Latest news of the domain name industry

Recent Posts

Registrars still not responding to private Whois requests

Kevin Murphy, October 18, 2018, Domain Policy

Registrars are still largely ignoring requests for private Whois data, according to a brand protection company working for Facebook.

AppDetex wrote to ICANN (pdf) last week to say that only 3% of some 9,000 requests it has made recently have resulted in the delivery of full Whois records.

Almost 60% of these requests were completely ignored, the company claimed, and 0.4% resulted in a request for payment.

You may recall that AppDetex back in July filed 500 Whois requests with registrars on behalf of client Facebook, with which it has a close relationship.

Then, only one registrar complied to AppDetex’s satisfaction.

Company general counsel Ben Milam now tells ICANN that more of its customers (presumably, he means not just Facebook) are using its system for automatically generating Whois requests.

He also says that these requests now contain more information, such as a contact name and number, after criticism from registrars that its demands were far too vague.

AppDetex is also no longer demanding reverse-Whois data — a list of domains owned by the same registrant, something not even possible under the old Whois system — and is limiting each of its requests to a single domain, according to Milam’s letter.

Registrars are still refusing to hand over the information, he wrote, with 11.4% of requests creating responses demanding a legal subpoena or UDRP filing.

The company reckons this behavior is in violation of ICANN’s Whois Temporary Specification.

The Temp Spec says registrars “must provide reasonable access to Personal Data in Registration Data to third parties on the basis of a legitimate interests pursued by the third party”.

The ICANN community has not yet come up with a sustainable solution for third-party access to private Whois. It’s likely to be the hottest topic at ICANN 63 in Barcelona, which kicks off this weekend.

Whois records for gTLD domains are of course, post-GDPR, redacted of all personally identifiable information, which irks big brand owners who feel they need it in order to chase cybersquatters.

Book review — “Domain Names: Strategies and Legal Aspects”

Kevin Murphy, October 18, 2018, Domain Policy

I’ve only ever read two books about the domain name industry.

The first one was Kieren McCarthy’s excellent Sex.com, the 2007 barely believable non-fictional tech-thriller that seemed to deliberately eschew inside-baseball policy talk in favor of a funny and rather gripping human narrative.

The second, Domain Names – Strategies and Legal Aspects, by Jeanette Soderlund Sause and Malin Edmar, is pretty much the diametrical opposite.

The book, published in its second edition in June, instead seems bent on explaining the complex intersection of domain names and intellectual property rights in as few words as it is able.

Coming in at a brisk 150 pages, it’s basically been engineered to funnel as much information into your brain as possible in as short a space of time as possible.

I blazed through my complimentary review copy during a three-hour train journey a couple months ago.

About half-way through, I realized I had done absolutely no background reading about the authors or publisher, and had no idea who the intended reader was.

The introduction, written for the 2014 first edition by a Swedish civil servant then on the GAC, gives the misleading impression that the book has something to say about multistakeholderism, DNS fragmentation, or new gTLD controversies.

It doesn’t. If the authors have any political opinions, you will not learn them from Domain Names.

What you will get is a competent reference work geared primarily towards IP lawyers and brand management folk who are newbies to the world of domain names.

The authors are both Swedish IP lawyers, though Soderland Sause is currently marketing VP for the .global gTLD registry.

The first half of their book deals with introducing and briefly explaining the high-level technical aspects of the DNS and the basic structure of the market, then discussing the difference between a trademark and a domain name.

An occasionally enlightening middle section of about 30 pages deals with strategies for selecting and obtaining domains, either as fresh registrations or from third parties such as cybersquatters, investors or competitors.

But the second half of the book — which deals with UDRP and related dispute resolution procedures — is evidently where the authors’, and presumably readers’, primary interest lies.

It goes into comparative depth on this topic, and I actually started to learn a few things during this section.

