Summary

Individuals or organizations seeking to register the names of their Web sites may provide inaccurate contact information to registrars in order to hide their identities or to prevent members of the public from contacting them. Contact information is made publicly available on the Internet through a service known as Whois. Data accuracy in the Whois service can help law enforcement officials to investigate intellectual property misuse and online fraud, or identify the source of spam e-mail, and can help Internet operators to resolve technical network issues. GAO was asked, among other things, to (1) determine the prevalence of patently false or incomplete contact data in the Whois service for the .com, .org, and .net domains; (2) determine the extent to which patently false data are corrected within 1 month of being reported to ICANN; and (3) describe steps the Department of Commerce (Commerce) and ICANN have taken to ensure the accuracy of contact data in the Whois database.

Based on test results, GAO estimates that 2.31 million domain names (5.14 percent) have been registered with patently false data--data that appeared obviously and intentionally false without verification against any reference data--in one or more of the required contact information fields. GAO also found that 1.64 million (3.65 percent) have been registered with incomplete data in one or more of the required fields. In total, GAO estimates that 3.89 million domain names (8.65 percent) had at least one instance of patently false or incomplete data in the required Whois contact information fields. Of the 45 error reports that GAO submitted to the Internet Corporation for Assigned Names and Numbers (ICANN) for further investigation--one for each domain name with patently false contact data that GAO found in a random sample of 900--11 domain name holders provided updated contact information that was not patently false within 30 days after GAO submitted the error reports to ICANN. One domain name, which had been pending deletion before submission to ICANN, was terminated after GAO submitted the error report. The remaining 33 were not corrected. Commerce and ICANN have taken steps to ensure the accuracy of contact data in the Whois database. In addition to implementing a Registrar Accreditation Agreement that requires registrars to investigate and correct any reported inaccuracies in the contact information, they have amended their memorandum of understanding to require ICANN to continue assessing the operation of the Whois service and to implement measures to secure improved accuracy of data. Commerce and ICANN officials generally agreed with a draft of this report.