Latest news of the domain name industry

Recent Posts

Governments demand Whois reopened within a year

Kevin Murphy, April 29, 2019, Domain Policy

ICANN’s government advisers wants cops, trademark owners and others to get access to private Whois data in under a year from now.

The Governmental Advisory Committee wants to see “considerable and demonstrable progress, if not completion” of the so-called “unified access model” for Whois by ICANN66 in Montreal, a meeting due to kick off November 4 this year.

The demand came in a letter (pdf) last week from GAC chair Manal Ismail to her ICANN board counterpart Cherine Chalaby.

She wrote that the GAC wants “phase 2” of the ongoing Expedited Policy Development Process on Whois not only concluded but also implemented “within 12 months or less” of now.

It’s a more specific version of the generic “hurry up” advice delivered formally in last month’s Kobe GAC communique.

It strikes me as a ludicrously ambitious deadline.

Phase 2 of the EPDP’s work involves deciding what “legitimate interests” should be able to request access to unredacted private Whois data, and how such requests should be handled.

The GAC believes “legitimate interests include civil, administrative and criminal law enforcement, cybersecurity, consumer protection and IP rights protection”.

IP interests including Facebook want to be able to vacuum up as much data as they want more or less on demand, but they face resistance from privacy advocates in the non-commercial sector (which want to make access as restrictive as possible) and to a lesser extent registries and registrars (which want something as cheap and easy as possible to implement and operate that does not open them up to legal liability).

Ismail’s letter suggests that work could be sped up by starting the implementation of stuff the EPDP group agrees to as it agrees to it, rather than waiting for its full workload to be complete.

Given the likelihood that there will be a great many dependencies between the various recommendations the group will come up with, this suggestion also comes across as ambitious.

The EPDP group is currently in a bit of a lull, following the delivery of its phase 1 report to ICANN, which is expected to approve its recommendations next month.

Since the phase 1 work finished in late February, there’s been a change of leadership of the group, and bunch of its volunteer members have been swapped out.

Volunteers have also complained about burnout, and there’s been some pressure for the pace of work — which included four to five hours of teleconferences per week for six months — to be scaled back for the second phase.

The group’s leadership has discussed 12 to 18 months as a “realistic and desirable” timeframe for it to reach its Initial Report stage on the phase 2 work.

For comparison, it published its Initial Report for phase 1 after only six stressful months on the job, and not only have its recommendations not been implemented, they’ve not even been approved by ICANN’s board of directors yet. That’s expected to happen this Friday, at the board’s retreat in Istanbul.

With this previous experience in mind, the chances of the GAC getting a unified Whois access service implemented within a year seem very remote.

Amazon tells power-hungry governments to get stuffed

Kevin Murphy, April 23, 2019, Domain Policy

Amazon has rejected attempts by South American governments to make the would-be gTLD .amazon “jointly owned”.

In a letter to ICANN last week, Amazon VP of public policy Brian Huseman finally publicly revealed the price Amazon is willing to pay for its dot-brand, but said members of the Amazon Cooperation Treaty Organization are asking for way too much power.

It turns out three of ACTO’s eight national government members have proposed solutions to the current impasse, but Amazon has had to reject them all for commercial and security reasons. Huseman wrote (pdf):

Some member states require that we jointly own and manage the .AMAZON TLDs. Some require that we give the member states advance notice and veto authority over all domain names that we want to register and use—for both trademarked terms as well as generic words. Some suggest a Governance Committee can work only if it has governance that outweighs Amazon’s voice (i.e. the Governance Committee has a representative from one of each of the eight member states, while Amazon has one); and some want to use .AMAZON for their own commercial purposes.

From Huseman’s description, it sounds like the ACTO nations basically want majority control (at least in terms of policy) of .amazon and the Chinese and Japanese translations, applications for which have been essentially frozen by ICANN for years.

Huseman told ICANN that Amazon cannot comply.

