GG Levine, is the National Association of Boards of Pharmacy, says “not having access to WHOis data has slowed investigations and hampered our efforts.” Says investigators once had a window into who owned what site — “now we have a brick wall.”

Uh-oh. First mention of “cyberterrorism.” ⚠️

That was from Alan Brill of Kroll, who is speaking now. But am curious how sites would navigate both GDPR & US requirements mooted by Fried of the MPAA. Fried holds up Denmark as an example, says .dk requires the publication of some WHOis data *and* is GDPR compliant.

Brill says WHOis data has been available since the dawn of the internet. “If we want a transparent internet, (we) need to know who’s at the other end of the line.” He compares it to KYC regulations at banks. “Not having it doesn’t make sense.”

Fried said that “since WHOis has gone dark, we’ve seen an uptick in domain registrations.” Suggests that the data isn’t in yet, but that malicious actors are jumping at the chance to register sites anonymously.

Gull says that removing the ability to make instant WHOis queries is slowing LE down dramatically. “The subpoena response time from a good provider could be a matter of days. It’s exponentially slowing down our response time.” As for foreign providers: “That’s months.”

Chung: “We’re talking about time,” said Chung. If it takes a few extra weeks to get basic info, “there’s true harm that could be done”

Meeting is over, but something that occurred to me: Journalists are generally required to seek comment from subjects of their stories — it’s often called “the right of reply.” How does that happen if you write about a website and have no way to reach its administrator?

Just because the domain is behind a privacy proxy, you can still send email to the admin listed in whois and the proxy should forward it on.

Yes that works for proxies — but not for data that’s been GDPR obscured. Here’re the WHOis details for my personal website. If my contact details weren’t on my homepage, how could anyone reach me?