The introduction of the new GDPR from May 25 could create an increase in malicious or spam emails, as registrars of new email addresses will no longer be able to block new malicious addresses.
Speaking to Infosecurity this week, Caleb Barlow, vice president of IBM Security, said that the WHOIS database is the most basic way to protect ourselves online, and now we are seeing the service being shut down because GDPR offers the ability to hide the name of the owner of each domain.
Barlow said that this result was unintentional and that the anonymity of domain name holders was not intended in any way. He added that "Millions of emails come in every day and we use the WHOIS database to verify who sent it so that we can block spammers. When a new domain is registered, we look at the information from WHOIS, such as the name and address.".
This issue was addressed by David Redl, the new head of the US National Telecommunications and Information Service, earlier in 2018. He said: “WHOIS can and should maintain its essential character while respecting national laws protecting the privacy of data subjects, including the GDPR.”
Barlow explained that while a malicious user won’t use their real name, there will be some consistency in their details if they register multiple domains. So, the phone number, email, or some other detail will be repeated. When one of the addresses they have registered is reported as malicious, all other listings with the same details will be reported and marked as malicious.”
Losing the ability to know who has registered an address will enhance the effectiveness of malicious domains and this could lead to more spam carrying malicious links or ransomware.
This gives the "bad guys" the upper hand, as most of the addresses registered to date are malicious. We need to be able to separate the good from the bad, and the only way to do that is with the WHOIS database.
