Cybersicherheit: EU will anonyme Websites verbieten

Die EU erarbeitet zurzeit eine Richtlinie zur Erhöhung der Cybersicherheit (überarbeitete NIS-Richtlinie, kurz „NIS 2“). Danach soll die Registrierung von Internetdomainnamen künftig die korrekte Identifizierung des Inhabers in der Whois-Datenbank einschließlich Namen, Anschrift und Telefonnummer voraussetzen. Die denic registriert bisher keine Telefonnummern der Inhaber. Der federführende Industrieausschuss fordert zudem eine Überprüfung der Registrierungsdaten. Dies könnte das Ende von „whois privacy“-Diensten zur stellvertretenden Registrierung von Domains bedeuten und die Sicherheit von Aktivisten und Whistleblowern bedrohen. Heute Nachmittag stimmt der Innenausschuss über die Frage ab, am Monatsende soll sich der federführende Industrieausschuss positionieren.

Der Europaabgeordnete Dr. Patrick Breyer, Schattenberichterstatter im mitberatenden Innenausschuss, warnt vor diesen Vorstoß:

„Diese Ausweispflicht für Domaininhaber ist ein weiterer Schritt in Richtung Abschaffung anonymer Veröffentlichungen und Leaks im Internet.

Das gefährdet Webseitenbetreiber, denn nur Anonymität im Netz schützt wirksam vor Datenklau und Datenverlust, Stalking und Identitätsdiebstahl, Doxxing und ‚Todeslisten‘. Besonders unverzichtbar ist das Recht auf Anonymität im Netz z.B. für Frauen, Kinder, Minderheiten und gefährdete Personen, Missbrauchs- und Stalkingopfer. Whistleblower und Presseinformanten, politische Aktivisten und beratungssuchende Menschen in Not, verstummen ohne den Schutz der Anonymität. Nur Anonymität verhindert die Verfolgung und Benachteiligung mutiger und hilfsbedürftiger Menschen und gewährleistet den freien Austausch mitunter lebenswichtiger Informationen. Hätten Wikileaks-Aktivisten beispielsweise die Website der Plattform auf ihren Namen registrieren müssen, wären sie von den USA sofort verfolgt worden.

Ich begrüße zwar das Ziel dieser Richtlinie, die Netzwerksicherheit zu erhöhen. Aber eine Ausweispflicht für Domaininhaber hat nichts mit Netzwerksicherheit zu tun. Deswegen fordern meine Fraktion und ich die Streichung der Identifizierungspflicht aus der Richtlinie.“

Die denic kritisiert die geplante Registrierungspflicht, während die ICANN sie noch verschärfen will.

Der von ITRE empfohlene Gesetzeswortlaut

(fettgedruckt sind die Änderungen gegenüber dem Gesetzentwurf der EU-Kommission)

Article 23
Database structure of domain names and registration data
1. For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall require TLD registries and entities providing domain name registration services to collect and maintain accurate, verified and complete domain name registration data in a database structure operated for that purposes.
2. Member States shall ensure that the database structure of domain name registration data referred to in paragraph 1 contains relevant information, which shall include at least the registrants’ name, their physical and email address as well as their telephone number, to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs.
3. Member States shall ensure that TLD registries and entities providing domain name registration services have policies and procedures in place to ensure that the database structure includes accurate, verified and complete information. Member States shall ensure that such policies and procedures are made publicly available.
4. Member States shall ensure that TLD registries and entities providing domain name registration services make publicly available, without undue delay after the registration of a domain name, domain registration data which are not personal data. For legal persons as registrants, the domain registration data publicly available shall include at least the registrants’ name, their physical and email address as well as their telephone number.
5. Member States shall require TLD registries and entities providing domain name registration services to provide access to specific domain name registration data, including personal data, upon duly justified requests of legitimate access seekers, in compliance with U nion data protection law. Member States shall require TLD registries and entities providing domain name registration services to reply without undue delay and in any event within 72 hours upon the receipt of the requests for access. Member States shall ensure that policies and procedures to disclose such data are made publicly available.

Recitals
(59) Maintaining accurate, verified and complete databases of domain names registration data (so called ‘WHOIS data’) is essential to ensure the security, stability and resilience of the DNS, which in turn contributes to a high common level of cybersecurity within the Union, and for tackling illegal activities. TLD registries and entities providing domain name registration services should therefore be required to collect domain name registration data, which should include at least the registrants’ name, their physical and email address as well as their telephone number. In practice, the collected data may not always be thoroughly accurate, however TLD registries and entities providing domain name registration services should adopt and implement proportionate processes to verify that natural or legal persons requesting or owning a domain name have provided contact details on which they can be reached and are expected to reply. Using a ‘best efforts’ approach, these verification processes should reflect the current best practices used within the industry. Those best practices in the verification process should reflect the advances being made in the electronic identification process. The TLD registries and entities providing domain name registration services should make publicly available their policies and procedures to ensure the integrity and availability of the domain name registration data. Where processing includes personal data such processing shall comply with Union data protection law.
(60) TLD registries and entities providing domain name registration services should be required to make publicly available domain name registration data that does not contain personal data. A distinction should be made between natural and legal persons. For legal persons, TLD registries and entities should make publicly available at least the registrants’ name, their physical and email address as well as their telephone number. The legal person should be required to either provide a generic email address that can be made publicly available or give consent to the publication of a personal email address. The legal person should be able to demonstrate such consent at the request of TLD registries and entities providing domain name registration services.
(61) The availability and timely accessibility of the domain name registration data to legitimate access seekers is essential for cybersecurity purposes and tackling illegal activities in the online ecosystem. TLD registries and entities providing domain name registration services should therefore be required to enable lawful access to specific domain name registration data, including personal data, to legitimate access seekers, in accordance with Union data protection law. Legitimate access seekers should make a duly justified request to access domain name registration data on the basis of Union or national law, and could include competent authorities under Union or national law for the prevention, investigation or prosecution of criminal offences, and national CERTs or CSIRTs. Member States should ensure that TLD registries and entities providing domain name registration services should respond without undue delay and in any event within 72 hours to requests from legitimate access seekers for the disclosure of domain name registration data. TLD registries and entities providing domain name registration services should establish policies and procedures for the publication and disclosure of registration data, including service level agreements to deal with requests for access from legitimate access seekers. The access procedure may also include the use of an interface, portal or other technical tools to provide an efficient system for requesting and accessing registration data. With a view to promoting harmonised practices across the internal market, the Commission may adopt guidelines on such procedures without prejudice to the competences of the European Data Protection Board.