4-2 Information Disclosure via WHOIS Service

1. Purpose of WHOIS Service

The Internet is beset by not only technical troubles affecting network connectivity, but also all manner of troubles such as spam and other disruptive mails, harassing behavior such as sending large quantities of E-mail ("mail bombs") simultaneously, cracking activity that takes advantage of system vulnerabilities, etc. Lately, we have also begun to hear of intellectual property right claims pertaining to domain names. What measures can be taken to resolve these problems?

The Internet is a wide area network whose functionality depends on the autonomous control of each component network. Network Information Centers (NICs) such as JPNIC, and Internet Registries (IRs), are organs that perform resource allocation and registration, but there as yet exists no organ dedicated to the maintenance and management of the Internet as a whole.

Against this backdrop, JPNIC provides its WHOIS service as an information source to help Internet users resolve troubles on their own. Users wishing to resolve inter-network troubles may look up the contact information of the other network through the WHOIS service, which enables the users to resolve their problems with each other on their own directly, without the need to involve any operations-managing organ.

The WHOIS service is also utilized extensively for the purpose of checking whether or not a desired domain name has already been registered.

It is a matter of worldwide consensus among Internet users today that NICs should provide WHOIS services that meet the two objectives mentioned above.

Furthermore, JPNIC makes registered information available to the Internet community through its WHOIS service, to show that registration operations are being carried out in accordance with the rules.

2. Changes in the Social Environment

The Internet continues to expand while always be an infrastructure of new services. At the same time, changes are occurring in the way the Internet is used. For example, as low-cost dedicated lines and hosting services proliferate, individuals who were once only information consumers as end-users are increasingly becoming information senders as well. Amid this development, parties registering their domain names and being assigned IP addresses are no longer restricted to academic research organs, corporations and other organizations, as individual users are beginning to join them increasingly.

In an effort to meet the objectives outlined in the preceding paragraphs, JPNIC has been providing on-line information about resource users and their contact information in the form of a WHOIS Service. The increase in information registration by individual users does bring with it the registration of personal information such as individual addresses, phone numbers, and so on, as part of assignment and registration information. With this type of information becoming accessible on-line through the WHOIS service, troubles are beginning to occur with increasing frequency.

3. Modification of JPNIC Information Disclosure Policy

JPNIC's approach to information disclosure has been based on "Principles derived from the autonomous development of the Internet." But a rethinking of this approach is being necessitated today by the rapid increase of individual Internet users over the last few years, and by social trends in Japan and other countries concerning the protection of personal information.

To study this issue, JPNIC has created the "Database Privacy Issues Task Force (DBPI-TF)." Discussions have since been in progress regarding, as an NIC, what sort of policies should be in place to provide information services; what information should be disclosed; and what information should be classified as undisclosable.

In the summer of 1998, the DBPI-TF made public an interim report entitled, "Regarding Disclosure of Personal Information by JPNIC's WHOIS Service"^[*1]. Further study of the issue led to the conclusion that it was necessary to modify the existing information disclosure policy in response to society's calls for personal information protection.

4. Basic Principles

The following are JPNIC's operative basic principles regarding the handling of information. By the time this Newsletter reaches you, a new information disclosure "policy document" based on those principles will have been posted on JPNIC's Web site. For more specific discussions, please refer to those pages.

Policy for Information Collection

JPNIC will collect information from registrants or allocatees. This will only be information that is required under the domain name registration rules or IP address allocation rules, in order to serve the purposes stated in said rules. The collected data will be used solely for business purposes within JPNIC and not for any other purpose.

Information Disclosure Policy

What information to disclose to whom, in what manner, and for what purpose will be clarified. When disclosing information, it is necessary to provide by proper means only the information that is essential to the attainment of a given objective.

5. Change in WHOIS Output

The WHOIS output format will undergo changes to ensure compliance with the new policy. From the standpoint of personal information protection and release of adequate information, some of the items of information that have been disclosed up to the present may no longer be displayed. For specific changes or new schedules, please refer to announcements on the JPNIC's Web site.

6. International Cooperation

An APTLD (Asia-Pacific Top-Level Domain Forum) workshop was organized on February 27 in Seoul, Korea, within the framework of APRICOT2000. On that occasion, JPNIC presented the substance of the arguments made to that point by DBPI-TF, and made an explanation of its latest information disclosure policy. Discussions ensued among the delegates of NIC from each country, registries and registrars. Discussions are to continue into the future on a sustained basis, with those concerned from participating countries keeping in close contact with each other.

7. Conclusion

Bearing in mind the matter of personal information protection, what is the most appropriate manner to disclose information? This is an issue that must be dealt with so that individual Internet users, whose numbers will continue to grow in the years to come, may use the Internet with peace of mind. Following an earnest study of this issue, JPNIC has reached the conclusion that there is a need for a change in policy. JPNIC herewith asks for the understanding and support of the entire Internet community.

---

[*1] "Regarding Disclosure of Personal Information by JPNIC's WHOIS Service"
http://www.nic.ad.jp/jp/topics/archive/19980824-01.html