Why Nominet Has Got It Wrong About The Royal Mail And Bad Actors

[diablo]

Why Nominet Has Got It Wrong About The Royal Mail And Bad Actors

http://georgemarshall.co.uk/why-nominet-has-got-it-wrong-about-the-royal-mail-and-bad-actors/

 

[bulkcorn]

Another instance of Nominet fixing what ain't broke!

I did wonder what would happen to holders of .co.uk with a POB address when they want to claim the .uk version.

 

[sdsinc]

Simply put, they ought to ditch the local address requirement.

 

[diablo]

It makes no sense at all. If it did it would apply to all .uk domain names. And indeed to other Registries, but it has never been a problem. "Bad actors" can and do operate from street addresses just as easily.

What's more, to register the new .uk, the Registrant's details have to exactly match the .co.uk Registrant details (assuming the .co.uk has rights to the .uk). If you have a PO Box address for the .co.uk, you have no option but to use it for the .uk registration.

 

[diablo]

Just a quick update on this.

I am continuing to ask Nominet to reconsider this policy, not least because "bad actors" can operate from any address, not just PO Boxes, and the fact that Royal Mail make more checks than the allowed proxy services. If Nominet had a case, it would surely apply to ALL .uk domain names, unless it's okay for "bad actors" to have used .co.uk domain names since 1996!

I appreciate this only affects domain Registrants who use a PO Box, but given the flawed reasoning behind the policy and the additional expense of getting a proxy address, I think it is important to pursue.

For their part, Nominet just keep repeating the "loophole for bad actors" mantra and "you can use any other legitimate address" without answering any of the specific questions I've put to them regarding this policy.

If anyone else uses a PO Box, please contact Nominet to tell them that the policy is wrong. Ask them to explain the reasoning behind the policy, what the loophole is, and why it doesn't apply to any other address that bad actors use (for example, I could take out a six month leae on an office, then register a domain name for ten years, or I could be a fly by night from China selling fake goods and use a UK Registrar's address as a proxy).

 

[Edwin]

Nominet have done an astonishingly poor job of explaining why PO Boxes are not acceptable, but they are (almost certainly) correct.

From the reading up I've been doing, it appears that a PO Box, because it is not a "physical address" (it's basically a designation in a Royal Mail database that causes mail to be intercepted and forwarded, but it is not tied to "anywhere") is not an acceptable "address for service" under UK law. This isn't "because Nominet says so", it's "because the law of the land says so".

What Nominet are after is an address that IS a valid "address for service" so that if there is a need to serve legal documents (e.g. a DRS claim) they can send it to the address of record and thus fulfil their legal duty. PO Boxes don't meet that criterion. Mail forwarding services do because the mail physically travels to a specific, known "real world" address before it gets forwarded.

I agree that it's a weird situation, but everything I've read suggests that the weirdness is not of Nominet's own doing i.e. the finger needs to be pointed at the inflexibility of UK law, not at Nominet.

If you would like to do your own research, I'd suggest Googling "address for service" "po box" and having a good rummage through the results that show up (ignore the ones where you can see from the snippet they're about Nominet and domain names). There isn't one neat-and-tidy resource that explains the issue, but if you check enough results I expect you'll find that the above interpretation is accurate.

 

[diablo]

Nominet have done an astonishingly poor job of explaining why PO Boxes are not acceptable, but they are (almost certainly) correct.

From the reading up I've been doing, it appears that a PO Box, because it is not a "physical address" (it's basically a designation in a Royal Mail database that causes mail to be intercepted and forwarded, but it is not tied to "anywhere") is not an acceptable "address for service" under UK law. This isn't "because Nominet says so", it's "because the law of the land says so".

What Nominet are after is an address that IS a valid "address for service" so that if there is a need to serve legal documents (e.g. a DRS claim) they can send it to the address of record and thus fulfil their legal duty. PO Boxes don't meet that criterion.

I agree that it's a weird situation, but everything I've read suggests that the weirdness is not of Nominet's own doing i.e. the finger needs to be pointed at the inflexibility of UK law, not at Nominet.

If you would like to do your own research, I'd suggest Googling "address for service" "po box" and having a good rummage through the results that show up. There isn't one neat-and-tidy resource that explains the issue, but if you check enough results I expect you'll find that the above interpretation is accurate.

