ICANN staffing up for next new gTLD round

ICANN has started hiring staff to support the next round of new gTLD applications.

The Org this week posted an ad for a “Policy Development Support Analyst” who will “track generic top-level domain policy proposals and contribute to capacity development in the civil society and noncommercial communities”.

It also appears to be still looking for a “Senior Director, New gTLD Subsequent Procedures”, with an ad first posted in June.

The latter is almost certainly a revolving-door type of opening, where somebody with deep, long-term insight into the industry and ICANN would be the likely hire.

ICANN describes it as a “highly visible role requiring a high degree of organization, leadership experience, management and communications acumen, and subject matter knowledge” where the successful candidate “will provide leadership and direction over multiple tracks of organizational activities toward implementation of a subsequent round of ICANN’s New gTLD (Generic Top-Level Domain) Program”.

The newer, more junior opening appears to have a broader remit, with the focus on non-commercial stakeholder engagement as well as the new gTLD program.

The two jobs are among 35 currently being advertised by ICANN.

Belgium slashes its ICANN funding in “mission creep” protest

DNS Belgium has cut its contribution to ICANN’s budget by two thirds, in protest at ICANN’s “mission creep” and its handling of GDPR.

The Belgian ccTLD registry informed ICANN CFO Xavier Calvez that it will only pay $25,000 this fiscal year, compared to the $75,000 it usually pays.

Registry general manager Philip Du Bois wrote (pdf) that “during recent years there has been a shift in focus which is not in the benefit of ccTLD’s”.

ICANN has become a large corporate structure with a tendency to suffer from “mission creep”… At the same time ICANN seems to fail in dealing in an appropriate way with important issues such as GDPR/privacy. It goes beyond our comprehension that ICANN and its officers don’t feel any reluctancy to “advise” European institutions and national governmental bodies to embrace “standards developed by the multi-stakeholder structures on international level” while at the same time it is obvious that ICANN itself has not yet mastered the implementation of important European legislation.

Based in the heart of the EU, DNS Belgium was a strong proponent of Whois privacy many years before the GDPR came into effect in 2018.

Calvez, in his reply (pdf), acknowledges that ccTLD contributions are voluntary, but seems to insinuate (call me a cynic) that the criticisms are hollow and that the registry might simply be trying to reduce its costs during an economic downturn:

We do appreciate any amount of contribution, and also that the ability for any ccTLD to contribute varies over time, including based on economic circumstances. We do understand that the reduction of DNS Belgium’s contribution from US$75,000 to US$25,000 represents a significant and meaningful reduction of costs for DNS Belgium.

DNS Belgium seems to be doing okay, based on its latest annual financial report. It’s not a huge company, but registrations and revenue have been growing at a slow and steady rate for the last several years.

All ccTLD contributions to ICANN are voluntary, but there are suggested donations based on how many domains a registry has under management, ranging from the $225,000 paid by the likes of the UK registry to the $500 paid by the likes of Pitcairn.

DNS Belgium, which manages about 1.7 million names, falls into the third-highest band, with a $75,000 suggested contribution.

ICANN is budgeting for funding of $152 million in its current FY23.

Diversity takes a hit as NomCom replaces two ICANN directors with newcomers

ICANN will be left with fewer women and Africans on its board of directors following this year’s Nominating Committee selections, after which apparent community newcomers will take seats.

NomCom last night announced that its three picks for the board, due to take or retake their seats at the Annual General Meeting in Kuala Lumpur next month, are Maarten Botterman, Christopher Chapman and Sajidur Rahman.

Botterman is of course the current chair, and his reappointment was surely never in any doubt. He’ll be entering his third and final term at the AGM.

Less is known about the two newcomers. ICANN has so far provided no biographical information about them beyond the geographic region they represent. Botterman is European and both Chapman and Rahman are from Asia-Pacific.

Both new appointees have very common, google-resistant names, and neither appears to have a track record of vocal ICANN community participation.

Chapman, if I had to guess, would be Chris Chapman, the former long-term independent media regulator from Australia. Sajid Rahman is such a common name I don’t think I could confidently make a call on his identity early doors.

What we do know is that they’re both Asia-Pac, and they’re both replacing one-term African directors.

Leaving the board at the AGM will be NomCom’s 2019 picks Mandla Msimang from South Africa and Ihab Osman from Sudan. This means the sole remaining voting African on the board come October will be South African Alan Barrett.

Msimang leaving and being replaced by a man of course changes the gender mix. After the AGM, there will be six women on the 20-seat board, five out of the 16 voting seats.

