In May 2018, the European Union’s General Data Protection Regulation (GDPR) officially became law. However, dust on its implementation is far from settled, as companies continue to learn how to navigate the new legal landscape and adapt their business practices accordingly. We are also beginning to realize that the legislation might have certain unexpected consequences. Ironically, some of them may serve to undermine the security of Internet users, rather than protect them. One example is the Internet Corporation for Assigned Names and Numbers (ICANN) and its attempt to ensure compliance of its WHOIS system.

For years, cybercriminals have exploited the domain names system to launch coordinated and automated attacks on a global scale. Attackers often use domain names disguised as major brands to install malware on targeted computers and take control of legitimate servers or websites to cause mass disruption or obtain critical information. Over the past two decades, the global WHOIS directory, has been used by millions of individuals, businesses, organizations and governments, who registered domain names to support a transparent online ecosystem that protects users and customers. The resulting database was searchable, which allowed cyberdefenders to determine the owner of a domain name and IP address, and has provided viable means to obtain the information necessary to identify criminal actors, prevent harm, and protect the online ecosystem.

Since May, ICANN has struggled to come to terms with Europe’s new data protection law. Through an attempt to operate under GDPR, ICANN adopted a temporary resolution in May to ensure a common framework for handling registration information by reducing the quantity and ease of access to WHOIS data. Under the temporary specifications, registrars would collect all of the same data points about their customers yet limit how much of that information is made available through public WHOIS searches. This has not only hampered the ability to identify malicious actors online, but also resulted in divergent approaches by registrars and registries, potentially fragmenting the WHOIS system as a whole in the long run.

In late June, a discussion to develop a framework for an accreditation and access model started the draft of Framework Elements for a Unified Access Model for Continued Access to Full WHOIS Data. The Framework proposes a tiered-access model, with prospective users having to apply for accreditation from specific bodies before gaining access to full WHOIS data. This leaves many details including query types undefined with the intent that the ICANN multi-stakeholder community will generate policy to fill the gaps.

Ultimately, the framework falls short on delivering solutions that allow cybersecurity companies to address the increasing number of cyberspace threats. While we welcome the framework as a starting point for the discussion and are delighted that ICANN has turned to the multi-stakeholder community to provide feedback and help develop a sustainable approach in its consultation process, more needs to be done. The Cybersecurity Tech Accord signatories therefore call on ICANN, in the policy position published today,  to expedite the development and implementation of an accreditation model that allows for broad, persistent and frictionless access to WHOIS data for legitimate purposes, such as cybersecurity.

We strongly embrace an individual’s right to privacy outlined under the GDPR, however we also recognize that there is no privacy without strong security. The WHOIS data represents an important tool that our cybersecurity defenders rely upon to help maintain a stable and secure Internet, and we believe access to such data for the purpose of cybersecurity, needs to be maintained. It is therefore critical that a workable accreditation model is developed, and developed quickly.

Companies across every layer of internet communication vow to defend against misuse of their technology; promise to protect all customers regardless of nationality, geography or attack motivation.

REDMOND, Wash. — April 17, 2018 — On Tuesday, 34 global technology and security companies signed a Cybersecurity Tech Accord, a watershed agreement among the largest-ever group of companies agreeing to defend all customers everywhere from malicious attacks by cybercriminal enterprises and nation-states. The 34 companies include ABB, Arm, Cisco, Facebook, HP, HPE, Microsoft, Nokia, Oracle, and Trend Micro, and together represent operators of technologies that power the world’s internet communication and information infrastructure.

“The devastating attacks from the past year demonstrate that cybersecurity is not just about what any single company can do but also about what we can all do together.” said Microsoft President Brad Smith. “This tech sector accord will help us take a principled path towards more effective steps to work together and defend customers around the world.”

The companies made commitments in four areas.

Stronger defense
The companies will mount a stronger defense against cyberattacks. As part of this, recognizing that everyone deserves protection, the companies pledged to protect all customers globally regardless of the motivation for attacks online.

No offense
The companies will not help governments launch cyberattacks against innocent citizens and enterprises, and will protect against tampering or exploitation of their products and services through every stage of technology development, design and distribution.

Capacity building
The companies will do more to empower developers and the people and businesses that use their technology, helping them improve their capacity for protecting themselves. This may include joint work on new security practices and new features the companies can deploy in their individual products and services.

Collective action
The companies will build on existing relationships and together establish new formal and informal partnerships with industry, civil society and security researchers to improve technical collaboration, coordinate vulnerability disclosures, share threats and minimize the potential for malicious code to be introduced into cyberspace.

The companies may have adhered to some or all of these principles prior to the accord, or may have adhered without a public commitment but this agreement represents a public shared commitment to collaborate on cybersecurity efforts. The Tech Accord remains open to consideration of new private sector signatories, large or small and regardless of sector, who are trusted, have high cybersecurity standards and will adhere unreservedly to the Accord’s principles.

“The real world consequences of cyber threats have been repeatedly proven. As an industry, we must band together to fight cybercriminals and stop future attacks from causing even more damage,” said Kevin Simzer, Chief Operating Officer, Trend Micro.

The victims of cyberattacks are businesses and organizations of all sizes, with economic losses expected to reach $8 trillion by 2022.* Recent cyberattacks have caused small businesses to shutter their doors, hospitals to delay surgeries and governments to halt services, among other disruptions and safety risks.

The Tech Accord will help to protect the integrity of the one trillion connected devices we expect to see deployed within the next 20 years,” said Carolyn Herzog, General Counsel, Arm. “It aligns the resources, expertise and thinking of some of the world’s most important technology companies to help to build a trusted foundation for technology users who will benefit immensely from a more security connected world.”

Companies that signed the accord plan to hold their first meeting during the security-focused RSA Conference taking place in San Francisco, and will focus on capacity building and collective action. Future actions may include jointly developed guidelines or broadly deployed features, as well as information sharing and partnering to combat specific threats to make the online world a safer place for people and businesses everywhere — and uphold the promise and benefit technology offers society.

* Losses are cumulative over five year, 2017 – 2022. James Moar; Juniper Research: The Future of Cybercrime & Security: Enterprise Threats & Mitigation 2017-2022 (April 25, 2017); https://www.juniperresearch.com/researchstore/innovation-disruption/cybercrime-security/enterprise-threats-mitigation