classic argument is “tracking down criminals”, however it would be a dumb criminal that did not use either fake or stolen credentials (major method currently). Brian Krebs argues that in some small number of cases the criminals make mistakes and cross contaminate their criminal IDs with tiny fragments of their pre-criminal activities that might provide small threads that can be pulled upon. Whilst this might be true, it’s the way Brian earns his living[1] thus the fact that the bulk of the crimal usage is with stolen IDs or Domains means way way more innocent people are left very very vulnerable for his convenience. But I suspect that Brian maybe being economical with the truth, I very much doubt that the use of Whois is the only way he can track supposed criminals down, just the easiest cost/effort for him.

But as Brian has demonstrated in one of his pieces the likes of the Scientology Cult has payed people to make false applications for a few dollars such that they can run faux rehab centers that are not just dangerous (ie causing death) but push the Cult of Scientology with all the damage and debt that brings into peoples lives.

[1] There is an old saying about “The impossibility of persuading a man of the wrongness of his opinion, when his living depends on his being wrong”.