Latest news of the domain name industry

Recent Posts

Demand Media slates GAC’s new gTLDs demands

Kevin Murphy, May 9, 2013, 08:34:49 (UTC), Domain Policy

Demand Media has become the first new gTLD applicant to put its head above the parapet and tell ICANN that its latest batch of Governmental Advisory Committee advice is unworkable.
While its comment on the GAC’s Beijing communique is very diplomatically worded, it’s obvious that Demand reckons most of the “safeguard” advice it contains would be difficult, if not impossible, to implement.
The company has urged ICANN to refuse to adopt the advice, saying:

the spirit and actual letter of the GAC Advice related to these additional safeguards comes in a manner and form that is completely antithetical and contrary to ICANN’s bottom-up, multi-stakeholder, consensus-driven policy development process. Because the proposed safeguards, if implemented, would effectively change how new gTLDs are managed, sold, distributed, registered, operated, and used in the marketplace, the GAC Advice is tantamount to making “top-down,” dictatorial, non-consensus, policy which undermines the entire ICANN model. If ICANN chose to adopt any one of these three safeguards, ICANN itself would lose all legitimacy.

Demand seems to agree with many of the points raised in this DI post from a few weeks ago related to the GAC’s demand that hundreds of new gTLD registries should compel their registrants to stick to data security standards when they handle sensitive financial or healthcare data.
The GAC’s advice is extremely broad here and pays scant attention to the innumerable implementation questions raised. As such, Demand says in its comment (filed by applying subsidiary United TLD Holdco):

United TLD believes applicable laws and recognized industry standards should be developed and implemented by appropriate legislative, law enforcement and industry expert bodies and should not be developed by the registry operator.

It also takes issue with the GAC’s demand for registry operators to “establish a working relationship with the relevant regulatory body including developing a strategy to mitigate abuse.”
The company points out that many TLDs listed in the Beijing communique will have multiple uses, and even if there is a regulatory body for a subsection of registrants, it may not cover all.
For example, should a software engineer (an unregulated profession) have to agree to abide by rules developed for civil engineers when they register a .engineer domain name?

it would be inappropriate, and impossible, to find a “relevant regulatory body” with whom to establish a relationship related to the use of .ENGINEER. Additionally, what if the relevant regulatory body simply declined to work with a registry operator or does not respond to requests for collaboration?

The Demand comment is full of examples of problems such as this.
In broader terms, however, the registrar and applicant is utterly opposed to the GAC’s insistence that “certain” unspecified gTLDs representing regulated sectors should be forced, in effect, to transform into tightly restricted sponsored gTLDs.
The GAC wants these applicants to forge tight links with regulatory and self-regulatory bodies and vet each registrant’s credentials before allowing domains to be registered.
Demand said:

applicants, including United TLD, submitted their new gTLD applications believing that that they would be operating, managing and distributing generic TLDs. These three Safeguards completely change the nature of the new TLDs from being generic and widely available, to being “sponsored” TLDs restricted only to those individuals who must prove their status or credentials entitling them to register domain names with certain extensions. These three Safeguards are patently adverse to the core purpose of the new gTLD program and ICANN’s mission generally which is to promote consumer choice and competition.

While Demand is the first application to slam the GAC advice as a whole (a few others have submitted preliminary comments on specific subsets of advice), I’m certain it won’t be the last.
That said, .secure applicant Artemis Internet submitted what is possibly the most amusing example of “sucking up” I’ve ever seen in an ICANN public comment period.
The company actually requests to be added to the list of strings covered by the GAC advice on the grounds that its application was so gosh-darn wonderful it already planned to do all that stuff anyway.
I expect, by the time the comment period closes next Tuesday the prevailing mood from applicants will be more Demand and less Artemis.

Tagged: , , , , , , ,

Comments (16)

  1. There is a “relevant regulatory body” for the wine industry, it is the OIV ( but unfortunately it is too late. ICANN should have considered this earlier in its applicant guidebook.
    Also agree all generic strings cannot have a regulatory body.

  2. steve machin says:

    We plan to run a similarly high-security domain as artemis and applaud the stance that Alex and the .secure folks are taking for their particular string.
    Clearly that approach does not suit all business models and all sectors, however if the registry has a plan to keep a name clean and it can work out how to do that in a commercially viable fashion, and the registrants are also happy to sign up to the license agreement then why not?

    • Kevin Murphy says:

      Isn’t it a bit worrying that the GAC, with its apparent focus on security, didn’t put .secure or .security on its list?

      • steve machin says:

        the inconsistencies are astonishing, as you have just pointed out in a great follow up post. some of the sentiment behind the advice is well intentioned, i just think the execution of the advice is appalling. I agree with you that it MUST have been rushed.. despite the ocean of (extended) time allowed

        • Rubens Kuhl says:

          GAC only works during the meetings, not between meetings. The industry thinks 24×7 about the program. This mismatch is one of the issues GAC needs to address. I’ve already suggested privately they could mimic UN security council and have one country from each ICANN region as a full-time body. Unless they do something towards being more Internet-time, these issues will repeat themselves.