Note that I’m not analyzing the picks by some subjective “woke” criteria — ICANN has strict rules about geographic representation in its bylaws and every year its board of directors encourages NomCom to consider the gender mix when making its selections.

The bylaws state that each of the five geographic regions must have at least one seat on the board, and that no one region can have more than five directors.

That said, ICANN doesn’t make it easy to figure out which directors hail from which regions. There’s no published breakdown that I’m aware of and many directors have multiple citizenships and/or are long-term residents of nations outside their birth region.

Two other directors have their current terms ending next month — GNSO appointee Becky Burr (North America), who has been reappointed for a third term, and Akinori Maemura (Asia-Pac) who is being replaced by Christian Kaufmann (Europe) as an ASO appointee.

NomCom broke down the gender and geographic mix of applicants for all the open board and non-board positions here.

RDNH loser files second appeal

A big drug company has appealed to ICANN for a second time over a Reverse Domain Name Hijacking ruling against it, claiming ICANN should be responsible for the decisions of the World Intellectual Property Organization.

India-based Zydus Lifesciences, which among other things makes Covid-19 vaccines, lost a UDRP complaint against the owner of zydus.com in June. To add insult to injury, WIPO made a RDNH finding against it.

Rather that go to court, Zydus filed a Request for Reconsideration with ICANN in July, but this was summarily dismissed because the Reconsideration mechanism only applies to the actions or inactions of the ICANN board or staff.

Now Zydus has filed a second RfR, in which its lawyers claim ICANN is responsible for WIPO’s UDRP decisions and failure to address the first RfR amounts to board inaction. The latest claim states:

when a dispute resolution service provider is accredited by ICANN to conduct mandatory administrative policy, as prescribed by the UDRP adopted by ICANN, such service providers are extension of ICANN itself

Zydus claims the WIPO panel erred by relying on what it claims were false and misleading statements by the zydus.com registrant. It wants the decision reversed and the three panelists forever barred.

I doubt the RfR will get anywhere. ICANN’s Board Accountability Mechanisms Committee is not about to make itself the de facto court of appeals for every UDRP party who thinks they got stiffed.

Malaysia relaxes travel restrictions ahead of ICANN 75

Malaysia has made it easier for foreign travelers to enter the country, which should take some of the headaches out of going to ICANN 75 next month.

According to local reports, the Malaysian government web site, and official UK travel advice, those entering Malaysia are no longer required to fill out a “travelers card” on the government’s contact-tracing app, MySejahtera.

It’s not clear whether MySejahtera is still mandatory for entry. The UK says you “may” be required to install it,

On-arrival tests have been scrapped, regardless of vaccination status, the Malaysian government said:

From 1st August 2022, all travellers are allowed to enter Malaysia regardless of their COVID-19 vaccination status and do not require a pre-departure or on-arrival COVID-19 test. There are no quarantine orders related to COVID-19 enforced by the Malaysian Government upon arrival.

If you test positive for Covid-19 while in Malaysia, you’re still required by law to quarantine for four days (if you subsequently test negative) to seven days (regardless of the test result) at your own expense.

While the government rules may take some of the red tape out of entering the country, ICANN’s still has rules about entering the meeting venue.

To obtain entry to the Kuala Lumpur Convention Center, you’ll need to have proof of vaccination under the current version of ICANN’s health guidelines, which were last updated July 20.

Thanks to Richard Wein for the tip.

More rules, but cozier ICANN 75 expected

There will be more rules to follow at ICANN 75 next month, but attendees might be able to expect a more intimate event, with less stringent seating restrictions.

The gathering, ICANN’s 2022 Annual General Meeting, will be held in Kuala Lumpur from September 17 to 22, the second pandemic-era meeting to have a face-to-face component, but in-person attendees need to register by September 14.

The new rules are largely a result of local laws, according to ICANN.

The first thing to note is that if you don’t have a smart-phone, you’re out of luck. Malaysia requires people entering the country to install a government Covid-control track-and-trace app called MySejahtera.

The law also says you have to wear masking indoors and self-isolate for four to seven days if you test positive. ICANN’s mandatory legal waiver makes the attendee responsible for associated costs.

But at the venue itself, ICANN is relaxing its session rules, saying it may halve the social-distancing requirement in half to a meter, which will allow more people into each room and could reduce the need for waiting lists and overflow rooms.

Many of the sessions at ICANN 74 in June were over-booked.

Did ICANN pay for most meeting attendees to show up in The Hague?

