Latest news of the domain name industry

Recent Posts

ICANN blocks .islam after government veto

Kevin Murphy, October 8, 2018, Domain Policy

After six years, ICANN has finally killed off the applications for the new gTLDs .islam and .halal, due to objections from several governments.

It has also rejected the application for .persiangulf from the same applicant.

The decisions were made by the ICANN board of directors last Wednesday. The resolutions were published Friday night.

The board said: “it is apparent that the vast majority of the Muslim community (more than 1.6 billion members) object to the applications for .HALAL and .ISLAM.”

This actually means that the Organization of Islamic Cooperation, the 57-nation treaty group with a combined 1.6 billion nominal Muslim citizens, objected to the applications.

Several governments with large Muslim populations — including the UAE, Malaysia, Turkey, India and Iran — had also individually told ICANN on the record that they were not happy.

The view from these governments seemed to be that if there’s going to be a .islam, it should be run under the umbrella of a group such as the OIC, rather than some random tuppenny ha’penny gTLD registry.

In Christianity, the comparable gTLD .catholic is run by an affiliate of the world’s oldest pedophile ring, while .bible is being run as a propaganda tool by a group of sexually repressed, homophobic American evangelicals.

The ICANN board said its decision to reject .islam and .halal was in tune with its “core values” to protect the “public interest”.

The decision was based “on its consideration of and commitment to ICANN’s Mission and core values set forth in the Bylaws, including ensuring that this decision is in the best interest of the Internet community and that it respects the concerns raised by the majority of the community most impacted by the proposed .HALAL and .ISLAM gTLDs”.

It’s been avoiding making this decision since at least December 2013.

But it has now voted that the two applications “should not proceed”. It does not appear to have banned organizations from applying for the strings in subsequent application rounds.

The applicant for .islam and .halal was Turkey-based Asia Green IT System. It applications have been “on-hold” since the GAC issued non-consensus advice against them back in April 2013.

The OIC filed Community Objections against both gTLDs with the International Chamber of Commerce, but failed on both counts.

Having failed to see any progress, in December 2015, AGIT filed an Independent Review Process appeal against its treatment by ICANN, and won.

The November 2017 IRP decision held that the “on-hold” status was a “new policy”, unilaterally put in place by ICANN Org, that unfairly condemned AGIT’s applications to indefinite limbo.

The panel ordered ICANN to make its damn mind up one way or the other and pay about $270,000 in costs.

While rejecting the applications may not seem unreasonable, it’s an important example of a minority group of governments getting an essential veto over a gTLD.

Under the rules of the 2012 application round, consensus GAC advice against an application is enough to kill it stone dead.

But the GAC had merely said (pdf):

The GAC recognizes that Religious terms are sensitive issues. Some GAC members have raised sensitivities on the applications that relate to Islamic terms, specifically .islam and .halal. The GAC members concerned have noted that the applications for .islam and .halal lack community involvement and support. It is the view of these GAC members that these applications should not proceed.

That’s non-consensus advice, which is expected to initiate bilateral engagement with ICANN’s board before a decision is made.

In the case of .persiangulf, also applied for by AGIT and also now rejected, the GAC didn’t even give non-consensus advice.

In fact, in its July 2013 Durban communique (pdf) is explicitly stated it “does not object to them proceeding”.

This appears to have been a not atypical GAC screw-up. The minutes of the Durban meeting, published months later, showed that the Gulf Cooperation Council states had in fact objected — there’s a bit of a dispute in that part of the world about whether it’s the “Persian Gulf” or “Arabian Gulf” — so the GAC would have been within its rights to publish non-consensus advice.

This all came out when the GCC filed its own IRP against ICANN, which it won.

The IRP panel in that case ordered ICANN to outright reject .persiangulf. Two years later, it now has.

While the three gTLDs in question are now going into “Will Not Proceed” status, that may not be the end of the story. One “Will Not Proceed” applicant, DotConnectAfrica, has taken ICANN to court in the US over its .africa application.

Here’s what ICANN’s boss is saying about Whois access now

Kevin Murphy, October 4, 2018, Domain Policy

Should ICANN become the sole source for looking up private domain registrant data? That’s one of the options for the post-GDPR world of Whois currently being mulled over on Waterfront Drive.

