Europe’s top dogs could decide the future of Whois

ICANN is pleading with the European Commission for legal clarity to help solve the two-year-old fight over the future of Whois in the age of GDPR.

CEO Göran Marby has written to three commissioners to ask for a definitive opinion on whether a centralized, mostly automated Whois system would free up registries and registrars from legal liability if their customers’ data is inappropriately disclosed.

It’s a question ICANN has been asking for years, but this time it comes after the ICANN community has come up with a set of policy recommendations that would create something called SSAD, for System for Standardized Access/Disclosure.

SSAD is supported by registries, registrars and non-commercial interests, but has been broadly criticized by governments, intellectual property interests, security experts and others as being not fit for purpose.

While it would create a centralized gateway for funneling Whois queries to contracted parties, and an accreditation system for those making the queries, the decision to accept or refuse the query would still lie with registries and registrars and be largely human-powered.

It’s been described as a glorified, $9 million-a-year ticketing system that will fail to provide better access to Whois to those who say they need it (largely the IP interests).

But registries and registrars say they cannot accept a solution that offloads decision-making to a centralized third party such as ICANN, unless that third party shoulders all the legal liability for mistakes, and whether that’s possible is far from clear this early in the life of GDPR.

As Marby told the commissioners:

Legal clarity could mean the difference between ICANN having a fragmented system that routes most requests for access to non-public registration data from requestors to thousands of individual registries and registrars for a decision, on the one hand, versus ultimately being able to implement a centralized, predictable solution in which decisions about whether or not to disclose non-public registration data in most or all cases could be made consistently, predictably, in a manner that is transparent and accountable to requestors and data subjects alike.

In GDPR lingo, the question is who becomes the “controller” of the data in a centralized system. The controller is the one that could get slapped with huge fines in the event of a privacy breach.

There’s a concept of “successive controllers”, where data is passed through a chain of handlers. ICANN wants clarity on whether, should a registrar send data to an ICANN central gateway, its liability ends there, before the final disclosure decision is made.

It’s asking the European Commission to exercise its authority under the GDPR to force the European Data Protection Board to issue a blanket opinion clarifying these issues, with the expectation that SSAD as currently envisaged could evolve over time to be something more like what the IP folk want.

For ICANN, such a ruling could help quell criticism from its influential advisory bodies, notably the Governmental Advisory Committee, which have come out strongly against the SSAD proposals.

If ICANN chooses to wait for the European Commission and EDPB responses to its new request, it’s highly unlikely we’re going to see the ICANN board fully approve SSAD at its annual general meeting later this month.

US and EU call for Whois to stay alive

Government officials from both sides of the Atlantic have this week called on ICANN to preserve Whois as it currently is, in the face of incoming EU privacy law, at least for a select few users.
The European Commission wrote to ICANN to ask for a “pragmatic and workable solution” to the apparent conflict between the General Data Protection Regulation and the desire of some folks to continue to access Whois as usual.
Three commissioners said in a letter (pdf) that special consideration should be given to “public interests” including “ensuring cybersecurity and the stability of the internet, preventing and fighting crime, protecting intellectual property and copyright, or enforcing consumer protection measures”.
David Redl, the new head of the US National Telecommunications and Information Administration, echoed these concerns in a speech at the State of the Net conference in Washington DC on Monday.
Redl said that the “preservation of the Whois service” is one of NTIA’s top two priorities at the moment. The other priority is pressing for US interests in the International Telecommunications Union, he said.
Calling Whois “a cornerstone of trust and accountability for the Internet”, Redl said the service “can, and should, retain its essential character while complying with national privacy laws, including the GDPR.”
“It is in the interests of all Internet stakeholders that it does,” he said. “And for anyone here in the US who may be persuaded by arguments calling for drastic change, please know that the US government expects this information to continue to be made easily available through the Whois service.”
He directly referred to the ability of regular internet users to access Whois for consumer protection purposes in his speech.
The European Commission appears to be looking at a more restrictive approach, but it did offer some concrete suggestions as to how GDPR compliance might be achieved.
For example, the commissioners’ letter appears to give tacit approval to the idea of “gated” access to Whois, but called for access by law enforcement to be streamlined and centralized.
It also suggests throttling as a mechanism to reduce abuse of Whois data, and makes it clear that registrants should always be clearly informed how their personal data will be used.
The deadline for GDPR compliance is May this year. That’s when the ability of EU countries to start to levy fines against non-compliant companies, which could run into millions of euros, kicks in.
While ICANN has been criticized by registries and registrars for moving too slowly to give them clarity on how to be GDPR-compliant while also sticking to the Whois provisions of their contracts, its pace has been picking up recently.
Two weeks ago it called for comments on three possible Whois models that could be used from May.
That comment period ended on Monday, and ICANN is expected to publish the model upon which further discussions will be based today.

