Eric Goldman alerts us to a new bill pending in New York which would make it a crime to sell domain names to terrorist organizations. The relevant portion of the proposed bill is,

A person is guilty of criminal sale of an internet domain name to a terrorist group when he or she knowingly sells or provides without charge an internet domain name to any organization included on the list of organizations engaged in terrorist activities or who pose a terrorist threat compiled, maintained and updated by the state office of homeland security pursuant to paragraph (t) of subdivision two of section seven hundred nine of the executive law. Criminal sale of an internet domain name to a terrorist group is a class A misdemeanor.

Read the full text at New York State Legislature, search for bill A5026/S63 (direct linking not possible)

I do not doubt that the bill honestly aims to prevent terrorism by making it difficult for terrorist organizations to obtain web domain registrations, at least in the State of New York. But is this a practical solution? Let’s say that a domain name registrar who is located in New York has to comply with this law. What would they do? They would have to constantly update the list of terrorist organizations maintained by the local DHS office, then for each new domain registration compare against the list. Arguably, this can be automated to some degree.

The problem comes from the fact that the domain name registration system does not require a shred of verification as to the identity of the domain name registrant. In fact, many registrants, among them spammers, phishers, and terrorists, would not even bother putting the name and address information in proper format. The falsity and unreliability of the whois domain records are notorious. So why does the New York legislature think that registrants would start using their real information especially when they try to obtain a domain name for hostile purposes?

The law, if passed, would do no more than create some additional requirements on domain registrants who are subject to the law and not much else. Other than raising the cost of doing business to domain registrars with little effect, the legislature may think about how it can improve the reliability of the information provided by registrants in the first place.