ICANN may have lauded the return to in-person meetings for its gathering in The Hague in June, but there’s good reason to believe more than half of those who showed up may have been there on ICANN’s dime.

ICANN 74, which was the first public meeting with a face-to-face component since the Covid-19 pandemic began in late 2019, attracted 917 in-person attendees, according to the Org’s latest By-The-Numbers report (pdf).

But more than a quarter of the badge-holders were on ICANN’s payroll, and as many as a third more could have had their flights, hotels and food reimbursed by ICANN.

The report shows that 28.7% of in-person attendees — 263 people — were either ICANN staff (14.9%), board of directors (1.7%), or event support staff (12.1%).

If ICANN’s travel support reimbursements track with previous meetings, as many as half of the remaining 651 attendees could also have had their trips fully or partially paid for by ICANN.

ICANN typically pays for around 300 non-staffers to attend its thrice-annual meetings, largely community volunteers in key roles on committees, advisory groups or working groups, who are expected to work for their money, as well as those on outreach programs such as Next-Gen.

Supported travelers for the June 2019 meeting in Marrakech, Morocco amounted to 326 people at a cost of about $820,000. For the Montreal AGM later that year, ICANN spent $1.1 million supporting 366 community travelers.

There’s reason to believe that the number of supported travelers could be lower due to the pandemic, of course, but it does seem quite realistic that more than half of the people who turned up for ICANN 74 did so with their hands in ICANN’s pocket.

That’s not counting the remote participants who asked ICANN to reimburse them for their extra internet access costs to Zoom in during the meeting.

According to the ICANN report, 32 people claimed up to $60 each for their broadband during ICANN 74. That was down a little on the prior meeting in March, but up on the number claiming reimbursements during the height of the pandemic.

ICANN also broke down the nations each in-person attendee hailed from, for I believe the first time, revealing Ghana as a surprisingly enthusiastic participant.

The Netherlands and US occupied the top two slots of the participants-by-country rankings, with 149 and 121 delegates, but Ghana was third with 43, ahead of the UK’s 41 and Germany’s 35.

ICANN staffer to referee closed generics fight

An ICANN policy staffer seems set to chair discussions between governments and the gTLD community over how to regulate “closed generic” domains in the next round of new gTLD applications.

ICANN has put forward its own conflict resolution specialist Melissa Peters Allgood to facilitate the talks, and the Governmental Advisory Committee and GNSO Council have apparently concurred, according to recent correspondence.

“We are of the view that Ms. Allgood’s experience, qualifications, and neutrality in the matter meets the suggested criteria from the GAC and the GNSO Council,” ICANN chair Maarten Botterman told his GAC and GNSO counterparts.

The talks will attempt to reach a consensus on how closed generics can be permitted, but limited to applications that “serve a public interest goal”.

A closed generic is a dictionary-word gTLD that the applicant hopes to operate as a dot-brand even though it does not own a matching trademark. Think Nike operating .sneakers and excluding Adidas and Reebok from registering names there.

While the GNSO community was unable to come to consensus on whether they should be permitted in subsequent rounds, the nine-year-old “public interest goal” GAC advice is still applicable.

The GAC and GNSO have agreed that the talks will exclude the propositions that closed generics should be unrestricted or banned outright.

Once both parties have formally agreed to Allgood’s appointment, and to the size and makeup of the discussion group, Allgood will prepare more paperwork outlining the problem at hand before talks start to happen, according to Botterman.

Covid vaccine maker takes RDNH loss to ICANN board

An Indian pharmaceuticals firm with a $2 billion turnover has complained at the highest level of ICANN after it was handed a Reverse Domain Name Hijacking decision over the .com matching its company name.

Zydus Lifesciences, which produces mainly generic drugs but last year earned government approval to manufacture a Covid-19 vaccine, says a UDRP panel “exhibited extreme bias” when it threw out its UDRP complaint against the owner of zydus.com last month.

The company had claimed the anonymous registrant was cybersquatting, but the WIPO panel instead found RDNH.

The panel was not convinced that the registrant should have been aware of Zydus’ existence when he registered the name in 2004, and said his use of the name — which it characterized as a fanciful five-letter generic — to redirect to various affiliate marketing sites was not “bad faith”.

But now Zydus is claiming that the panel ignored evidence that it was already a very large company, with a $110 million turnover, at the time of registration, and says the UDRP decision shows evidence of bias against developing-world companies. The latter card is played pretty hard.