EU guns for ICANN’s relationship with US

The European Union has made ICANN’s close relationship with the US one of the targets of a new platform on internet governance.
In a new communication on internet governance (pdf), the European Commission said it will “work with all stakeholders” to:

– identify how to globalise the IANA functions, whilst safeguarding the continued stability and security of the domain-name system;
– establish a clear timeline for the globalisation of ICANN, including its Affirmation of Commitments.

The policy is being characterized as being prompted by former NSA contractor Edward Snowden’s revelations about widespread US spying on internet users.
EC vice president Neelie Kroes issued a press release announcing the policy, saying:

Recent revelations of large-scale surveillance have called into question the stewardship of the US when it comes to Internet Governance. So given the US-centric model of Internet Governance currently in place, it is necessary to broker a smooth transition to a more global model while at the same time protecting the underlying values of open multi-stakeholder governance of the Internet.

Despite this, the document does not contain any allegations that link ICANN to spying, or indeed any justification for the logical leap from Snowden to domain names.
The EU position is not dissimilar to ICANN’s own. Last October CEO Fadi Chehade used Snowden as an excuse to talk about putting ICANN’s relationship with the US back in the spotlight.
As I noted at the time, it all looks very opportunistic.
Internationalizing ICANN is of course a noble objective — and one that has been envisaged since ICANN’s very creation 15 years ago — but what would it look like it practice?
I’d be very surprised if what the Commission has in mind isn’t a scenario in which the Commission always gets what it wants, even if other stakeholders disagree with it.
Right now, the Commission is demanding that ICANN rejects applications for .wine and .vin new gTLDs unless applicants agree to new rights protection mechanisms for geographic indicators such as “Champagne”.
That’s something that ICANN’s Governmental Advisory Committee could not reach consensus on, yet the EU wants ICANN to act based on its unilateral (insofar as the EU could be seen as a single entity) advice.
The new EC policy document makes lots of noise about its support for the “multi-stakeholder process”, but with hints that it might not be the “multi-equal-stakeholder process” championed by Chehade.
For example, it states on the one hand:

Those responsible for an inclusive process must make a reasonable effort to reach out to all parties impacted by a given topic, and offer fair and affordable opportunities to participate and contribute to all key stages of decision making, while avoiding capture of the process by any dominant stakeholder or vested interests.

That sounds fair enough, but the document immediately goes on to state:

the fact that a process is claimed to be multistakeholder does not per se guarantee outcomes that are widely seen to be legitimate
…
it should be recognised that different stages of decision making processes each have their own requirements and may involve different sets of stakeholders.
…
Sound multistakeholder processes remain essential for the future governance of the Internet. At the same time, they should not affect the ability of public authorities, deriving their powers and legitimacy from democratic processes, to fulfil their public policy responsibilities where those are compatible with universal human rights. This includes their right to intervene with regulation where required.

With that in mind, what would an “internationalized” IANA look like, if the European Commission gets its way?
Right now, IANA may be contractually tethered to the US Department of Commerce, but in practice Commerce has never refused to delegate a TLD (even when Kroes asked it to delay .xxx).
Compare that to Kroes statement last September that “under no circumstance can we agree having .wine and .vin on the internet, without sufficient safeguards”.
Today’s policy news from the EC looks fine at a high level, but in light of what the EC actually seems to want to achieve in practical terms, it looks more like an attempt at a power grab.

.eu registry contract up for grabs

The European Commission has opened up the .eu registry contract to competitive bidding.
The sort-of ccTLD has been managed by EurID since it launched 2004 but its contract, which has already been extended to its maximum term, is due to expire in October next year.
Would-be usurpers must be not-for-profit organizations based in the European Union, according to a Commission RFP, which should narrow the field quite a lot.
The .eu space has 3.7 million registered domain names, growing at 5.4% a year. Considering that the TLD is open to all in the EU, the numbers fare poorly compared to many European ccTLDs.
The deadline for submissions is June 20.