If the company were to give eight South American governments advanced notice and veto power over .amazon domains it planned to register, it would make it virtually impossible to contain its business secrets prior to the launch of new services, he said.

The governments also want the right to block certain unspecified generic strings, unrelated to the Amazon region, he wrote. Amazon can’t allow that, because its range of businesses is broad and it may want to use those domains for its own commercial purposes.

Amazon has offered to block up to 1,500 strings per TLD that “represent the culture and heritage of the Amazonia region”.

Nine .amazon domains would be set aside for actual usage, one for ACTO and one each for its members, “that have primary and well-recognized significance to the culture and heritage of the region”, but they’d have to use those domains non-commercially.

The proposal seems to envisage that the countries would select their two-letter country code as their freebie domain. Brazil could get br.amazon, for example.

They could also select the names of Amazonian indigenous peoples’ groups or “the specific terms OTCA, culture, heritage, forest, river, and rainforest, in English, Dutch, Portuguese, and Spanish.”

They would not to be allowed to use third-level domains, other than “www”.

The governments would have up to two years to populate the list of 1,500 banned terms. The strings would have to have the same “culture and heritage” nexus, and Amazon would get veto power over whether the proposed strings actually meet that test.

As the whole policy would be enshrined as a Public Interest Commitment in the .amazon registry contract with ICANN, ACTO members would be able to protest such rejections using the PIC Dispute Resolution Policy.

Amazon would also get veto power over the content of the web sites at the domains used by the governments. They’d have to be basically static sites, and all user-generated content would be strictly verboten.

It’s a power struggle, with little evident common ground once you get down into the details, and it’s likely going to be up to ICANN to decide whether Amazon’s proposal is sufficient to overrule the ACTO and Governmental Advisory Committee concerns.

ICANN had set a deadline of April 21 to receive the proposal. The timetable it has previously set out would see its board of directors make a decision (or punt it back to Amazon) at the Marrakech public meeting in late June.

However, board chair Cherine Chalaby has told ACTO that if it wants to negotiate a joint proposal with Amazon, it can still do so. ICANN would need to receive this revised proposal by June 7, he said.

ICANN takes the reins again as .amazon talks fail

Kevin Murphy, April 10, 2019, Domain Policy

ICANN has re-involved itself in the fight over the .amazon gTLD, after Amazon and eight South American governments failed to reach agreement over the name.

ICANN chair Cherine Chalaby wrote this week to the Amazon Cooperation Treaty Organization to inform the group that it is now ICANN that will decide whether the proposed dot-brand domain is approved or not.

ICANN’s board had given Amazon and ACTO until April 7 to come to a mutual agreement that addressed ACTO’s sovereignty concerns, but they missed that deadline.

According to the BBC World Service, citing unnamed diplomats, ACTO wanted Amazon to create a kind of policy committee, with seats at the table for governments to veto second-level domains Amazon decides it wants to register in .amazon in future.

Amazon declined this demand, instead offering each of the eight ACTO countries its two-letter country-code under .amazon — br.amazon for Brazil, for example — the Beeb reported at the weekend.

Now that ICANN’s deadline has passed, ACTO appears to have lost its chance to negotiate with Amazon.

ICANN has now asked the company to submit a plan to address ACTO’s concerns directly to ICANN by April 21.

From that point, it could go either way. ICANN might approve the .amazon application, reject it, or push it back to Amazon for further work.

But .amazon may not necessarily be on the home straight yet. A straightforward approval or rejection will very likely provoke howls of anguish, and further appeals action, from the losing side.

Amazon countries fighting back against .amazon gTLD

Kevin Murphy, December 4, 2018, Domain Policy

When ICANN’s board of directors voted in late October to let Amazon have its controversial .amazon gTLD, it was not entirely clear what governments in the Amazon region of South America thought about it.

Now, it is: they’re pissed.

The governments of the Amazon Cooperation Treaty Organization have cancelled planned peace talks with the retailer and ICANN boss Goran Marby and have filed an appeal against the board’s decision.