ICANN CEO Goran Marby laid out some of ICANN’s current thinking on the future of Whois last week at an occasionally combative meeting in Los Angeles.

One idea would see ICANN act as a centralized gatekeeper for all Whois data. Another could risk ICANN becoming much more tightly controlled by governments.

I’ve listened to the recordings, read the transcripts, chatted to participants, and I’m going to attempt to summarize what I believe is the current state of play.

As regular DI readers know, post-GDPR Whois policy is currently being debated to a tight deadline by an Expedited Policy Development Process working group.

The work has been a tough slog, and there seems to be little hope of the EPDP closing all of its outstanding issues before its first conclusions are due under three weeks from now.

One of the outstanding issues not yet addressed in any depth by the group is the potential creation of a “unified access model” — a standardized way cops, trademark owners, cybersecurity professionals and others could look at the same Whois data they could look at just a few months ago.

While the EPDP has carried on deferring discussion of such a model, ICANN Org has in parallel been beavering away trying to figure out whether it’s even going to be legally possible under the new European privacy law to open up Whois data to the people who want to see it, and it’s come up with some potentially game-changing ideas.

After weeks of conference calls, the EPDP working group — made up of 30-odd volunteers from all sections of the ICANN community — met in LA for three days last week to get down to some intensive face-to-face arguments.

I gather the meeting was somewhat productive, but it was jolted by the publication of an ICANN blog post in which Marby attempted to update the community on ICANN’s latest efforts to get clarity on how GDPR legally interacts with Whois.

Marby wrote that ICANN “wants to understand whether there are opportunities for ICANN, beyond its role as one of the ‘controllers’ with respect to WHOIS or its contractual enforcement role, to be acknowledged under the law as the coordinating authority of the WHOIS system.”

What did ICANN mean by this? While “controller” is a term of art defined in mind-numbing detail by the GDPR, “coordinating authority” is not. So ICANN’s blog post was open to interpretation.

It turns out I was not the only person confused by the post, and on Tuesday afternoon last week somebody from the EPDP team collared Marby in the corridor at ICANN HQ and dragged him into the meeting room to explain himself.

He talked with them for about an hour, but some attendees were still nonplussed — some sounded downright angry — after he left the room.

This is what I gleaned from his words.

No End-Runs

First off, Marby was at pains to point out, repeatedly, that ICANN is not trying to bypass the community’s Whois work.

It’s up to the community — currently the EPDP working group, and in a few weeks the rest of you — to decide whether there should be a unified access model for Whois, he explained.

What ICANN Org is doing is trying to figure out is whether a unified access model would even be legal under GDPR and how it could be implemented if it is legal, he said.

“If the community decides we should have a policy about a unified access model, that’s your decision,” he told the group. “We are trying to figure out the legal avenues if it’s actually possible.”

He talked about this to persons unknown at the European Commission in Brussels last month.

Whatever ICANN comes up with would merely be one input to the community’s work, he said. If it discovers that a unified access model would be totally illegal, it will tell the community as much.

Marby said ICANN is looking for “a legal framework for how can we diminish the contracted parties’ legal responsibility” when it comes to GDPR.

So far, it’s come up with three broad ideas about how this could happen.

The Certification Body Idea

GDPR sections 40 to 43 talk about the concepts of “codes of conduct” and “certification bodies”.

It’s possible that ICANN was referring to the possibility of itself becoming a certification body when it blogged about being a “coordinating authority”. Marby, during the EPDP meeting, unhelpfully used the term “accreditation house”.

These hypothetical entities (as far as I know none yet exist) would be approved by either national data protection authorities or the pan-EU European Data Protection Board to administer certification schemes for companies that broadly fall into the same category of data processing businesses.

It seems to be tailor-made for ICANN (though it wasn’t), which already has accreditation of registries and registrars as one of its primary activities.

But this legal avenue does not appear to be a slam-dunk. ICANN would presumably have to persuade a DPA or two, or the EDPB, that giving third parties managed access to citizens’ private data is a good thing.

You’d think that DPAs would be dead against such an idea, but the EU members of ICANN’s Governmental Advisory Committee have put their names to advice stating that Whois should remain accessible under certain circumstances, so it’s not impossible they could see it ICANN’s way.

