May 8, 2018 By Caleb Barlow 5 min read

The goal of the European Union’s General Data Protection Regulation (GDPR) is, among other things, to standardize data protection laws applicable to EU data subjects. Aimed at enhancing privacy protection, the enforcement of the regulation becomes effective on May 25.

GDPR’s implementation on an issue relevant to the cybersecurity industry may well have negative consequences that, ironically, run contrary to its original intent. These consequences could include a significant increase in cyberattacks, online fraud, and spam. At IBM, we are among many groups and individuals calling for European regulators to work with the right parties to ensure security teams continue to have access to the data they need to help stop cybercrime through a discussion of possible consequences and remedies.

What’s at Stake?

The central issue involves changes to accessing business contact information in the ICANN WHOIS database as a result of the current interpretation of the GDPR. WHOIS is a service that has readily provided basic information about a registered domain, such as domain owner contact information, domain availability status and the company with which the domain is registered. Registrants of new domains provide this information as part of the registration process.

The current interpretation of GDPR will greatly restrict access to data for security professionals and security researchers, as well as automated processes associated with access. Today, cybersecurity professionals use this information to quickly stop cyberthreats. Restriction under the GDPR interpretation includes limiting access or redaction of data such as the name of the person who registered the site domain, his or her phone number, physical address and email address.

Why this information is so vital to ongoing efforts to protect data privacy and prevent or limit cybercrime is best explained with an illustration of how that protection is provided in the first place.

How We Stop Cybercrime Today

IBM receives upward of 35 million malicious spam messages per day in our spam traps. Using high-speed machine-to-machine technology and with full access to WHOIS data, we can block these messages. But organizations like IBM X-Force can also block or at least delay activity coming from domains associated with the individuals (or phone numbers, email addresses or physical addresses) aligned with these spam messages.

That’s how IBM X-Force identifies and blocks nearly 1.3 million malicious domains per month. This information is shared globally — with other cybersecurity investigators, governments and even law enforcement — for the legitimate purpose of cybersecurity protection and to better protect users everywhere. Without WHOIS data, IBM X-Force analysts predict it might take over 30 days to detect malicious domains by other methods, leaving organizations at the mercy of cybercriminals during that period.

Also, it is important to understand how attacks are often launched. Organized criminals — and that is exactly who is behind an estimated $600 billion annual cybercrime business — invest heavily in buying legal and illegal email lists. They also purchase spam and phishing kits on the Dark Web. They then purchase not a few, but literally thousands of domain names at a time — domains that, at a glance, may look quite legitimate.

Then they do nothing for a period of time, possibly months, simply watching and noting if security filters block any of the domains. Once they feel their fake domains are largely perceived as legitimate, they strike, unleashing millions of illicit emails. They closely monitor click-thrus, which usually follow a pattern of high clicks followed by increasingly fewer successful click-thrus as spam and other filters begin limiting their effectiveness. After as little as a few hours, they shut down the operation and assess their “take.”

With the proper WHOIS data, IBM X-Force, as well as private, legitimate security researchers, can essentially “map” the malicious domain information to other fake domains by blocking any domains opened by the same person or with the same phone number or same email address. Cybercriminals routinely reuse such data because it is too costly to buy thousands of phones with unique phone numbers or to establish thousands of unique email address. This cyber cross-referencing is highly successful at stopping or greatly limiting the overall damage of the attack by limiting the amount of time the attack can take place.

Many Calls for Restraint

Opposition to these fundamental access changes to the WHOIS database and calls for a “cooling-off period” have come from many quarters. Included among these voices is Secretary Wilbur Ross, Department of Commerce, who specifically noted the importance of “preserving quick access to domain name registration… needed for intellectual property rights enforcement, cybersecurity and law enforcement.”

Additionally, the U.S. Chamber of Commerce, in a recent memorandum, minced few words in praising the security benefits of broad access to WHOIS data while sounding warnings of probable impact due to proposed changes to that access.

“Legitimate public access to the [WHOIS] database has proven crucial to effectively identify, prioritize and allocate resources to the policing of malicious and unlawful activity on the Internet,” the memorandum stated. “If access to the database is eliminated, there will be a significant rise in cyberattacks and fraudulent online activity without any ability for law enforcement, cyber researchers, companies or consumers to respond or remedy. An assurance of forbearance of enforcement or an interim ‘self certification’ solution, preserving this access to qualified users with appropriate safeguards, is necessary.”

Others Chime In

Security expert Brian Krebs is another leader in the call for temporary reconsideration of the GDPR rules regarding WHOIS data.

“I have worked the majority of my professional career to expose those who are doing the spamming and scamming,” Krebs articulated. “I can say without hesitation that an overwhelming percentage of that research has been possible thanks to data included in the public WHOIS registration records.”

Some suggest that this change will not have a material impact as qualified investigators can take legal steps to access the owner’s information. This is not practical in an automated cyber protection environment when security attacks often begin, do all of their damage, and conclude in a few minutes or hours. More time is needed to develop a solution that would appropriately calibrate privacy interests with the need to access this information for cybersecurity research purposes.


The time is now for security professionals globally to contribute to the conversation regarding the unintended consequences of interpreting the GDPR to restrict access to WHOIS data in cybersecurity research contexts. Preserving the resiliency, transparency and accountability of the internet is key, given the national and economic security issues that could result.

A fuller meaningful dialogue is needed and short- and long-term solutions must be developed and proposed. Industries and regulators need to find a path to both protect privacy and give the security community access to the data we need to stay ahead of the threat actors — but we’re running out of time to put it into action.

Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations. The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

Learn more about IBM’s own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey here.

More from CISO

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today