It even seems that the negotiations — aimed at obtaining ACTO’s blessing by stuffing the .amazon registry agreement with cultural safeguards and augmenting it with financial sweeteners — may be dead before they even started.

The rapid deterioration of the relationship between ACTO and ICANN plays out in a series of letters between Marby and ACTO secretary general Jacqueline Mendoza, published last week by ICANN.

After the board’s October 25 resolution, which gave .amazon a pardon from its longstanding “Will Not Proceed” death sentence, it took just 10 days for ACTO to file a Request for Reconsideration with ICANN, asking the board to rethink its resolution.

In a cover letter to the November 5 request, Mendoza said that ACTO was still happy to have Marby facilitate talks between the governments and Amazon, “to develop a mutually acceptable solution for the delegation” of .amazon.

Amazon is said to have offered concessions such as the protection of culturally sensitive names, along with $5 million worth of free Kindles, in order to get ACTO to back down.

But the governments had yet to see any proposal from Amazon for them to consider, Mendoza wrote a month ago.

At some point Marby then agreed to meet with the ACTO governments — Bolivia, Brazil, Colombia, Ecuador, Guyana, Peru, Suriname and Venezuela — in Bolivia on November 29.

He froze their reconsideration request pending this meeting, according to his November 20 letter (pdf), which also bulletted out the sequence of events that led to the ICANN resolution.

It seems ICANN has been working rather closely with, and had been hearing encouraging noises from, Brazil’s Governmental Advisory Committee representative, over the last 12 months. Indeed, it seems it was Brazil that said the reconsideration should be put on hold, pending the November 29 meeting.

But on November 22, Mendoza cancelled the summit (pdf), taking a hard line against the unfreezing of the applications.

Four days later, she told Marby and ICANN chair Cherine Chalaby that ICANN should be dealing with ACTO, not its individual members.

She said that a “positive reaction” to the reconsideration request and the request for the board resolution to be “cancelled” are “indispensable pre-requisites for such a meeting to take place”.

The short version: ICANN jumped the gun when it unfroze the .amazon gTLD applications, at least in ACTO’s view.

ACTO didn’t even receive Amazon’s latest proposal until November 23, the day after the talks were cancelled, according to ICANN.

And, judging by the latest missive in this infuriating thread, ICANN may have thrown in the towel already.

Marby informed GAC chair Manal Ismail (pdf) last Wednesday that the “facilitation process” ICANN had resolved to lead “has been unsuccessful” and “has not been able to reach its desired conclusion.”

While he added ICANN remains “open to assist and facilitate this matter, should it be considered useful”, there’s otherwise an air of finality about the choice of language in his letter.

As for the reconsideration request (pdf), it seems to be still active, so there’s a chance for the board to change its mind about .amazon’s status.

It will be interesting to see whether the request will be approved by the board for the sake of political expediency.

Reconsideration requests are almost unfailingly tossed out for failing to reach the threshold of providing the board with information it was not aware of at the time of its contested resolution.

In this case, ACTO claims that the board was wrongly informed that the ACTO members had seen and liked Amazon’s latest proposal, presumably because ICANN had been feeling positive vibes from Brazil.

It’s not impossible that the board might agree this is true, put .amazon back on ice, and try again at the “facilitation” route.

But should it? Part of me wonders why the hell ICANN resources — that is, registrants’ money — should be diverted to pay for ICANN to act as an unpaid lobbyist for one of the world’s wealthiest companies, which can’t seem to actually put a proposal on the table in a timely fashion, or for eight national governments who don’t seem to be even talking to each other on an issue they claim is of the utmost importance.

Amazon offered $5 million of free Kindles for .amazon gTLD

Kevin Murphy, October 23, 2018, Domain Policy

Amazon offered South American governments $5 million worth of free Kindles, content and cloud services in exchange for their endorsement of its .amazon gTLD application, it has emerged.

The proposal, made in February, also included an offer of four years of free hosting up to a value of $1 million.

