.ca Whois Harvesting

The .ca domains are run by an organization in Canada at CIRA.ca.   Their whois access terms of service is shown below.  It prohibits things like “unauthorised aggregation or collection of information from the WHOIS database.”  It has been well known for years that DomainTools.com has been harvesting this information and selling the historical data in whois history reports.  This practice may circumvent the whois privacy system put in place by CIRA and may be in conflict with Canadian privacy laws that states that historic data should be made anonymous or be deleted.

When CIRA received complaints about this they would not answer for months.  The Privacy Commissioner of Canada was notified and they recommended contacting DomainTools.com.  When that was done DomainTools.com filed a bogus lawsuit in US federal court thousands of miles from the person complaining.  When CIRA was asked about this their response was:

“Domain Tools is not packaging and selling private information, but rather, is consolidating and making available (typically old) publicly available information found on our public WHOIS service … CIRA has written directly to Domain Tools in this regard to try and address this.”

The issue is not “private information” but rather the “personal information” that was contained in the public whois database in the past but is no longer public.  When CIRA was asked to release the letter to DomainTools.com CIRA’s attorney said it would not be released publicly and if a member of public wanted to see CIRA’s letter to DomainTools.com they would need to take legal action against CIRA!  (More information about who operates DomainTools.com is here)

A request was made to the CIRA Board to release the letter as it involves matters of public policy and affects the .ca registrants.  CIRA has also been asked to comply with the Alberta Privacy Breach Notification Law and notify .ca registrants of the status of the historic whois data and describe what steps are being taken to reduce the risk of harm and notify the registrants.  This would include, of course, releasing the letter sent to DomainTools.com.

.ca WHOIS terms of service:

You shall use the WHOIS database on the Website solely for the following purposes:

  1. to query the availability of a domain name;
  2. to identify the holder of a domain name; and/or
  3. to contact the holder of a domain name in regard to the domain name or the respective website.

You may not use the WHOIS information for any other purpose.  Prohibited uses include, but are not limited to:

  • unauthorised aggregation or collection of information from the WHOIS database;
  • access or use of the WHOIS database to send unsolicited communications of any kind, other than those reasonably required in the course of fulfilling the purposes set out above; and
  • access or use of the WHOIS database for commercial, advertising, market research, solicitation, or any other purposes which may be reasonably viewed as intrusive to a reasonable domain name holder.

You may not use automated processes that send multiple queries or data to the WHOIS database, except as reasonably necessary to register domain names or modify existing  registrations. By submitting any query to the WHOIS, you agree to abide by and comply with the WHOIS Terms and Legal Notice.