As a newcomer to the work, I cannot definitively say whether the new and updated content — which I infer covers developments in new gTLDs and such over the last four years — is worth the £120 upgrade for owners of the first edition.

It also seems to have gone to the printers before it was fully clear how ICANN was going to deal with GDPR; a third edition will likely be needed in a couple of years after the smoke clears.

I’d be lying if I said I had any fun reading Domain Names, but I don’t think I was supposed to.

I can see myself keeping it near my desk for occasional reference, which I think is what it’s mainly there for.

I can see IP lawyers or ICANN policy wonks also keeping copies by their desks, to be handed out to new employees as a primer on what they need to do to get their hands on the domains they want.

These juniors can then absorb the book over a weekend and keep it by their own desks for future reference, to be eventually passed on to the next n00b.

If that’s what it’s for, I think the authors have done a pretty good job of it.

Domain Names – Strategies and Legal Aspects, 2nd edition, by Jeanette Soderlund Sause and Malin Edmar, is published by Sweet & Maxwell.

ICANN says it can spend quarter-billion-dollar auction fund however it likes

Kevin Murphy, October 12, 2018, Domain Policy

ICANN can tap into its $236 million new gTLD auction fund whenever it wants, and there’s nothing the community can do about it, according to its board of directors.

The board this week said it has a “legal and fiduciary responsibility” over the money, and would be obliged to spend the cash to meet ICANN’s obligations if it ever needed to.

The statement came in a letter to the leaders of a community working group that this week published a set of preliminary recommendations (pdf) for how the money should be distributed.

The group — a cross-community working group or CCWG — laid out a few options for how the money should be administered, either by ICANN alone or in conjunction with a charitable third party, and distributed.

The money was collected from new gTLD applicants that participated in ICANN’s “last-resort” auctions to settle their contention sets. Over half of the money came from Verisign’s winning bid for .web, which is still being contested.

The CCWG said that the money should be used to:

  • Benefit the development, distribution, evolution and structures/projects that support the Internet’s unique identifier systems;
  • Benefit capacity building and underserved populations, and;
  • Benefit the open and interoperable Internet

But the CCWG could not agree among itself whether ICANN Org or community groups such as the GNSO or GAC should be able to grab some of the cash, which is currently held in a special fund, separated from ICANN’s operational budget.

The group asked the board for its opinion, and the board responded (pdf):

ICANN maintains legal and fiduciary responsibility over the funds, and the directors and officers have an obligation to protect the organization through the use of available resources. In such a case, while ICANN would not be required to apply for the proceeds, the directors and officers would have a fiduciary obligation to use the funds to meet the organization’s obligations.

In other words: it doesn’t matter what rules you put in place, it’s our money and we’re duty-bound to spend it if we have to.

The board added, however, that ICANN Org “currently does not foresee a situation where it would need to apply for the proceeds”.

ICANN is pretty well-funded. It would have to hit hard times indeed before it needed to crack open the auction nest egg.

The board also said that supporting organizations and advisory committees would not be able to apply for funding because they’re not legal entities and wouldn’t pass the due diligence.

The CCWG’s initial report is now open for public comment until November 27.

ICANN blocks .islam after government veto

Kevin Murphy, October 8, 2018, Domain Policy

After six years, ICANN has finally killed off the applications for the new gTLDs .islam and .halal, due to objections from several governments.

It has also rejected the application for .persiangulf from the same applicant.

The decisions were made by the ICANN board of directors last Wednesday. The resolutions were published Friday night.

The board said: “it is apparent that the vast majority of the Muslim community (more than 1.6 billion members) object to the applications for .HALAL and .ISLAM.”

This actually means that the Organization of Islamic Cooperation, the 57-nation treaty group with a combined 1.6 billion nominal Muslim citizens, objected to the applications.

Several governments with large Muslim populations — including the UAE, Malaysia, Turkey, India and Iran — had also individually told ICANN on the record that they were not happy.