The sweeteners came during negotiations with the eight governments of the Amazon Cooperation Treaty Organization, which object to .amazon because they think it would infringe on their geographical and cultural rights.

Amazon has sought to reassure these governments that it will reserve culturally sensitive strings of their choice in .amazon, and that it will actively support any future applications for gTLDs such as .amazonas, which is the more meaningful geographic string in local languages.

I’ve reported on these offers before, but to my knowledge the offer of free Kindles and AWS credits has not been made public before. (UPDATE: Nope.)

According to a September letter from ACTO, published (pdf) this week, Amazon told it:

as an indication of goodwill and support for the people and governments of the Amazonian Region… [Amazon will] make available to the OTCA governments credits for the use of AWS services, Kindles preloaded with mutually agreed upon content, and similar Amazon.com services and products in an amount not to exceed $5,000,000.

Amazon also offered to set up a .amazon web site “to support the Amazonian people’s cultural heritage” and pay up to $1 million to host it for four years.

These kinds of financial sweeteners would not be without precedent.

The applicant for .bar wound up offering to donate $100,000 to fund a school in Montenegro, after the government noted the string match with the Bar region of the country.

The ACTO countries met in August to consider Amazon’s offer, but chose not to accept it.

However, they’re not closing off talks altogether. Instead, they’ve taken up ICANN on its offer to act as a facilitator of talks between Amazon and ACTO members.

The ICANN board of directors passed a resolution last month instructing CEO Goran Marby to “support the development of a solution” that would involve “sharing the use of those top-level domains with the ACTO member states”.

ACTO secretary general Jacqueline Mendoza has responded positively to this resolution (pdf) and invited Marby to ACTO headquarters in Brasilia to carry on these talks.

ICANN blocks .islam after government veto

Kevin Murphy, October 8, 2018, Domain Policy

After six years, ICANN has finally killed off the applications for the new gTLDs .islam and .halal, due to objections from several governments.

It has also rejected the application for .persiangulf from the same applicant.

The decisions were made by the ICANN board of directors last Wednesday. The resolutions were published Friday night.

The board said: “it is apparent that the vast majority of the Muslim community (more than 1.6 billion members) object to the applications for .HALAL and .ISLAM.”

This actually means that the Organization of Islamic Cooperation, the 57-nation treaty group with a combined 1.6 billion nominal Muslim citizens, objected to the applications.

Several governments with large Muslim populations — including the UAE, Malaysia, Turkey, India and Iran — had also individually told ICANN on the record that they were not happy.

The view from these governments seemed to be that if there’s going to be a .islam, it should be run under the umbrella of a group such as the OIC, rather than some random tuppenny ha’penny gTLD registry.

In Christianity, the comparable gTLD .catholic is run by an affiliate of the world’s oldest pedophile ring, while .bible is being run as a propaganda tool by a group of sexually repressed, homophobic American evangelicals.

The ICANN board said its decision to reject .islam and .halal was in tune with its “core values” to protect the “public interest”.

The decision was based “on its consideration of and commitment to ICANN’s Mission and core values set forth in the Bylaws, including ensuring that this decision is in the best interest of the Internet community and that it respects the concerns raised by the majority of the community most impacted by the proposed .HALAL and .ISLAM gTLDs”.

It’s been avoiding making this decision since at least December 2013.

But it has now voted that the two applications “should not proceed”. It does not appear to have banned organizations from applying for the strings in subsequent application rounds.

The applicant for .islam and .halal was Turkey-based Asia Green IT System. It applications have been “on-hold” since the GAC issued non-consensus advice against them back in April 2013.

The OIC filed Community Objections against both gTLDs with the International Chamber of Commerce, but failed on both counts.

Having failed to see any progress, in December 2015, AGIT filed an Independent Review Process appeal against its treatment by ICANN, and won.

The November 2017 IRP decision held that the “on-hold” status was a “new policy”, unilaterally put in place by ICANN Org, that unfairly condemned AGIT’s applications to indefinite limbo.