There is no such thing as UK law (at least in the sense above - laws can apply throughout the UK). Scotland has its own legal system for example.

But if what you say is correct, why aren't Registrants of .co.uk domain names also required to meet this requirement? Why haven't Nominet fulfilled their legal duty since 1996 with regards to such domain names if it exists? Why haven't they moved to do so now?

Nominet are also allowing proxy addresses that require little or no checks. As such these "addresses for service" are worthless. See my examples above.

What is more, none of the above has been given to me as a reason by Nominet. I am simply being told "the policy has already been decided. As .. (has been) highlighted, this decision was made after two lengthy consultations."

Does anyone remember the use of PO Boxes being central to .uk consultations?

 

[bluerock]

I dont understand this as I use a POB and have registered .uk domains.

See Advice uk as an example of the address.

 

[diablo]

I dont understand this as I use a POB and have registered .uk domains.

See Advice uk as an example of the address.

That's the other thing. If you have the .co.uk, Nominet are allowing PO Boxes to be used - presumably because addresses must match. If it was a legal requirement, this would not be allowed.

Nominet has said that in due course they will ask for the address to be changed. No time frame has been given.

Problems will arise when you try to register a new .uk and try to use a PO Box.

 

[dazc]

(for example, I could take out a six month leae on an office, then register a domain name for ten years, or I could be a fly by night from China selling fake goods and use a UK Registrar's address as a proxy).

A 'bad actor' could just use any random physical address since there is almost zero chance of anyone checking it. The new rule only inconveniences legitimate PO box users.

 

[Edwin]

But if what you say is correct, why aren't Registrants of .co.uk domain names also required to meet this requirement? Why haven't Nominet fulfilled their legal duty since 1996 with regards to such domain names if it exists? Why haven't they moved to do so now?

It is correct, to the best of my knowledge. But please do your own checking. The Google search I suggested should easily provide enough information to enable you to confirm what I posted.

I can't speak for why Nominet have only started implementing it now. Perhaps - and I have no "inside knowledge" on this - they felt it's good to start the clean slate of .uk with "best practices" and they will come around to fixing the existing body of registrations at some stage. After all - to choose a very extended metaphor - if you have a badly leaking pipe and a flooded basement, you might well choose to fix the pipe (stop the problem getting worse) before pumping the water out.

Nominet have compounded the confusion by making it sound like this is something they're instigating for consumer protection, whereas in fact they're very likely doing it for the reason I outlined previously i.e. so that they can be 100% confident of fulfilling their obligation under UK law if they have to serve legal documents on a domain name owner.

 

[diablo]

It is correct, to the best of my knowledge. But please do your own checking. The Google search I suggested should easily provide enough information to enable you to confirm what I posted.

I can't speak for why Nominet have only started implementing it now. Perhaps - and I have no "inside knowledge" on this - they felt it's good to start the clean slate of .uk with "best practices" and they will come around to fixing the existing body of registrations at some stage. After all - to choose a very extended metaphor - if you have a badly leaking pipe and a flooded basement, you might well choose to fix the pipe (stop the problem getting worse) before pumping the water out.

I take your point, but if you are breaking the law, you don't have the luxury of deciding if and when you abide by it.

 

[Edwin]

I take your point, but if you are breaking the law, you don't have the luxury of deciding if and when you abide by it.

Their current arrangement does not break the law as far as I can see. However, it exposes Nominet to potential issues in that if they attempt to "serve" legal documents against a domain owner with a PO Box, Nominet have little recourse if the owner ignores them or claims they were never received. In other words, it is Nominet themselves who end up under-protected under UK law if they accept PO Boxes.

So at the moment, Nominet is absorbing a "legal risk" as part of doing business - hard to measure how risky that risk is, but it does exist - and they've decided that .uk provides the perfect opportunity to remove that risk.

 

[diablo]

Nominet have compounded the confusion by making it sound like this is something they're instigating for consumer protection, whereas in fact they're very likely doing it for the reason I outlined previously i.e. so that they can be 100% confident of fulfilling their obligation under UK law if they have to serve legal documents on a domain name owner.

