8 May 2016

Push for privacy in domain game

10:07 am on 8 May 2016

People registering for New Zealand website domain names could keep their details secret in certain cases for the first time.

no caption

Photo: 123rf

Following two rounds of public consultation, the Domain Name Commission, a subsidiary of InternetNZ, said it was proposing to let people apply to have their contact details withheld from publication under certain circumstances, such as if their personal safety was at risk.

Its spokesman, Campbell Gardiner, said transparency was "a core value" of the .nz domain and it would remain a publicly-available register.

"A big part of the reason why the .nz register experiences very low levels of malicious activity is because registrations can't be made anonymously and registrants are identifiable. Basically it allows people to see who's associated with a particular website or email."

However, the proposal would be introduced in response to submissions about privacy concerns.

It would be an attempt to balance the views of those who wanted a completely open register with others arguing for it to be completely private, Mr Gardiner said.

The commission received about 50 submissions overall, including from the Health Ministry, which argued for sole-trader health providers to have their personal information protected.

"The nature of the work that clinicians and individuals providing health services undertake often places them in difficult positions with patients and family and as a result they can become targets for harassment."

Some website owners said the changes did not go far enough.

One submitter, Wellington software developer Aurynn Shaw, remained unconvinced the latest proposal would be inclusive enough.

"This new proposal allows people to submit and ask if their particular case is severe enough. So we now have a panel of people judging whether I'm being harassed enough, or I'm under enough threat."

The requirement to disclose contact details put an unfair burden on women and minorities, who faced a higher level of "digital assault", she said.

"People cannot register these domains, they can't have a .nz name because they're facing stalkers, they're facing harassment. So they're in a position where they can't participate because of these transparency rules."

Nor was Ms Shaw reassured by the commission's security measures - such as "response rate limiting" to curb DDOS online attacks, in which websites or email addresses are swamped by high volumes of malicious queries, and not publishing historical registrant details.

"The instant anything is published, there's a worldwide constellation of third parties that download it and keep it indefinitely. So even if a domain changes hands, that old information is retained by these third parties.

"In some cases they're spammers, in some cases they've developed a business model in which people who are under threat of harassment will be forced to go to them and have their data expunged."

One blogger, who asked not to be identified, said making home addresses searchable put people "in an unsafe position".

"There's the potential of stalking, 'trolls' harassing you, and as the parent of a young child I find the thought of a paedophile seeing my child online and easily finding out where we live abhorrent."

Submissions close on June 6.