The panel ordered ICANN to make its damn mind up one way or the other and pay about $270,000 in costs.

While rejecting the applications may not seem unreasonable, it’s an important example of a minority group of governments getting an essential veto over a gTLD.

Under the rules of the 2012 application round, consensus GAC advice against an application is enough to kill it stone dead.

But the GAC had merely said (pdf):

The GAC recognizes that Religious terms are sensitive issues. Some GAC members have raised sensitivities on the applications that relate to Islamic terms, specifically .islam and .halal. The GAC members concerned have noted that the applications for .islam and .halal lack community involvement and support. It is the view of these GAC members that these applications should not proceed.

That’s non-consensus advice, which is expected to initiate bilateral engagement with ICANN’s board before a decision is made.

In the case of .persiangulf, also applied for by AGIT and also now rejected, the GAC didn’t even give non-consensus advice.

In fact, in its July 2013 Durban communique (pdf) is explicitly stated it “does not object to them proceeding”.

This appears to have been a not atypical GAC screw-up. The minutes of the Durban meeting, published months later, showed that the Gulf Cooperation Council states had in fact objected — there’s a bit of a dispute in that part of the world about whether it’s the “Persian Gulf” or “Arabian Gulf” — so the GAC would have been within its rights to publish non-consensus advice.

This all came out when the GCC filed its own IRP against ICANN, which it won.

The IRP panel in that case ordered ICANN to outright reject .persiangulf. Two years later, it now has.

While the three gTLDs in question are now going into “Will Not Proceed” status, that may not be the end of the story. One “Will Not Proceed” applicant, DotConnectAfrica, has taken ICANN to court in the US over its .africa application.

No, I don’t get what’s going on with GDPR either

Kevin Murphy, May 16, 2018, Domain Policy

GDPR comes into effect next week, changing the Whois privacy landscape forever, and like many others I still haven’t got a clue what’s going on.

ICANN’s still muddling through a temporary Whois spec that it hopes will shield itself and the industry from fines, special interests are still lobbying for special privileges after May 25, EU privacy regulators are still resisting ICANN’s begging expeditions, and registries and registrars are implementing their own independent solutions.

So what will Whois look like from next Friday? It’s all very confusing.

But here’s what my rotting, misfiring, middle-aged brain has managed to process over the last several days.

1. Not even the ICANN board agrees on the best way forward

For the best part of 2018, ICANN has been working on a temporary replacement Whois specification that it could crowbar into its contracts in order to enforce uniformity across the gTLD space and avoid “fragmentation”, which is seen as a horrific prospect for reasons I’ve never fully understood (Whois has always been fragmented).

The spec has been based on legal advice, community and industry input, and slim guidance from the Article 29 Working Party (the group comprising all EU data protection authorities or DPAs).

ICANN finally published a draft (pdf) of the spec late last Friday, May 11.

That document states… actually, forget it. By the time the weekend was over it and I had gotten my head around it, it had already been replaced by another one.

Suffice it to say that it was fairly vague on certain counts — crucially, what “legitimate purposes” for accessing Whois records might be.

The May 14 version came after the ICANN board of directors spent 16 hours or so during its Vancouver retreat apparently arguing quite vigorously about what the spec should contain.

The result is a document that provides a bit more clarity about that it hopes to achieve, and gets a bit more granular on who should be allowed access to private data.

Importantly, between May 11 and May 14, the document started to tile the scales a little away from the privacy rights of registrants and towards towards the data access rights of those with the aforementioned legitimate purposes for accessing it.

One thing the board could agree on was that even after working all weekend on the spec, it was still not ready to vote to formally adopt it as a Temporary Policy, which would become binding on all registries and registrars.

It now plans to vote on the Temporary Policy tomorrow, May 17, after basically sleeping on it and considering the last-minute yowls and cries for help from the variously impacted parts of the community.

I’ll report on the details of the policy after it gets the nod.