The view from these governments seemed to be that if there’s going to be a .islam, it should be run under the umbrella of a group such as the OIC, rather than some random tuppenny ha’penny gTLD registry.

In Christianity, the comparable gTLD .catholic is run by an affiliate of the world’s oldest pedophile ring, while .bible is being run as a propaganda tool by a group of sexually repressed, homophobic American evangelicals.

The ICANN board said its decision to reject .islam and .halal was in tune with its “core values” to protect the “public interest”.

The decision was based “on its consideration of and commitment to ICANN’s Mission and core values set forth in the Bylaws, including ensuring that this decision is in the best interest of the Internet community and that it respects the concerns raised by the majority of the community most impacted by the proposed .HALAL and .ISLAM gTLDs”.

It’s been avoiding making this decision since at least December 2013.

But it has now voted that the two applications “should not proceed”. It does not appear to have banned organizations from applying for the strings in subsequent application rounds.

The applicant for .islam and .halal was Turkey-based Asia Green IT System. It applications have been “on-hold” since the GAC issued non-consensus advice against them back in April 2013.

The OIC filed Community Objections against both gTLDs with the International Chamber of Commerce, but failed on both counts.

Having failed to see any progress, in December 2015, AGIT filed an Independent Review Process appeal against its treatment by ICANN, and won.

The November 2017 IRP decision held that the “on-hold” status was a “new policy”, unilaterally put in place by ICANN Org, that unfairly condemned AGIT’s applications to indefinite limbo.

The panel ordered ICANN to make its damn mind up one way or the other and pay about $270,000 in costs.

While rejecting the applications may not seem unreasonable, it’s an important example of a minority group of governments getting an essential veto over a gTLD.

Under the rules of the 2012 application round, consensus GAC advice against an application is enough to kill it stone dead.

But the GAC had merely said (pdf):

The GAC recognizes that Religious terms are sensitive issues. Some GAC members have raised sensitivities on the applications that relate to Islamic terms, specifically .islam and .halal. The GAC members concerned have noted that the applications for .islam and .halal lack community involvement and support. It is the view of these GAC members that these applications should not proceed.

That’s non-consensus advice, which is expected to initiate bilateral engagement with ICANN’s board before a decision is made.

In the case of .persiangulf, also applied for by AGIT and also now rejected, the GAC didn’t even give non-consensus advice.

In fact, in its July 2013 Durban communique (pdf) is explicitly stated it “does not object to them proceeding”.

This appears to have been a not atypical GAC screw-up. The minutes of the Durban meeting, published months later, showed that the Gulf Cooperation Council states had in fact objected — there’s a bit of a dispute in that part of the world about whether it’s the “Persian Gulf” or “Arabian Gulf” — so the GAC would have been within its rights to publish non-consensus advice.

This all came out when the GCC filed its own IRP against ICANN, which it won.

The IRP panel in that case ordered ICANN to outright reject .persiangulf. Two years later, it now has.

While the three gTLDs in question are now going into “Will Not Proceed” status, that may not be the end of the story. One “Will Not Proceed” applicant, DotConnectAfrica, has taken ICANN to court in the US over its .africa application.

Here’s what ICANN’s boss is saying about Whois access now

Kevin Murphy, October 4, 2018, Domain Policy

Should ICANN become the sole source for looking up private domain registrant data? That’s one of the options for the post-GDPR world of Whois currently being mulled over on Waterfront Drive.

ICANN CEO Goran Marby laid out some of ICANN’s current thinking on the future of Whois last week at an occasionally combative meeting in Los Angeles.

One idea would see ICANN act as a centralized gatekeeper for all Whois data. Another could risk ICANN becoming much more tightly controlled by governments.

I’ve listened to the recordings, read the transcripts, chatted to participants, and I’m going to attempt to summarize what I believe is the current state of play.

As regular DI readers know, post-GDPR Whois policy is currently being debated to a tight deadline by an Expedited Policy Development Process working group.