Massive internet policy database planned in Europe

The European Commission plans to build a massive web site and database of information related to global internet policy-making.
The Global Internet Policy Observatory, which is still in the planning stages, would be a “clearinghouse for monitoring Internet policy, regulatory and technological developments across the world”.
The idea appears to be to make it easier for people interested in this kind of thing to wade through information overload. According to a Commission press release, the site would:

• automatically monitor Internet-related policy developments at the global level, making full use of “big data” technologies;
• identify links between different fora and discussions, with the objective to overcome “policy silos”;
• help contextualise information, for example by collecting existing academic information on a specific topic, highlighting the historical and current position of the main actors on a particular issue, identifying the interests of different actors in various policy fields;
• identify policy trends, via quantitative and qualitative methods such as semantic and sentiment analysis;
• provide easy-to-use briefings and reports by incorporating modern visualisation techniques;

GIPO (I’m choosing to pronounce it with a hard G) could get underway in 2014, pending the results of a feasibility study, the Commission said.
Brazil, the African Union, Switzerland, the Association for Progressive Communication, Diplo Foundation and the Internet Society are also all involved in the project.

Europe rejects ICANN’s authority as it warns of problems with 58 new gTLDs

The European Commission has issued a list of 58 new gTLD applications it considers problematic, thumbing its nose at ICANN’s procedures for handling government objections to new gTLDs.
The list, sent to all applicants this afternoon, draws in several applications that were not already subject to Early Warnings from other GAC nations, including .sex, .sexy and .free.
Remarkably, the cover letter says that the gTLDs are not “Early Warnings” as described by the ICANN Applicant Guidebook and says the Commission may continue to work outside the established process in future:

The position outlined in this letter is without prejudice to any further action that the Commission might decide to undertake in order to safeguard the rights and interests of the European Union and of its citizens.
For the sake of clarity, the Commission does not consider itself legally bound to the processes, including the means of recourse, outlined in the new gTLD Applicant Guidebook and/or adopted by ICANN, unless a legal agreement between the latter and the Commission exists.

While that’s little more than a statement of fact — governments are of course free to do whatever they want in their own jurisdictions — it’s giving applicants much more reason to be nervous.
Even if they don’t receive GAC Advice against their applications, the EC may decide to take other action against them.
The fact that the letter also explicitly states that the warnings are definitely not official Early Warnings — meaning applicants on the list won’t even qualify for the extra refund if they drop out — sends a worrying signal that the EC is not in the mood to play by ICANN’s rules.
As for the list itself, the Commission’s letter states that it’s “non-exhaustive” and that it focuses on bids that “could possibly raise issues of compatibility with the existing legislations (the acquis) and/or with policy positions and objectives of the European Union”.
The fact that the list contains ICM Registry’s .adult and .sex applications, but not its identical .porn bid, seems to confirm that the list does not cover all the gTLDs the Commission has a problem with.
The letter (pdf) states that the Commission will attempt to enter into “further discussions” with the applicants on the list (pdf).

Europe dislikes US-only IANA rule

The European Commission is disappointed that only US-based companies are eligible to apply to take over ICANN’s IANA contract, but has otherwise welcomed the new deal.
As I reported Friday, the US National Telecommunications and Information Administration has put the IANA contract, which gives ICANN its powers to create new top-level domains, up for rebid.
While ICANN is generally expected to be a shoo-in for the contract, the NTIA tilted the odds in its favor by refusing to consider bids from replacement candidates from outside the US.
The EC said in a statement today:

The Commission believes greater respect should be given by the IANA contractor to respecting applicable law (such as EU personal data protection laws)… In that context, it noted with regret that non-US companies are not allowed to compete for the forthcoming IANA contract.

Otherwise, the EC said it was happy with the new provisions in the IANA contract, which promise to enforce mandatory conflict of interests protections on the winning bidder.
Neelie Kroes, European Commission Vice-President for the Digital Agenda said in a press release:

The new IANA tender is a clear step forward for global internet governance. A more transparent, independent and accountable management of the Internet domain names and other resources will reinforce the Internet’s role as a global resource.

