Steve Crocker, of ICANNs SSAC, made a presentation of the SSAC findings on Verisign's Sitefinder to the GNSO Council (of which I am a member). This gave me another chance to drill down a little bit further on exactly what the whole "spyware" issue was all about.

Both presentations specifically referenced "spyware". The second presentation was transcribed as part of the council meeting, here's the relevant excerpt;

"In the privacy aspect, it was discovered that the web pages that were delivered when you actually did make -- were making web access contained classic commercial spyware from Ominiture.

And not that that was signficantly different from what happens in other commercial pages, except that it's pretty -- it was pretty surprising to a large number of users that it would come as a consequence of simply making a domain -- domain name lookup.

And the last find something that, collectively, all of this left a very strong sense of unease and lowered level of trust that the system as a whole is being managed and is predictable."

Having heard this a second time, I re-read the SSAC report, whereupon it became clear to me that there was discontinuity between the contents of the report and the presentation that Steve was making. The report talked about "web bugs" and the presentation talked about "spyware". While the potential of either being returned as a result of a query to the DNS is bothersome, my concern has real practical roots. Are there ongoing implications for users of the DNS as a result of this "test"?

I asked Steve both of these questions and while he did clarify that Sitefinder's behavior was "not ... significantly different from what happens in other commercial pages... it was pretty surprising to a large number of users that it would come as a consequence of simply making a ... domain name lookup". When I asked for a definitive answer regarding the "spyware" v. "web bug" question he responded indicating that only Verisign could really provide the answers that I was looking for and invited someone from Verisign to respond to my question.

Here's the relevant bits of the entire exchange...

>>ROSS RADER: Thanks again, Stephen, for the informative presentation.

Sort of following on to the comments you made yesterday, I just wanted to clarify a little bit your use of the term spyware in the slide deck. If you could just sort of describe precisely what that component was, how it worked. FOr instance, was it executable code or just a little bit more along those lines.

>>STEPHEN CROCKER: I was looking out in the audience and the people who actually know what they did are in the audience. Would somebody from Verisign like to describe the active software that was delivered as part of the responses?

>>CHUCK GOMES: I'm not the right one to respond to that because that was a technical implementation. My personal reaction, I certainly wouldn't call it spyware. But the person who was here at these meetings, Matt Larsen and who could respond to that is in another meeting right now. So I am not qualified. I don't think Rusty is going to say he is, either, to respond to that. I certainly would object to the term spyware.

>>STEPHEN CROCKER: Would you offer up another term?

>>CHUCK GOMES: Well, I -- I'm not prepared to give you another term on it right now. We can come up with one.

>>STEPHEN CROCKER: Automatically instered user tracking behavior software?

>>CHUCK GOMES: It certainly wasn't for the purposes of spying.

>>STEPHEN CROCKER: Just accumulating information about what the users were doing?

>>CHUCK GOMES: Right.

>>STEPHEN CROCKER: That's not spying, I understand.

>>ROSS RADER: So if I had any sort of follow-up to that, are there any longer term implications for registrars and registrants as a result of that thing that they were subjected to?

>>STEPHEN CROCKER: I think what you're asking in polite terms is even though the service has been shut down, for those users who did make such queries, is that software still operating on their machine in some fashion, and the answer is I don't know.

>>ROSS RADER: That was precisely the question I was asking. Thanks.

Not exactly the precision I was looking for, but these answers did get did get me closer to understanding what Verisign had most likely "installed" as part of the Sitefinder launch. Its very much as its laid out in the SSAC report and the prior briefings - a web bug. Which takes me right back to the original set of questions that I had.

Is it appropriate to use this type of tracking technology as the response to a DNS query?

Is this pattern of behavior appropriate for the steward of this community resource?