The C.R.A.P. Idea

Marby’s second idea for taking some of the GDPR burden off the shoulders of contracted parties is to basically make ICANN a proxy, or man-in-the-middle, for Whois queries.

“What would happen if ICANN Org legally is the only place you can ask a question through?” he said. “And the only ones that the contracted parties actually can answer a question to would be ICANN Org? Would that move the legal responsibility away from the contracted parties to ICANN Org?”

In many ways, this is typical domain industry tactics — if there’s a rule you don’t want to follow, pass it off to a proxy.

This model was referred to during the session by EPDP members as the “hub and spoke” or “starfish”. I think the starfish reference might have been a joke.

Marby, in a jocular callback to the “Calzone” and “Cannoli” Whois proposals briefly debated in the community earlier this year, said that this model had a secret ICANN-internal code-name that is “something to do with food”.

Because whenever I’ve tried to coin a phrase in the past it has never stuck, I figure this time I may as well go balls-out and call it the “Cuisine-Related Access Plan” for now, if for no other reason than the acronym will briefly annoy some readers.

Despite the name I’ve given it, I don’t necessarily dislike the idea.

It seems to be inspired by, or at least informed by, side-channel communications between Marby and the Intellectual Property Constituency and Business Constituency, which are both no doubt mightily pissed off that the EPDP has so far proven surprisingly resilient to their attempts to get Whois access into the policy discussions as early as possible.

Two months ago, a few influential IP lawyers proposed to Marby (pdf) a centralized Whois model in which registrars collect data from registrants then pass it off to ICANN, which would be responsible for deciding who gets to see it.

Forget “thin” versus “thick” Whois — this one would be positively, arguably dangerously, obese. Contracted parties would be relegated to “processors” of private data under GDPR, with ICANN the sole “controller”.

Benefits of this would include, these lawyers said, reducing contracted parties’ exposure to GDPR.

It’s pretty obvious why the IP lobby would prefer this — ICANN is generally much more amenable to its demands than your typical registry or registrar, and it would very probably be easier to squeeze data out of ICANN.

While Marby specifically acknowledged that ICANN has taken this suggestion as one of its inputs — and has run it by the DPAs — he stopped well short of fully endorsing it during last week’s meeting in LA.

He seemed to instead describe a system whereby ICANN acts as the gatekeeper to the data, but the data is still stored and controlled at the registry or registrar, saying: “We open a window for access to the data so the data is still at the contracted parties because they use that data for other reasons as well”.

The Insane Idea

The third option, which Marby seemed to characterize as the least “sane” of the three, would be to have Whois access recognized by law as a public interest, enabling the Whois ecosystem to basically ignore GDPR.

Remember, back on on GDPR Day, I told you about how the .dk ccTLD registry is carrying on publishing Whois as normal because a Danish law specifically forces it to?

Marby’s third option seems to be a little along those lines. He specifically referred to Denmark and Finland (which appears to have a similar rule in place) during the LA session.

If I understand correctly, it seems there’d have to be some kind of “legal action” in the EU — either legislation in a member state, or perhaps something a little less weighty — that specifically permitted or mandated the publication of otherwise private Whois data in gTLD domains.

Marby offered trademark databases and telephone directories as examples of data sets that appear to be exempt from GDPR protection due to preexisting legislation.

One problem with this third idea, some say, is that it could bring ICANN policy under the direct jurisdiction of a single nation state, something that it had with the US government for the best part of two decades and fought hard to shake off.

If ICANN was given carte blanche to evade GDPR by a piece of legislation in, say, Lithuania, would not ICANN and its global stakeholders forever be slaves to the whims of the Lithuanian legislature?

And what if that US bill granting IP interests their Whois wet dream passes onto the statute books and ICANN finds itself trapped in a jurisdictional clusterfuck?

Oh, my.

Fatuous Conclusion For The Lovely People Who Generously Bothered To Read To The End

I’m not a lawyer, so I don’t pretend to have a comprehensive understanding of any of this, but to be honest I’m not convinced the lawyers do either.

If you think you do, call me. I want to hear from you. I’m “domainincite” on Skype. Cheers.

