Registrant Search is the latest service to come out of DomainTools.com and has raised concerns of domainers, shocked by the information which is now available on their portfolio and activities. However this issue has wider implications which should be considered by all domain owners, businesses and privacy advocates.

I wrote an article last year for Jim Boykin’s blog, entitled “What Does Google Know about Your Domain Names”. My theory was that Google became a Registrar in order to obtain WHOIS data from the Registries.

I believe Google has built or is building a tool to analyse domain names. The API access they were given as a Registrar allows them to carry out the level of automated queries they needed for this. I would also go further and suggest this tool is building up a historical picture of each domain through regular scraping of their WHOIS records.

As you can imagine this tool could be very useful for Google. It would allow them to track the age of domain names and connect likely networks and portfolios. They would see when a domain name changed ownership and allow them to adjust the value of that domain in their engine.

At the time this was speculation but this week the concept has become reality in the form of Registrant Search.

The system is built on the back of the DomainTools.com database, which has been busily collecting WHOIS records and logging changes since 1995. For some time now users have been able to view historical records on a selected domain and view name server changes logged. However this week they took the next logical step and linked the records together.

For a fee you can buy a report which will give you all domain records currently and ever registered to a person or company, as logged by their system. As you see here, we can obtain 314,103 records for Google Inc. and 379,367 for Yahoo! Inc. giving us a unique insight into the domain portfolios for those companies.

However it gets scarier when you consider that searches can also be made on individuals. We have 465 records under the name “Danny Sullivan” and 1,556 recorded entries for “Michael Gray”. Although all but the first letter of the domain names are obscured, I recognised the domains under some of my profiles.

The power of this tool is that it can associate domains, even if they have subsequently been sold on or hidden with WHOIS privacy. One weak link in your WHOIS protection could reveal your entire portfolio. For example if a domain was previously registered in your name and this then moved to a company entity. Both records would be recovered by the search - tying the two together for anyone investigating.

There is also a huge opportunity to discover personal data, including names, addresses and telephone numbers of users who had failed to use WHOIS privacy at an early stage of their domain buying career. As some long-time internet users have pointed out, domain privacy was not available as a service until recently.

Why are people worried?

Apart from the general invasion of privacy, commenters in this thread have put forward specific concerns about the new tool.

If you combined the domain ownership list and the known prices domain were sold at, you end up with a financial valuation of a company or individual. Some of these run into the $millions. Critics have argued that this information could be used by blackmailers or within legal disputes. This data can amount to having your bank statements publicly available.

For domainers involved in UDP (Uniform Dispute Policy) disputes, this information could be used against them in a court of law. Typo and trademark registrations were not as much of a concern in the early days but these cases could be cited as evidence of previous infractions or bad faith.

Individuals who registered politically motivated domains or ones that they might find embarrassing. The domains we register tell people a lot about us, and which sites we may have operated. Some of these we may wish to remain secret.

The domain portfolios of businesses can be checked by their competitors. This would give useful information on their future strategy and list all their current website properties.

There have been some questions about the legality of selling this information. While WHOIS searches are publicly available they often come with clauses which prohibit electronic scraping and re-distributing. Nominet for example have the following clause:

Use of WHOIS and data: You may not:

re-package, compile, re-distribute or re-use any or all of the WHOIS database or data (unless you are a lawful user using an insubstantial part);

use any or all of the WHOIS data for advertising or as part of a process of identifying entities, names or addresses for future advertising activity of any sort (any such use may also be unlawful under the Data Protection Act 1998);

Verisign, the operator of .COM gives themselves more room for maneuver by suggesting this can be overcome by ‘prior written consent’. It’s unclear though whether DomainTools has such consent to compile and resell this data.

Jay Westerdal, CEO of DomainTools is asking for feedback on this new tool and has already received over 125 replies. The response has been overwhelmingly negative, with many “>industry leaders joining the calls for this tool to be taken down. However, as has been pointed out, even if this is taken out of public hands there is little to stop them selling the data. The more cynical among us might suggest the publicity surrounding this tool will provide a rich supply of private clients.

One of these clients could even be Google, should they be following similar lines. This data could be sold or leased to help them ‘catch-up’ on the historical records they may have missed.

This episode has been a wake up call for all domain owners to apply WHOIS privacy to their domains. Historical snapshots do not give you the luxury of applying this at a later stage. Even if you do not need it now, you may thank yourself several years down the line.