In article <telecom24.555.4@telecom-digest.org>,
Zonk <zonk@telecom-digest.org> wrote:
> Posted by Zonk on Thursday December 08, @01:01PM
> from the seekrit-webmaster-conspiracy dept.
> bakotaco writes "According to research carried out by the US
> Government Accountability Office (GAO) many domain owners are hiding
> their true identity. The findings could mean that many websites are
> fronts for spammers, phishing gangs and other net criminals. The
> report also found that measures to improve information about domain
> owners were not proving effective." From the article: "The GAO took
> 300 random domain names from each of the .com, .org and .net
> registries and looked up the centrally held information about their
> owners. Any user can look up this data via one of the many whois sites
> on the net. The report found that owner data for 5.14% of the domains
> it looked at was clearly fake as it used phone numbers such as (999)
> 999-9999; listed nonsense addresses such as 'asdasdasd' or used
> invalid zip codes such as 'XXXXX'. In a further 3.65% of domain owner
> records data was missing or incomplete in one or more fields."
> To discuss this matter further, please go to:
> http://telecom-digest.org/chat/index.html
> [TELECOM Digest Editor's Note: As the official Keeper of the Records,
> ICANN was asked for a comment on this report, but they refused any
> discussion of it. PAT]
"Figures don't lie, but liars can figure." The last line of the cited
report is a particularly egregious example of this. One of the domain
owner fields is a for a 'fax' number for contact. If you don't have a
fax then, *of*course*, that field is going to be 'incomplete' -- or
filled with some registrar 'default', recognizably *invalid*, data --
e.g. (000) 000-000, or (999) 999-999. The '5.14%' number is similarly
suspect, _if_ the 'phone numbers' examined include the 'fax phone
number' field.
And, unless the GAO restricted the check to domains registered to
addresses in the USA, 'defective' and/or 'missing' *ZIPCODE* data is
to be expected. Even Canada doesn't have _ZIP_ codes. that said, I
figure that this one is a gratuitous error on the part of the person
writing the review of the GAO report, rather than a procedural flaw in
the GAO analysis.
That said, I expect the GAO report did find evidence of real problems
in the registration process. Too much 'trust', and not enough
'*trust*but* *verify*'. For U.S.A. based addresses, there is simply
no excuse for accepting a registration where the street address and
"postal code" do not match. The USPS has an on-line look-up tool
where the full ZIP+4 can looked up for any particular address. Now,
admittedly, some addresses may have multiple ZIP+4 codes -- e.g. my
building has distinct zip+4 for each of several groups of residents,
_and_ a 'catch all' ZIP+4 that is valid for any address in the
building. I think there may be yet another '+4' that identifies
'some/any building on this block'.
A number of other countries have similar publicly accessible tools for
validating addresses, postal codes, and/or the combination thereof.
The fact that registration services do -not- make use of things like
that to make even a 'minimal' attempt to keep the database 'clean'
*is* an outrage, and an abomination, no doubt about it.
Robert Bonomi (bonomi@host122.r-bonomni.com)