It’s Drazek vs Dammak for GNSO Council chair

Kevin Murphy, September 28, 2018, Domain Policy

The chair of ICANN’s Generic Names Supporting Organization Council is contested this year, with a registry veep facing off against a software engineer.

The nomination from the contracted parties house is US-based Keith Drazek, Verisign’s VP of policy and government relations.

He’ll be opposed by non-contracted parties nominee and current vice-chair Rafik Dammak, a Tunisian working as a software engineer for NTT Communications (which is technically a contracted party due its dot-brand gTLD) in Japan.

Both men are long-time, active members of the ICANN community and GNSO.

The Council will pick its new chair about a month from now at the ICANN 63 meeting in Barcelona.

The winner will replace lawyer Heather Forrest, the non-contracted party who took the seat after an unopposed vote a year ago.

Chutzpah alert! DotKids wants ICANN handout to fight gTLD auction

Kevin Murphy, September 24, 2018, Domain Policy

New gTLD applicant DotKids Foundation has asked ICANN for money to help it fight for .kids in an auction against Amazon and Google.

The not-for-profit was the only new gTLD applicant back in 2012 to meet the criteria for ICANN’s Applicant Support Program, meaning its application fee was reduced by $138,000 to just $47,000.

Now, DotKids reckons ICANN has a duty to carry on financially supporting it through the “later stages of the process” — namely, an auction with two of the world’s top three most-valuable companies.

The organization even suggests that ICANN dip into its original $2 million allocation to support the program to help fund its bids.

Because .kids is slated for a “last resort” auction, an ICANN-funded winning bid would be immediately returned to ICANN, minus auction provider fees.

It’s a ludicrously, hilariously ballsy move by the applicant, which is headed by DotAsia CEO Edmon Chung.

It’s difficult to see it as anything other than a delaying tactic.

DotKids is currently scheduled to go to auction against Google’s .kid and Amazon’s .kids application on October 10.

But after ICANN denied its request for funding last month, DotKids last week filed a Request for Reconsideration (pdf), which may wind up delaying the auction yet again.

According to DotKids, the original intent of the Applicant Support Program was to provide support for worthy applicants not just in terms of application fees, but throughout the application process.

It points to the recommendations of the Joint Applicant Support working group of the GNSO, which came up with the rules for the support program, as evidence of this intent.

It says ICANN needs to address the JAS recommendations it ignored in 2012 — something that could time quite some time — and put the .kids auction on hold until then.

KSK vote was NOT unanimous

Kevin Murphy, September 18, 2018, Domain Policy

ICANN’s board of directors on Sunday voted to approve the forthcoming security key change at the DNS root, but there was some dissent.

Director Avri Doria, a Nominating Committee appointee, said today that she provided the lone vote against the DNSSEC KSK rollover, which is expected to cause temporary internet access problems for potentially a couple million people next month.

I understand there was also a single abstention to Sunday’s vote.

Doria has released a dissenting statement, in which she said the absence of an external, peer-reviewed study of the risks could prove a problem.

The greatest risk is that out of the millions that will fail after the roll over, some that are serious and may even be critical, may occur; if this happens the lack of peer reviewed studies may be a liability for ICANN, perhaps not legal, but in terms of our reputation as protectors of the stability & security of internet system of names.

She added that she was concerned about the extent that the public has been notified of the rollover plan, and questioned whether the current risk mitigation plan is sufficient.

Doria said she found comments filed by Verisign (pdf) particularly informative to her eventual vote, as well as comments from the At-Large Advisory Committee (pdf), Business Constituency (pdf) and Registries Stakeholder Group (pdf).

These groups had called for more study and data, better outreach, more clearly defined success/failure benchmarks, and more delay.

Doria noted in her dissenting statement that the ICANN board did not have a chance to quiz any of the minority of the members of the Security and Stability Advisory Committee who had called for further delay.

The board’s resolution, apparently arrived at after two hours of formal in-person discussions in Brussels at the weekend, is expected to be published shortly.

The rollover, which has already been delayed a year, is now scheduled to go ahead October 11.

Any impact is expected to be felt within a couple of days, as the change ripples out across the DNS.

ICANN says that any network operator impacted by the change has a simple fix: turn off DNSSEC. Then, if they want, they can update their keys and turn it back on again.