I believe this is only the second time that a UDRP decision has been challenged with a formal Request for Reconsideration with the ICANN board of directors, and there’s a pretty good chance it will be summarily dismissed like the first one.

Zydus will probably have to sue, or pay up.

Feds warn of Covid risk from “dark” Whois

The US Food and Drug Administration has escalated its beef with ICANN, warning that inaccessible Whois data is making it harder to tackle bogus Covid-19 “cures” and the country’s opioid crisis.

Catherine Hermsen from the FDA’s Office of Criminal Investigations wrote to ICANN CEO Göran Marby last week to complain that some registrars do not adequately respond to abuse complaints and that ICANN ignores follow-up complaints from government agencies.

She doubled down on the FDA’s previous complaint that ICANN’s inaction may be because it is funded by the industry, but back-pedaled on previous insinuations that ICANN’s leadership were putting their own big salaries ahead of public safety.

The beef started in early June, when an organization called Coalition for a Secure & Transparent Internet — basically a front for the likes of DomainTools and other companies whose business models are threatened by privacy legislation — held a one-sided webinar entitled “The Threat of a Dark WHOIS”.

On that webinar, Daniel Burke, chief of the FDA’s Investigative Services Division, lamented the lack of cooperation his agency gets when requesting private Whois data from “certain” registrars, and pointed to cases where the FDA’s inability to quickly get fake pharma sites, including those related to Covid-19, shut down have led to deaths.

He also said that complaints to ICANN about non-compliant registrars fall on deaf ears, to the point that it no longer bothers complaining, and suggested that ICANN and domain companies are financially incentivized to be uncooperative.

Burke quoted the writer Upton Sinclair: “It is difficult to get a man to understand something when his salary depends on his not understanding it.”

“I have found that’s the case with my interactions with ICANN and certain registries and registrars,” Burke said. “They just don’t want to listen… it’s a money-maker for them right now, it’s not profitable for them to deal with it.”

Marby also “spoke” on the CSTI webinar, but his brief intervention was actually just an out-of-context snippet — the “GDPR is not my fault!” T-shirt speech — taken from a recording of an ICANN webinar back in January and presented — dishonestly in my opinion — as if it had been filmed as a contribution to the CSTI discussion.

His inability to directly respond to Burke live led him to write to the FDA (pdf) a couple of weeks later to dispute some of his claims.

First, Marby said the the FDA does not need to obtain a subpoena to get access to Whois data. Registrars are obliged to respond to “legitimate interest” requests, when balanced against the privacy rights of the registrant, he said. He added:

In a few instances, government agencies have submitted complaints to ICANN Contractual Compliance regarding registrars’ refusal to provide non-public registration data. These agencies were ultimately successful in gaining access to the requested data without having to obtain a subpoena or lawful order.

Second, Marby disputed the financial motivation claims, writing: “ICANN’s leadership’s salaries are in no way tied to or dependent upon domain name registrations.”

Third, he offered a (pretty weak, in my view) defense against the claim that ICANN ignores complaints from government agencies, pointing out: “ICANN is not political and, therefore, takes actions to ensure that the workings of the Internet are not politicized.”

He also pointed out that ICANN operates a system called DNSTICR which monitors reports of DNS abuse related to the pandemic and alerts the relevant registries and registrars.

The problem here is that ICANN’s definition of abuse is pretty narrow and does not extend to web sites that sell industrial bleach as a Covid cure. That would count as “content” and ICANN is not the “content police”.

That’s pretty much what Hermsen says in the latest missive (pdf) in this row.

DNS security threats such as malware and phishing, however, were not what SA Burke was referring to in his presentation. Given the agency’s public health mission, FDA has been working during the pandemic to protect Americans from unproven or fraudulent medical products claiming to treat, cure, prevent, mitigate or diagnose COVID-19…

Given your stated concerns regarding COVID-19-related malware and phishing activity, we trust that you are equally concerned about registrars who may not be following the [Registrar Accreditation Agreement’s] requirements to “investigate” and “respond appropriately” following receipt of notifications about abuse, particularly complaints reporting activity involving COVID-19-related fraud or activity exacerbated the current opioid addiction crisis — especially in light of ICANN’s singular ability to enforce the terms of RAAs.

She also comes back, splitting hairs in my opinion, on the ICANN salaries claim, stating: “SA Burke was not referring to ICANN’s leadership salaries… SA Burke was referring more generally to the substantial source of funding ICANN receives from domain name registries and registrars.”

ICANN has just started work on a Whois Disclosure System that, while pretty weak, may make it slightly easier for government agencies to obtain the data they want.