The work has been a tough slog, and there seems to be little hope of the EPDP closing all of its outstanding issues before its first conclusions are due under three weeks from now.

One of the outstanding issues not yet addressed in any depth by the group is the potential creation of a “unified access model” — a standardized way cops, trademark owners, cybersecurity professionals and others could look at the same Whois data they could look at just a few months ago.

While the EPDP has carried on deferring discussion of such a model, ICANN Org has in parallel been beavering away trying to figure out whether it’s even going to be legally possible under the new European privacy law to open up Whois data to the people who want to see it, and it’s come up with some potentially game-changing ideas.

After weeks of conference calls, the EPDP working group — made up of 30-odd volunteers from all sections of the ICANN community — met in LA for three days last week to get down to some intensive face-to-face arguments.

I gather the meeting was somewhat productive, but it was jolted by the publication of an ICANN blog post in which Marby attempted to update the community on ICANN’s latest efforts to get clarity on how GDPR legally interacts with Whois.

Marby wrote that ICANN “wants to understand whether there are opportunities for ICANN, beyond its role as one of the ‘controllers’ with respect to WHOIS or its contractual enforcement role, to be acknowledged under the law as the coordinating authority of the WHOIS system.”

What did ICANN mean by this? While “controller” is a term of art defined in mind-numbing detail by the GDPR, “coordinating authority” is not. So ICANN’s blog post was open to interpretation.

It turns out I was not the only person confused by the post, and on Tuesday afternoon last week somebody from the EPDP team collared Marby in the corridor at ICANN HQ and dragged him into the meeting room to explain himself.

He talked with them for about an hour, but some attendees were still nonplussed — some sounded downright angry — after he left the room.

This is what I gleaned from his words.

No End-Runs

First off, Marby was at pains to point out, repeatedly, that ICANN is not trying to bypass the community’s Whois work.

It’s up to the community — currently the EPDP working group, and in a few weeks the rest of you — to decide whether there should be a unified access model for Whois, he explained.

What ICANN Org is doing is trying to figure out is whether a unified access model would even be legal under GDPR and how it could be implemented if it is legal, he said.

“If the community decides we should have a policy about a unified access model, that’s your decision,” he told the group. “We are trying to figure out the legal avenues if it’s actually possible.”

He talked about this to persons unknown at the European Commission in Brussels last month.

Whatever ICANN comes up with would merely be one input to the community’s work, he said. If it discovers that a unified access model would be totally illegal, it will tell the community as much.

Marby said ICANN is looking for “a legal framework for how can we diminish the contracted parties’ legal responsibility” when it comes to GDPR.

So far, it’s come up with three broad ideas about how this could happen.

The Certification Body Idea

GDPR sections 40 to 43 talk about the concepts of “codes of conduct” and “certification bodies”.

It’s possible that ICANN was referring to the possibility of itself becoming a certification body when it blogged about being a “coordinating authority”. Marby, during the EPDP meeting, unhelpfully used the term “accreditation house”.

These hypothetical entities (as far as I know none yet exist) would be approved by either national data protection authorities or the pan-EU European Data Protection Board to administer certification schemes for companies that broadly fall into the same category of data processing businesses.

It seems to be tailor-made for ICANN (though it wasn’t), which already has accreditation of registries and registrars as one of its primary activities.

But this legal avenue does not appear to be a slam-dunk. ICANN would presumably have to persuade a DPA or two, or the EDPB, that giving third parties managed access to citizens’ private data is a good thing.

You’d think that DPAs would be dead against such an idea, but the EU members of ICANN’s Governmental Advisory Committee have put their names to advice stating that Whois should remain accessible under certain circumstances, so it’s not impossible they could see it ICANN’s way.

The C.R.A.P. Idea

Marby’s second idea for taking some of the GDPR burden off the shoulders of contracted parties is to basically make ICANN a proxy, or man-in-the-middle, for Whois queries.