This to me is the crux of the matter - they claim it is to protect the consumer, but are happy to see "bad actors" exploit the supposed loophole by using a .co.uk or a suspect proxy address.

Bad actors are also far more likely to use a mail forwarding service (with no checks) than apply for a PO Box (that requires checks).

 

[diablo]

Their current arrangement does not break the law as far as I can see. However, it exposes Nominet to potential issues in that if they attempt to "serve" legal documents against a domain owner with a PO Box, Nominet have little recourse if the owner ignores them or claims they were never received. In other words, it is Nominet themselves who end up under-protected under UK law if they accept PO Boxes.

So at the moment, Nominet is absorbing a "legal risk" as part of doing business - hard to measure how risky that risk is, but it does exist - and they've decided that .uk provides the perfect opportunity to remove that risk.

Royal Mail are obliged to disclose the actual address of any PO Box holder. Nominet know this as does every solicitor in the land. That is how legal papers can be and are served.

There are proxy services that allow you to operate anonymously.

Furthermore, foreign Registrants (often beyond the reach of the law) are allowed to use a Registrar's address as a proxy. So in this instance, are Nominet asking Registrars to absorb the legal risk you are referring to?

 

[Edwin]

This to me is the crux of the matter - they claim it is to protect the consumer, but are happy to see "bad actors" exploit the supposed loophole by using a .co.uk or a suspect proxy address.

Bad actors are also far more likely to use a mail forwarding service (with no checks) than apply for a PO Box (that requires checks).

That's why I said they're explaining it very badly. Perhaps because it looks too self-serving otherwise? I have no idea why they've put it the way they have.

But if you strip out Nominet's communications on the matter and focus solely on the idea of forbidding the use of PO Boxes, that makes a huge amount of sense when you look at how UK law treats them.

In other words, you can still end up doing the right thing even if your stated reasons for doing so are tangential. And this is a great example of Nominet doing the "right thing".

 

[bluerock]

The service addresses are usually cheap as chips to buy and get setup in the same day.
If anyone has tried to get a POB its a different matter as RM want original docs of everything and I pay over £300 pa for mine. Everybody knows you can get the POB holders address easily so you cant really hide. Its there to stop idiots knocking on your door offering you £50 for a domain.

If they target anything I would have thought it would be the service addresses rather than an established product offered by a recent Government owned outfit.

 

[Edwin]

Royal Mail are obliged to disclose the actuual address of any PO Box holder. Nominet know this as does every solicitor in the land.

There are proxy services that allow you to operate anonymously.

Furthermore, foreign Registrants (often beyond the reach of the law) are allowed to use a Registrar's address as a proxy. So in this instance, are Nominet asking Registrars to absorb the legal risk you are referring to?

As I mentioned earlier in this thread, Nominet's behaviour is logical if you're willing to take the time to dig into the actual law - UK law, not Nominet T&C - that governs PO Boxes and addresses for service. If, after doing the research, you find credible documents that support a different conclusion, I'd love to see the references.

When you're digging, forget all Nominet's stated reasons for requiring PO Boxes, and focus only on address for service vs PO Box issues.

Anyway, I've said all I'll say about this. I don't expect you - or anyone else - to take my word for it, which is why I keep saying "Google it"!

 

[diablo]

Their current arrangement does not break the law as far as I can see. However, it exposes Nominet to potential issues in that if they attempt to "serve" legal documents against a domain owner with a PO Box, Nominet have little recourse if the owner ignores them or claims they were never received. In other words, it is Nominet themselves who end up under-protected under UK law if they accept PO Boxes.

A possible solution would be then for Nominet to allow the use of PO Boxes, but when used, insist that an address for service is provided to them (but that does not appear in the whois). The whois could even state "address for service" available from Nominet.

This is important for those who work from home legally, but whose tenancy agreement forbids the use of the address for business (I find myself in this position and so do tens of thousands of others). A PO Box means I can continue to trade while not having to trust my post to anyone other than the Royal Mail. I shouldn't have to go to additional expense or trust my post to anyone else.

 

[diablo]

And this is a great example of Nominet doing the "right thing".

So allowing the use of suspect proxy addresses is doing the right thing. I simply cannot follow your logic.