          • Alex Stamos says:

            This seems like a serious issue, especially now that Durban is going to be such an important meeting for the gTLD program. The GAC should really publish this kind of communique a week or two before an ICANN meeting, otherwise the GNSO, RySG, RrSG, NTAG and others are all talking (or yelling) about issues that could be completely mooted by the GAC.

      • Alex Stamos says:

        It *is* strange that .secure and .security were not on the list. According to a GAC member we asked about this, both of those domains were actually included in early drafts of the communiqué, but in the frantic last minutes of merging and negotiating those (and several others) were lost. This GAC member reinforced that this list is *not* comprehensive and will probably expand by Durban.
        As for sucking up, I think that is a really unfair characterization. I am not a domain person; I have spent my entire career in information security, dealing with real problems for real people. The unfortunate truth is that the level of trust and safety on the Internet is so abysmal that almost no normal consumer can use it safely. Every time Average Joe or Jane buys something from their mobile device, logs into their retirement account from a coffee shop, or even browses random sites, they are safe only because they are not being targeted at that exact moment.
        The domain industry plays a small but significant role in this problem, especially with the “race to the bottom” in the registrar space. I refuse to accept that pushing for a short-term best interest, namely not allowing the GAC to slow down delegation, outweighs the long-term interest in making the Internet a more viable mechanism for commerce and communication. That is what motivated our response.

  3. JS says:

    I don’t understand the “top-down” argument. The GAC has been in the picture since the inception of the program. Everyone knew that the GAC could shoot down any application at will (almost).

    • Kevin Murphy says:

      If it had done so, the argument would fail. But it didn’t, it decided it wanted to impose an arbitrary regulatory environment instead.

    • Jean Guillon says:

      We yet have not seen if they can shoot down an application. The ICANN new gTLD program is always full of surprises anyway.
      I think applicants knew about the power of the GAC but they did not know how far it could go.
      A lesson learnt for round 2.

      • Rubens Kuhl says:

        Because of .xxx most applicants underestimated GAC. We are now overestimating GAC, and the results of round 1 will provide a balanced view of what GAC can do; not as unimportant as once thought, not as important as now people think.

  4. Jean Guillon says:

    If .XXX passed the test, all other TLDs can pass the test easily.
    Well…apparently, not.

  5. zack says:

    “it would be inappropriate, and impossible, to find a “relevant regulatory body” with whom to establish a relationship related to the use of .ENGINEER.”
    While I might agree with that statement. This is not the first time this subject has been raised. Everyone should be reminded of the language in the application itself in the Notes to Question 30a:
    “Criterion 5 calls for security levels to be
    appropriate for the use and level of trust
    associated with the TLD string, such as, for
    example, financial services oriented TLDs.
    “Financial services” are activities performed
    by financial institutions, including: 1) the
    acceptance of deposits and other repayable
    funds; 2) lending; 3) payment and
    remittance services; 4) insurance or
    reinsurance services; 5) brokerage services;
    6) investment services and activities; 7)
    financial leasing; 8) issuance of guarantees
    and commitments; 9) provision of financial
    advice; 10) portfolio management and
    advice; or 11) acting as a financial
    clearinghouse. Financial services is used as
    an example only; other strings with
    exceptional potential to cause harm to
    consumers would also be expected to
    deploy appropriate levels of security.”
    I don’t think the GAC is not saying something new – it appears they already had a very similar statement included in the Guidebook. What I think is ludicrous is that for many strings there is no common body or regulatory authority to define “appropriate levels of security”.
    Perhaps we can ask the technical panels how they passed certain strings and use that criteria to help establish some sort of baseline?

    • Kevin Murphy says:

      You raise an interesting point.
      My understanding of the Guidebook is that Question 30 relates to security measures in place *at the registry*.
      The GAC advice, on the other hand, asks registries to look at the security measures in place *at the registrants*.
      It’s true that some applicants — fTLD’s .bank for example — want to impose some security requirements on registrants (see bullet 29 at
      fTLD seems to be asking for registrants to use transport-layer security (eg SSL), whereas the GAC advice (vague as it is) seems to want more.
      It looks like the GAC wants .art registrants, for example, to implement greater security measures than fTLD has proposed for its own limited number of future .bank customers.

      • Rubens Kuhl says:

        Artemis .secure also has registrant-side security requirements, stricter than .bank.
        Q30 is indeed about Information Security at the registry, not about eligibility requirements, content enforcement, registrant behavior, or transforming the DNS Industry into World Police.

  6. Zack says:

    You give the GAC too much credit here by assuming they know the difference. I think they assumed that 30a had broader implications.

Add Your Comment