.nz domain names should be safe by default

The Domain Name Commission, who control the .nz domain name space, are currently running a consultation on whether to allow domain registrants to make their contact details private. I have previously commented on this. This is the third round of consultation, the previous round received 24 responses and raised a number of key issues that those in favour of private registration by individuals see as needing to be addressed:

• No amount of education avoids the naive expectation that details are not published on the internet as a whole. Terms and Conditions, even checkboxes in bold do not appear to be sufficient to counter the natural expectation that the details are between the registrant and the registrar. Submissions such as this one and this one show this is a genuine issue.
• The information made available is broad — full name, address and phone number included. The consequences of mistaken disclosure, or a transition from a state where disclosure is irrelevant to one where there is a threat to physical safety, are far greater than if the contact details were restricted to a minimum by default.
• Privacy is available to those who can afford a lawyer to hold the domain in trust, or to corporates who can register with corporate contact details instead of an individuals. This discriminates against low income citizens, who should have equal right to the .nz space privately. Worse, those vulnerable to the above two points are disproportionately from this group.

Those in favour of the existing system of mandatory public registration see the system as:

• Protecting the .nz namespace from abuse by forcing domain holders to be visible to take responsibility for their actions.
• Allowing copyright, patent and trademark holders easy access to registrants without the need to go via an intermediary.

While both sides have valid points, the DNC appears to have taken the position that the burden of trying to meet these conflicting goals should fall to the individual registrants. They propose that all registrations will remain public by default. Should a registrant wish to obtain a private registration, they must use an alternative method of registration via the DNC themselves, justify their position using various forms of proof of potential harm, and regularly re-justify their status.

On the face of it, this appears ridiculous. Those who predominately benefit from the public registration details of individuals (as opposed to companies) are well resourced. Lawyers and corporates can easily educate themselves in processes to request access to data and justify time spent navigating those processes. Vulnerable individuals do not have remotely comparable resources, are less likely to be technically savvy, or even understand the existence and role of the DNC.

Given this, how is it possible that the proposed process puts the onus on the vulnerable individual? Is the threat to the .nz space by private registration so potent that we see the inadvertent release of very private information as an acceptable cost? surely this is nonsense - other TLDs still manage to function while permitting private registration.

In a time in which we are furiously trying to educate New Zealanders on how to stay safe on the internet, when social engineering attacks leverage data like this to compromise individuals and companies alike, when online bullying is regularly front-page news, the DNC should be taking concrete steps to enhance the safety and privacy of the many individual .nz domain holders. This review is a huge opportunity to achieve this, but the proposed policy change does the exact opposite — it risks demonstrating that the DNC does not care for the privacy of New Zealand citizens online.

The DNC must allow all registering individuals the option to conceal at least their name, address and phone number, automatically, via any registrar. The DNC should consider making individual registrations private by default. Only in this fashion will we keep New Zealanders safe and included in their own TLD.

I encourage you to send a comment on the proposal to policies@dnc.org.nz. There is still time to convince the Domain Name Commission to adopt a course that lets us include all New Zealanders in the .nz space, and keeps them safe in the process. Please, remain polite. I know many of the people at the DNC and they’re wonderful individuals, but they clearly need help to understand who is being hurt and excluded by this policy.