The EC is also pleased that ICANN/IANA “will have to provide specific documentation demonstrating how the underlying decision-making process was supportive of the public interest” when new gTLDs are approved.
How this provision will be implemented, and how much power it gives ICANN’s Governmental Advisory Committee to kill new gTLD applications, is perhaps the biggest question hanging over the contract today.
The current IANA contract expires at the end of March next year, shortly before the end of ICANN’s first new gTLDs application window.

What Europe’s demands mean for new gTLDs

The European Commission wants stronger government powers over ICANN’s new top-level domain approval process, according to leaked documents.
Six “informal background papers” obtained and published by .nxt yesterday indicate that the EC, perceiving snubs over the last six months, plans to take a hard line with ICANN.
The documents cover a lot of ground, including a discussion of the various mechanisms by which governments would be able to force ICANN to reject new gTLD applications.
This article covers just the bases related to new gTLDs.
As things currently stand, ICANN’s Applicant Guidebook gives governments three ways to register their objections to any given gTLD application. The EC wants two of them strengthened.
GAC Early Warning
The Governmental Advisory Committee may formally put an applicant on notice that one or more governments have a problem with their bid.
Any government can initiate an Early Warning “for any reason”, at any point during the 60-day public comment period that is currently scheduled to begin April 27.
The mechanism is designed to give applicants a chance to get out with their cash before a more formal objection is filed by the GAC or an individual government.
Applicants in receipt of such a warning can choose to withdraw at that point, receiving a partial refund of their fees, but it’s entirely voluntary.
Under the EC’s new proposals, a GAC Early Warning would trigger an additional requirement by the applicant to show the support of “the relevant internet community”.
Because there’s little chance of getting this provision into the Guidebook now, the EC wants this provision baked into ICANN’s IANA contract with the US Department of Commerce.
The IANA contract is currently the biggest stick governments have to beat ICANN with. It’s up for renewal before March, and it’s the US that decides what goes into the contract.
The European Commission paper on new gTLDs says:

The IANA contract should include a provision requiring applicants to positively demonstrate the support of the relevant Internet community in advance of formal consultation of the GAC (and other supporting organisations and advisory committees), in cases where there are prima facie grounds to believe that the application may raise a public policy concern.

The paper explains: “in other words, if the GAC issues an early warning, the applicant would be automatically required to demonstrate the support of the relevant Internet community”.
In the Guidebook today, only applicants that have self-designated as “community” applications have to show this level of support, using a strict scoring process.
The EC’s proposal could, hypothetically, force non-community applicants to show a similar level of support if a single government initiates an Early Warning in the GAC.
If there was a vanilla, non-community application for .gay, for example, an Early Warning spurred (anonymously) by Saudi Arabia, say, could force the applicant to provide evidence of community support.
How this evidence would be evaluated is unclear. It would depend on what final language the Department of Commerce puts into the IANA contract.
At a guess, it could be a matter for the ICANN board to decide, with the Damoclean sword of IANA non-compliance hanging over its decision.
Formal GAC Advice
The Guidebook today allows for over six months, from April 27 to November 12, for the GAC to formally object to any gTLD application.
The way the GAC will create this formal “GAC Advice on New gTLDs” is a black box. We probably won’t even be told which governments objected, or what level of support they received.
ICANN had tried to enforce certain transparency and procedural requirements on this mechanism, but the GAC told it to take a hike and ICANN bent over in the interests of expediency.
But any such Advice will nevertheless “create a strong presumption for ICANN that the application should not be approved”.
The ICANN board will technically still be able to overrule one of these objections, but it practice it seems unlikely. At the very least it’s not predictable.
Under the European Commission’s new proposals, this fail-safe would be weakened further:

The ICANN by-laws should be amended to ensure that consensus GAC advice is accepted as reflecting the global public interest, and should ICANN wish to reject such advice, it would bear the burden of demonstrating that the GAC advice would conflict with ICANN’s legal obligations or create problems for the stability or security of the Domain name System.