“What would happen if ICANN Org legally is the only place you can ask a question through?” he said. “And the only ones that the contracted parties actually can answer a question to would be ICANN Org? Would that move the legal responsibility away from the contracted parties to ICANN Org?”

In many ways, this is typical domain industry tactics — if there’s a rule you don’t want to follow, pass it off to a proxy.

This model was referred to during the session by EPDP members as the “hub and spoke” or “starfish”. I think the starfish reference might have been a joke.

Marby, in a jocular callback to the “Calzone” and “Cannoli” Whois proposals briefly debated in the community earlier this year, said that this model had a secret ICANN-internal code-name that is “something to do with food”.

Because whenever I’ve tried to coin a phrase in the past it has never stuck, I figure this time I may as well go balls-out and call it the “Cuisine-Related Access Plan” for now, if for no other reason than the acronym will briefly annoy some readers.

Despite the name I’ve given it, I don’t necessarily dislike the idea.

It seems to be inspired by, or at least informed by, side-channel communications between Marby and the Intellectual Property Constituency and Business Constituency, which are both no doubt mightily pissed off that the EPDP has so far proven surprisingly resilient to their attempts to get Whois access into the policy discussions as early as possible.

Two months ago, a few influential IP lawyers proposed to Marby (pdf) a centralized Whois model in which registrars collect data from registrants then pass it off to ICANN, which would be responsible for deciding who gets to see it.

Forget “thin” versus “thick” Whois — this one would be positively, arguably dangerously, obese. Contracted parties would be relegated to “processors” of private data under GDPR, with ICANN the sole “controller”.

Benefits of this would include, these lawyers said, reducing contracted parties’ exposure to GDPR.

It’s pretty obvious why the IP lobby would prefer this — ICANN is generally much more amenable to its demands than your typical registry or registrar, and it would very probably be easier to squeeze data out of ICANN.

While Marby specifically acknowledged that ICANN has taken this suggestion as one of its inputs — and has run it by the DPAs — he stopped well short of fully endorsing it during last week’s meeting in LA.

He seemed to instead describe a system whereby ICANN acts as the gatekeeper to the data, but the data is still stored and controlled at the registry or registrar, saying: “We open a window for access to the data so the data is still at the contracted parties because they use that data for other reasons as well”.

The Insane Idea

The third option, which Marby seemed to characterize as the least “sane” of the three, would be to have Whois access recognized by law as a public interest, enabling the Whois ecosystem to basically ignore GDPR.

Remember, back on on GDPR Day, I told you about how the .dk ccTLD registry is carrying on publishing Whois as normal because a Danish law specifically forces it to?

Marby’s third option seems to be a little along those lines. He specifically referred to Denmark and Finland (which appears to have a similar rule in place) during the LA session.

If I understand correctly, it seems there’d have to be some kind of “legal action” in the EU — either legislation in a member state, or perhaps something a little less weighty — that specifically permitted or mandated the publication of otherwise private Whois data in gTLD domains.

Marby offered trademark databases and telephone directories as examples of data sets that appear to be exempt from GDPR protection due to preexisting legislation.

One problem with this third idea, some say, is that it could bring ICANN policy under the direct jurisdiction of a single nation state, something that it had with the US government for the best part of two decades and fought hard to shake off.

If ICANN was given carte blanche to evade GDPR by a piece of legislation in, say, Lithuania, would not ICANN and its global stakeholders forever be slaves to the whims of the Lithuanian legislature?

And what if that US bill granting IP interests their Whois wet dream passes onto the statute books and ICANN finds itself trapped in a jurisdictional clusterfuck?

Oh, my.

Fatuous Conclusion For The Lovely People Who Generously Bothered To Read To The End

I’m not a lawyer, so I don’t pretend to have a comprehensive understanding of any of this, but to be honest I’m not convinced the lawyers do either.

If you think you do, call me. I want to hear from you. I’m “domainincite” on Skype. Cheers.