ICANN turns 20 today (or maybe not)

Kevin Murphy, September 18, 2018, Domain Policy

ICANN is expected to celebrate its 20th anniversary at its Barcelona meeting next month, but by some measures it has already had its birthday.

If you ask Wikipedia, it asserts that ICANN was “created” on September 18, 1998, 20 years ago today.

But that claim, which has been on Wikipedia since 2003, is unsourced and probably incorrect.

While it’s been repeated elsewhere online for the last 15 years, I’ve been unable to figure out why September 18 has any significance to ICANN’s formation.

I think it’s probably the wrong date.

It seems that September 16, 1998 was the day that IANA’s Jon Postel and Network Solutions jointly published the organization’s original bylaws and articles of incorporation, and first unveiled the name “ICANN”.

That’s according to my former colleague and spiritual predecessor Nick Patience (probably the most obsessive journalist following DNS politics in the pre-ICANN days), writing in now-defunct Computergram International on September 17, 1998.

The Computergram headline, helpfully for the purposes of the post you are reading, is “IANA & NSI PUBLISH PLAN FOR DNS ENTITY: ICANN IS BORN”.

Back then, before the invention of the paragraph and when ALL CAPS HEADLINES were considered acceptable, Computergram was published daily, so Patience undoubtedly wrote the story September 16, the same day the ICANN proposal was published.

A joint Postel/NetSol statement on the proposal was also published September 17.

The organization was not formally incorporated until September 30, which is probably a better candidate date for ICANN’s official birthday, archived records show.

Birthday meriments are expected to commence during ICANN 63, which runs from October 20 to 25. There’s probably free booze in it, for those on-site in Barcelona.

As an aside that amused me, the Computergram article notes that Jones Day lawyer Joe Sims very kindly provided Postel with his services during ICANN’s creation on a “pro bono basis”.

Jones Day has arguably been the biggest beneficiary of ICANN cash over the intervening two decades, billing over $8.7 million in fees in ICANN’s most recently reported tax year alone.

Van der Laan to leave ICANN board

Kevin Murphy, September 17, 2018, Domain Policy

Former Dutch politician Lousewies van der Laan is to leave the ICANN board of directors next month and be replaced with the former CEO of the Serbian ccTLD.

ICANN said yesterday that Danko Jevtovic, who headed RNIDS from 2013 until July last year, has been selected to occupy van der Laan’s seat following the Annual General Meeting in Barcelona.

Van der Laan, who had been selected by the Nominating Committee for a second term, has had to decline the offer “due to unforeseen family obligations”, ICANN said.

Jevtovic will take his seat at the same time as fellow NomCom appointee, Tripti Sinha of the University of Maryland, who oversees management of the DNS D-root server and replaces term-limited George Sadowsky.

El Salvadorean ccTLD founder Rafael “Lito” Ibarra is the third NomCom appointee this year, starting his second term next month.

Set buttocks to clench! ICANN approves risky KSK rollover

Kevin Murphy, September 17, 2018, Domain Policy

ICANN has approved the first rollover of the domain name system’s master security key, setting the clock ticking on a change that could cause internet access issues for millions.

The so-called KSK rollover, when ICANN deletes the key-signing key that has been used as the trust anchor for the DNSSEC ecosystem since 2011 and replaces it with the new one — will now go ahead as planned on October 11.

The decision was made yesterday at the ICANN board of directors’ retreat in Brussels.

ICANN chief technology officer David Conrad posted this to an ICANN mailing list this morning:

The Board voted to approve the resolution for ICANN org to move forward with the revised KSK rollover plan. So barring unforeseen circumstances, the KSK-2017-signed ZSK will be used to sign the root zone on 11 October 2018.

The rollover was due to happen October 11 last year, but ICANN delayed it when it emerged that many DNS resolvers weren’t yet configured to use the new key.

That’s still a problem, and nobody knows for sure how many endpoints will stop functioning properly when the new KSK goes solo.

While most experts weighing in on the rollover, including Conrad, agreed that the risk of more delay outweighed the risk of rolling now, that feeling was not unanimous.

Five members of the 22-member Security and Stability Advisory Committee — including top guys from Google and Verisign — last month dissented from the majority view and said ICANN should delay again.

The question now is not whether internet users will see a disruption in the days following October 11, but how many users will be affected and how serious their disruptions will be.