In other words, the bar for an ICANN board decision to overrule the GAC would be raised to only include cases where there was a legal or technical reason not to comply.
The GAC would have an effective veto on every decision ICANN is asked to make. The term “multi-stakeholder” would be subverted in almost textbook Orwellian fashion.
To have this proposal implemented, the EC suggests that ICANN and the GAC enter talks. There’s no talk of running to the US government to have it unilaterally imposed.
Reserved Words
Currently, all new gTLD registries will be forced to reserve strings such as country names from their spaces, and deal with individual governments to open them up.
The EC wants the list expanding to include basically any word that governments ask for, and it wants the US government to make this a condition of IANA contract renewal:

In relation to reserved and blocked names at the second level, the IANA contract should require the contractor to develop appropriate policies to allow governments and public administrations to identify names to be included in a reference list to be respected by all new gTLD operators.

This request appears to have been inspired by ICM Registry’s offer to block “culturally sensitive” strings from .xxx at the request of governments.
Yet again, we find global internet policy being driven by sex. What is it with these politicians?
Domain Name Takedown
Incredibly, the EC also wants the IANA contract to include a provision that would allow any government to ask any gTLD registry to turn off any domain:

The contractor [ICANN] should also be required to ensure that governments and public administrations can raise concerns about particular names after their registration if a serious public order concern is involved, and with a view to the registry “taking down” the name concerned.

This clearly hasn’t been thought through.
Facebook.com and Twitter.com have both been blamed recently for raising “serious public order concerns” in everything from the Egyptian revolution to the London riots.
The new powers the EC is discussing would have given the despotic former government of Egypt a legal basis for having Twitter shut down, in other words.
Cross-Ownership
Finally, the EC is still concerned, on competition grounds, about ICANN’s decision to drop the vertical separation rules that apply to registries and registrars.
It suggests that the IANA contract should create a new oversight body with an “extra-judicial review” function over ICANN, enabling its decisions to be challenged.
This would enable antitrust authorities in Europe or elsewhere to challenge the vertical integration decision without having to resort to the US courts.
Anyway
Overall, the proposals seem to represent a depressingly authoritarian ambition by the European Commission, as well as a disdain for the idea of the ICANN multi-stakeholder model and a shocking lack of respect for the rights of internet users.
While the documents are “informal background papers”, they do seem to give an indication of what certain elements within the EC think would make reasonable policy.
Whether the positions outlined in the papers became a reality would largely depend on whether the EC’s requests, if they were made, were compatible with US public policy.
As usual, the Department of Commerce still holds all the cards.

Kroes slams ICANN new gTLD approval

Neelie Kroes, vice-president of the European Commission, has repeated her call for ICANN reform after it rejected governmental advice in its newly approved top-level domains program.
According to a statement from her official spokesperson sent to Intellectual Property Watch, Kroes said the approval of the program “disregard[ed] governmental advice on public policy issues” and “underscores the need for the model to be reformed to remain sustainable”.

The lack of an adequate response on the part of ICANN Board clearly points to some deficiencies in the current functioning of the model. This calls for specific actions in order to remedy the situation.

Kroes seems to believe that governments are entitled to every concession they demand from “multistakeholder” policy-making processes.
According to IP-Watch, she promised to coordinate a response with EU member states and the US.
While the Governmental Advisory Committee had filed about 80 objections to aspects of the Applicant Guidebook earlier this year, ICANN managed to whittle the list down to a small handful.
It refused to remove the requirement for trademark owners to provide proof of use before participating in sunrise periods, and to lower the burden of proof in certain anti-cybersquatting mechanisms.
Governments also don’t seem particularly convinced by ICANN’s decision to approve the program before consulting more deeply with competition authorities over the vertical integration issue.
GAC chair Heather Dryden delivered a more measured statement expressing “disappointment” with the decision yesterday.
EC GAC representative Gerard de Graaf, who’s earning himself a reputation in ICANN as a bit of a firebrand, was less measured in his response, accusing ICANN of potentially putting new gTLD applicants at risk of violating European competition laws.
More at Intellectual Property Watch.