2. ICANN seems to have grown a pair

Tonally, ICANN’s position seems to have shifted over the weekend, perhaps reflecting an increasingly defiant, confident ICANN.

Its weekend resolution asserts:

the global public interest is served by the implementation of a unified policy governing aspects of the gTLD Registration Data when the GDPR goes into full effect.

For ICANN to state baldly, in a Resolved clause, that something is in the “global public interest” is notable, given what a slippery topic that has been in the past.

New language in the May 14 spec (pdf) also states, as part of its justification for continuing to mandate Whois as a tool for non-technical purposes: “While ICANN’s role is narrow, it is not limited to technical stability.”

The board also reaffirmed that it’s going to reject Governmental Advisory Committee advice, which pressured ICANN to keep Whois as close to its current state as possible, and kick off a so-called “Bylaws consultation” to see if there’s any way to compromise.

I may be reading too much into all this, but it seems to me that having spent the last year coming across as a borderline incompetent johnny-come-lately to the GDPR conversation, ICANN’s becoming more confident about its role.

3. But it’s still asking DPAs for a moratorium, kinda

When ICANN asked the Article 29 Working Party for a “moratorium” on GDPR enforcement, to give itself and the industry some breathing space to catch up on its compliance initiatives, it was told no such thing was legally possible.

Not to be deterred, ICANN has fired back with a long list of questions (pdf) asking for assurances that DPAs will not start fining registrars willy-nilly after the May 25 deadline.

Sure, there may be no such thing as a moratorium, ICANN acknowledges, but can the DPAs at least say that they will take into account the progress ICANN and the industry is making towards compliance when they consider their responses to any regulatory complaints they might receive?

The French DPA, the Commission Nationale de L’informatique & Libertés, has already said it does not plan to fine companies immediately after May 25, so does that go for the other DPAs too? ICANN wants to know!

It’s basically another way of asking for a moratorium, but one based on aw-shucks reasonableness and an acknowledgement that Whois is a tricky edge case that probably wasn’t even considered when GDPR was being developed.

4. No accreditation model, yet

There’s no reference in the new spec to an accreditation model that would give restricted, tiered access to private Whois data to the likes of security researchers and IP lawyers.

The board’s weekend resolution gives a nod to ongoing discussions, led by the Intellectual Property Constituency and Business Constituency (and reluctantly lurked on by other community members), about creating such a model:

The Board is aware that some parts of the ICANN community has begun work to define an Accreditation Model for access to personal data in Registration Data. The Board encourages the community to continue this work, taking into account any advice and guidance that Article 29 Working Party or European Data Protection Board might provide on the topic.

But there doesn’t appear to be any danger of this model making it into the Temporary Policy tomorrow, something that would have been roundly rejected by contracted parties.

While these talks are being given resource support by ICANN (in terms of mailing lists and teleconferencing), they’re not part of any formal policy development process and nobody’s under any obligation to stick to whatever model gets produced.

The latest update to the accreditation model spec, version 1.5, was released last Thursday.

It’s becoming a bit of a monster of a document — at 46 pages it’s 10 pages longer than the ICANN temporary spec — and would create a hugely convoluted system in which people wanting Whois access would have to provide photo ID and other credentials then pay an annual fee to a new agency set up to police access rights.

More on that in a later piece.

5. Whois is literally dead

The key technical change in the temporary Whois spec is that it’s not actually Whois at all.

Whois is not just the name given to the databases, remember, it’s also an aging technical standard for how queries and responses are passed over the internet.

Instead, ICANN is going to mandate a switch to RDAP, the much newer Registration Data Access Protocol.

RDAP makes Whois output more machine-readable and, crucially, it has access control baked in, enabling the kind of tiered access system that now seems inevitable.

ICANN’s new temporary spec would see an RDAP profile created by ICANN and the community by the end of July. The industry would then have 135 days — likely a late December deadline — to implement it.

Problem is, with a few exceptions, RDAP is brand-new tech to most registries and registrars.

We’re looking at a steep learning curve for many, no doubt.

