Sweeping new European data protection regulations may have the accidental effect of protecting scammers and spammers by killing the WHOIS system used to link misdeeds online to real identities offline, security experts have warned.
The General Data Protection Regulation (GDPR), which comes into effect in May, contains a raft of measures intended to strengthen data protection for Europeans.But some of the new rights and responsibilities will conflict with decades-old technologies that have provided much-needed transparency on the internet, says Raj Samani, the chief scientist at cybersecurity firm McAfee.
Q&AWhat is GDPR?
Show
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
The WHOIS protocol allows anyone to look up the contact details for the owner of a domain name, such as theguardian.com, google.com or parliament.uk. First standardised in the 1980s, it has become a key part of the toolkit for anyone trying to trace online wrongdoing back to its roots- a digital equivalent of Companies House or the Land Registry, Samani says.
“As an industry one of the first things we often do is use WHOIS data to determine whether something is likely malicious, or whether there’s an indicator of suspiciousness,” Samani explains. “It could be something as simple as ‘hey, look, this name is a name we find registered with other domains’, or ‘this metadata is used for other things’.”
But domain registrations are commercial contracts, meaning that those making a registration have a right to privacy that is hard to square with publishing contact details on the internet, as Sarah Wyld, a product manager at internet services company OpenSRS, wrote in November:
“It’s certainly difficult to argue that there’s a legal basis for openly sharing contact details of a domain’s owner, administrator, or technical contact in the public WHOIS record. And we can’t claim that it helps to accomplish the original purpose for which the information was collected (registering the domain). This means that the public WHOIS system as it exists today is incompatible with the principles of data privacy that the GDPR affirms.”
A further wrinkle is that GDPR-induced changes to the WHOIS system are likely to affect users worldwide, not just in Europe – as with Facebook’s decision to improve privacy tools for its own users. It has prompted a minor geopolitical scuffle, with David Redl, the head of the US National Telecommunications and Information Administration, noting that “the US government expects this information to continue to be made easily available through the WHOIS service.”
Some argue the change is unlikely to have as large an impact as it might initially seem. Many registrars have long offered the ability to keep details private when buying a domain, instead registering the site in their own name, which limits the ability of researchers to catch canny criminals. And law enforcement already has a wider array of tools than private security researchers, such as demanding the registration details direct from the registrars themselves.
But the information published by WHOIS can be useful to more people than just the professionals, Samani says. “A friend of mine was buying a camera over Christmas, and what they did is they looked a the WHOIS information for this website and actually the website had only been registered for a couple of weeks. And it was clearly fake information that had been put in: it was registered under something like “Mickey Mouse”, something equally obvious.”
Tim Chen, the chief executive of analytical firm Domain Tools, agrees, noting “it’s difficult to make broad statements about the interest of a ‘typical’ member of the public.
“Yes, members of the public who strongly favour their own privacy will likely look kindly on a change like this. Other members of the public want their information to be in WHOIS so that anyone navigating to their website can know who they are dealing with.
“There are more thoughtful and effective ways to meet privacy concerns than simply redacting all the contact fields.”