Hot topics for ICANN Singapore

ICANN’s 41st public meeting kicks off in Singapore on Monday, and as usual there are a whole array of controversial topics set to be debated.
As is becoming customary, the US government has filed its eleventh-hour saber-rattling surprises, undermining ICANN’s authority before its delegates’ feet have even touched the tarmac.
Here’s a high-level overview of what’s going down.
The new gTLD program
ICANN and the Governmental Advisory Committee are meeting on Sunday to see if they can reach some kind of agreement on the stickiest parts of the Applicant Guidebook.
They will fail to do so, and ICANN’s board will be forced into discussing an unfinished Guidebook, which does not have full GAC backing, during its Monday-morning special meeting.
It’s Peter Dengate Thrush’s final meeting as chairman, and many observers believe he will push through some kind of new gTLDs resolution to act as his “legacy”, as well as to fulfill the promise he made in San Francisco of a big party in Singapore.
My guess is that the resolution will approve the program in general, lay down some kind of timetable for its launch, and acknowledge that the Guidebook needs more work before it is rubber-stamped.
I think it’s likely that the days of seemingly endless cycles of redrafting and comment are over for good, however, which will come as a relief to many.
Developing nations
A big sticking point for the GAC is the price that new gTLD applicants from developing nations will have to pay – it wants eligible, needy applicants to get a 76% discount, from $185,000 to $44,000.
The GAC has called this issue something that needs sorting out “as a matter of urgency”, but ICANN’s policy is currently a flimsy draft in desperate need of work.
The so-called JAS working group, tasked with creating the policy, currently wants governmental entities excluded from the support program, which has made the GAC, predictably, unhappy.
The JAS has proven controversial in other quarters too, particularly the GNSO Council.
Most recently, ICANN director Katim Touray, who’s from Gambia, said the Council had been “rather slow” to approve the JAS’s latest milestone report, which, he said:

might well be construed by many as an effort by the GNSO to scuttle the entire process of seeking ways and means to provide support to needy new gTLD applicants

This irked Council chair Stephane Van Gelder, who rattled off a response pointing out that the GNSO had painstakingly followed its procedures as required under the ICANN bylaws.
Watch out for friction there.
Simply, there’s no way this matter can be put to bed in Singapore, but it will be the topic of intense discussions because the new gTLD program cannot sensibly launch without it.
The IANA contract
The US National Telecommunications and Information Administration wants to beef up the IANA contract to make ICANN more accountable to the NTIA and, implicitly, the GAC.
Basically, IANA is being leveraged as a way to make sure that .porn and .gay (and any other TLD not acceptable to the world’s most miserable regimes) never make it onto the internet.
If at least one person does not stand up during the public forum on Thursday to complain that ICANN is nothing more than a lackey of the United States, I’d be surprised. My money’s on Khaled Fattal.
Vertical integration
The eleventh hour surprise I referred to earlier.
The US Department of Justice, Antitrust Division, informed ICANN this week that its plan to allow gTLD registries such as VeriSign, Neustar and Afilias to own affiliated registrars was “misguided”.
I found the letter (pdf) utterly baffling. It seems to say that the DoJ would not be able to advise ICANN on competition matters, despite the fact that the letter itself contains a whole bunch of such advice.
The letter has basically scuppered VeriSign’s chances of ever buying a registrar, but I don’t think anybody thought that would happen anyway.
Neustar is likely to be the most publicly annoyed by this, given how vocally it has pursued its vertical integration plans, but I expect Afilias and others will be bugged by this development too.
The DoJ’s position is likely to be backed up by Europe, now that the NTIA’s Larry Strickling and European Commissioner Neelie Kroes are BFFs.
Cybercrime
Cybercrime is huge at the moment, what with governments arming themselves with legions of hackers and groups such as LulzSec and Anonymous knocking down sites like dominoes.
The DNS abuse forum during ICANN meetings, slated for Monday, is usually populated by pissed-off cops demanding stricter enforcement of Whois accuracy.
They’ve been getting louder during recent meetings, a trend I expect to continue until somebody listens.
This is known as “engaging”.
Geek stuff
IPv6, DNSSEC and Internationalized Domain Names, in other words. There are sessions on all three of these important topics, but they rarely gather much attention from the policy wonks.
With IPv6 and DNSSEC, we’re basically looking at problems of adoption. With IDNs, there’s impenetrably technical stuff to discuss relating to code tables and variant strings.
The DNSSEC session is usually worth a listen if you’re into that kind of thing.
The board meeting
Unusually, the board’s discussion of the Guidebook has been bounced to Monday, leading to a Friday board meeting with not very much to excite.
VeriSign will get its .net contract renewed, no doubt.
The report from the GAC-board joint working group, which may reveal how the two can work together less painfully in future, also could be interesting.
Anyway…
Enough of this blather, I’ve got a plane to catch.