The impact of GDPR on WHOIS: Implications for businesses facing cybercrime
Anthony J. Ferrante · Cyber security. · 2018
To protect privacy rights, the European Union’s General Data Protection Regulation (GDPR) has been effectively blocking access to the personal information of individuals who register Internet domains. Prior to the May 2018 GDPR enforcement deadline, this information was available through WHOIS, the directory service maintained by the ICANN, the organisation that manages the global domain system. By preventing access to this information, GDPR is depriving cyber security professionals of data that is vital for fighting a variety of Internet-based crimes. ICANN and European authorities have been engaged in high-stakes negotiations over who may legally access the data in the future, and how. To address the concerns of security professionals and others, ICANN has proposed creating a tiered system to allow accredited users, including security professionals, to continue accessing personal data. However, how that tiered system would work is unclear, complicated and mired in controversy. Corporate security officials should take note, as it could speed up the already rapidly escalating problem of cybercrime.