Based on current information, as many as two million internet users could be affected.

ICANN is likely to take flak for even relatively minor disruptions, but the alternative was to continue with the delays and risk an even bigger impact, and even more flak, in future.

The text of ICANN’s resolution and the rationale behind it will be published in the next day or so.

Mediators hired as Whois reformers butt heads

Kevin Murphy, September 17, 2018, Domain Policy

ICANN has hired professional mediators to help resolve strong disagreements in the working group tasked with reforming Whois for the post-GDPR world.

Kurt Pritz, chair of the Expedited Policy Development Process for Whois, last week told the group that ICANN has drafted in the Consensus Building Institute, with which it has worked before, to help “narrow issues and reach consensus”.

Three CBI mediators will brief the EPDP group today, and join them when the WG meets face-to-face for the first time at a three-day session in Los Angeles later this month.

Their goal is not to secure any particular outcome, but to help the disparate viewpoints find common ground, Pritz told the group.

It’s been Pritz’s intention to get the mediators in since day one — he knew in advance how divisive Whois policy is — but it’s taken until now to get the contracts signed.

The EPDP WG’s job is to create a new, privacy-conscious, consensus Whois policy that will apply to all gTLD registries and registrars. Its output will replace ICANN’s post-GDPR Temporary Specification for Registration Data, which in turn replaced the longstanding Whois policy attached to all ICANN registry and registrar contracts.

Since the working group first convened in early August — about 500 emails and 24 hours of painful teleconferences ago — common ground has been hard to find, and in fact the EPDP group did not even attempt to find consensus for the first several weeks of discussions.

Instead, they worked on its first deliverable, which was finalized last week, a “triage report” that sought to compile each faction‘s opinion of each section of ICANN’s Temp Spec.

The idea seemed sensible at the time, but with hindsight it’s arguable whether this was the best use of the group’s time.

The expectation, I believe, was that opposing factions would at least agree on some sections of text, which could then be safely removed from future debate.

But what emerged instead was this, a matrix of disagreement in which no part of the Temp Spec did not have have at least one group in opposition: Triage Table

The table is potentially misleading, however. Because groups were presented with a binary yes/no option for each part of the spec, “no” votes were sometimes recorded over minor language quibbles where in fact there was agreement in principle.

By restricting the first few weeks of conversation to the language of the Temp Spec, the debate was arguably prematurely hamstrung, causing precious minutes to trickle away.

And time is important — the EPDP is supposed to deliver its consensus-based Initial Report to the ICANN 63 meeting in Barcelona about five weeks from now.

That’s going to be tough.

What’s becoming increasingly clear to me from the post-triage talks is that the WG’s task could be seen as not much less than a wholesale, ground-up, reinvention of the Whois wheel, recreated with GDPR as the legal framework.

Who is Whois for?

Discussions so far have been quite mind-expanding, forcing some fundamental rethinking of long-held, easy assumptions, at least for this lurker. Here’s an example.

One of the fundamental pillars of GDPR is the notion of “purposes”. Companies that collect private data on individuals have to do so only with specific, enumerated purposes in mind.

The WG has started by discussing registrars. What purpose does a registrar have when it collects Whois data from its registrants?

None whatsoever, it was claimed.

“To execute the contract between the registrant and the registrar, it’s really not necessary for registrars to collect any of this information,” GoDaddy head of policy James Bladel, representing registrars, told the group on its latest call Thursday.

Registrars collect data on their customers (not just contact data, but also stuff like credit card details) for billing and support purposes, but this is not the same as Whois data. It’s stored separately and never published anywhere. While covered by GDPR, it’s not covered by Whois policy.

Whois data is only collected by registrars for third parties’ purposes, whether that third party be a registry, ICANN, a data escrow agent, a cop, or an intellectual property enforcer.

“Other than a few elements such as domain name servers, there is nothing that is collected in Whois that is needed for the registrar to do their business,” At-Large Advisory Committee chair Alan Greenberg told the WG. “All of them are being collected for their availability to third parties, should they need it.”

While this may seem like a trivial distinction, drawing a hard line between the purposes of registries, registrars and ICANN itself on the one hand and law enforcement, cybersecurity and IP lawyers on the other is one of the few pieces of concrete advice ICANN has received from European data protection regulators.

There’s by no means unanimous agreement that the registrars’ position is correct, but it’s this kind of back-to-basics discussion that makes me feel it’s very unlikely that the EPDP is going to be able to produce an Initial Report with anything more than middling consensus by the October deadline.

I may be overly pessimistic, but (mediators or no mediators) I expect its output will be weighted more towards outlining and soliciting public comment on areas of disagreement than consent.

And the WG has not yet even looked in depth at the far thornier issue of “access” — the policy governing when third parties such as IP lawyers will be able to see redacted Whois data.

Parties on the pro-access side of the WG have been champing at the bit to bring access into the debate at every opportunity, but have been

Hey, look, a squirrel!

The WG has also been beset by its fair share of distractions, petty squabbles and internal power struggles.

The issues of “alternates” — people appointed by the various constituencies to sit in on the WG sessions when the principles are unavailable — caused some gnashing of teeth, first over their mailing list and teleconference privileges and then over how much access they should get to the upcoming LA meeting.

Debates about GDPR training — which some say should have been a prerequisite to WG participation — have also emerged, after claims that not every participant appeared clued-in as to what the law actually requires. After ICANN offered a brief third-party course, there were complaints that it was inadequate.

Most recently, prickly Iranian GAC rep Kavouss Arasteh last week filed a formal Ombudsman complaint over a throwaway god-themed pun made by Non-Com Milton Mueller, and subsequently defended by fellow non-resident Iranian Farzaneh Badii, in the Adobe Connect chat room at the September 6 meeting.

Mueller has been asked to apologize.

Empty Whois a threat to the US elections?

Kevin Murphy, September 5, 2018, Domain Policy

Could a lack of Whois records thwart the fight against attempts to interfere in this year’s US elections?

That’s the threat raised by DomainTools CEO Tim Chen in a blog post, and others, this week.

Chen points to recent research by Facebook, based on an investigation by security company FireEye, that linked a large network of bogus news sites and social media accounts to the Iranian state media.

FireEye’s investigation used “historical Whois records”, presumably provided by DomainTools, to connect the dots between various domains and registrants associated with “Liberty Front Press”, a purportedly independent media organization and prolific social media user.

Facebook subsequently found that 652 accounts, pages and groups associated with the network, and removed them from its platform.

The accounts and sites in question were several years old but had been focusing primarily on politics in the UK and US since last year, Facebook said.

Based on screenshots shared by Facebook, the accounts had been used to spread political messages bashing US president Donald Trump and supporting the UK’s staunchly pro-Palestinian opposition leader Jeremy Corbyn.

Google’s research, also inspired by FireEye’s findings and Whois data, linked the network to the state-run Islamic Republic of Iran Broadcasting.

The actions by Google and Facebook come as part of their crackdown on fake news ahead of the US mid-term Congressional elections, this November, which are are largely being seen as a referendum on the Trump presidency.

Because the domains in question predate the General Data Protection Regulation and ICANN’s response to it, DomainTools was able to capture Whois records before they went dark in May.

While the records often use bogus data, registrant email addresses common to multiple domains could be used to establish common ownership.

Historical Whois data for domains registered after May 2018 is not available, which will likely degrade the utility of DomainTools’ service over time.

Chen concluded his blog post, which appeared to be written partly in response to data suggesting that GDPR has not led to a growth in spam, with this:

Domain name Whois data isn’t going to solve the world’s cyberattack problems all on its own, but these investigations, centering on an issue of global importance that threatens our very democracy, likely get severely impaired without it. And this is just the tip of the iceberg, a few uniquely important investigations among the hundreds of thousands of cyberattacks going on all day every day all over the globe by people and organizations that can now hide behind the anonymity inherent in today’s internet. It’s reasonable that domain names used for certain commercial or functional purposes should require transparent registration information. Whois is not a crime.

DomainTools is one of the founders of the new Coalition for a Secure and Transparent Internet, a lobby group devoted to encouraging legislatures to keep Whois open.

Representatives of Facebook and Iran’s government are among the members of the Expedited Policy Development Process on Whois, an emergency ICANN working group that is currently trying to write a permanent GDPR-compliant Whois policy for ICANN.