6. It’s all a bit of a clusterfuck

The situation as it stands appears to be this:

ICANN is going to approve a new Whois policy tomorrow that will become binding upon a few thousand contracted parties just one week later.

While registries and registrars have of course had a year or so’s notice that GDPR is coming and will affect them, and I doubt ICANN Compliance will be complete assholes about enforcement in the near term, a week’s implementation time on a new policy is laughably, impossibly short.

For non-contracted parties, a fragmented Whois seems almost inevitable in the short term after May 25. Those of us who use Whois records will have to wait quite a bit longer before anything close to the current system becomes available.

ICANN flips off governments over Whois privacy

Kevin Murphy, May 8, 2018, Domain Policy

ICANN has formally extended its middle finger to its Governmental Advisory Committee for only the third time, telling the GAC that it cannot comply with its advice on Whois privacy.

It’s triggered a clause in its bylaws used to force both parties to the table for urgent talks, first used when ICANN clashed with the GAC on approving .xxx back in 2010.

The ICANN board of directors has decided that it cannot accept nine of the 10 bulleted items of formal advice on compliance with the General Data Protection Regulation that the GAC provided after its meetings in Puerto Rico in March.

Among that advice is a direction that public Whois records should continue to contain the email address of the registrant after GDPR goes into effect May 25, and that parties with a “legitimate purpose” in Whois data should continue to get access.

Of the 10 pieces of advice, ICANN proposes kicking eight of them down the road to be dealt with at a later date.

It’s given the GAC a face-saving way to back away from these items by clarifying that they refer not to the “interim” Whois model likely to come into effect at the GDPR deadline, but to the “ultimate” model that could come into effect a year later after the ICANN community’s got its shit together.

Attempting to retcon GAC advice is not unusual when ICANN disagrees with its governments, but this time at least it’s being up-front about it.

ICANN chair Cherine Chalaby told GAC chair Manal Ismail:

Reaching a common understanding of the GAC’s advice in relation to the Interim Model (May 25) versus the Ultimate Model would greatly assist the Board’s deliberations on the GAC’s advice.

Of the remaining two items of advice, ICANN agrees with one and proposes immediate talks on the other.

One item, concerning the deployment of a Temporary Policy to enforce a uniform Whois on an emergency basis, ICANN says it can accept immediately. Indeed, the Temporary Policy route we first reported on a month ago now appears to be a done deal.

ICANN has asked the GAC for a teleconference this week to discuss the remaining item, which is:

Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;

Basically, the GAC is trying to prevent the juicier bits of Whois from going dark for everyone, including the likes of law enforcement and trademark lawyers, two weeks from now.

The problem here is that while ICANN has tacit agreement from European data protection authorities that a tiered-access, accreditation-based model is probably a good idea, no such system currently exists and until very recently it’s not been something in which ICANN has invested a lot of focus.

A hundred or so members of the ICANN community, led by IP lawyers who won’t take no for an answer, are currently working off-the-books on an interim accreditation model that could feasibly be used, but it is still subject to substantial debate.

In any event, it would be basically impossible for any agreed-upon accreditation solution to be implemented across the industry before May 25.

So ICANN has invoked its bylaws fuck-you powers for only the third time in its history.

The first time was when the GAC opposed .xxx for reasons lost in the mists of time back in 2010. The second was in 2014 when the GAC overstepped its powers and told ICANN to ignore the rest of the community on the issue of Red Cross related domains.

The board resolved at a meeting last Thursday:

the Board has determined that it may take an action that is not consistent or may not be consistent with the GAC’s advice in the San Juan Communiqué concerning the GDPR and ICANN’s proposed Interim GDPR Compliance Model, and hereby initiates the required Board-GAC Bylaws Consultation Process required in such an event. The Board will provide written notice to the GAC to initiate the process as required by the Bylaws Consultation Process.

Chalaby asked Ismail (pdf) for a call this week. I don’t know if that call has yet taken place, but given the short notice I expect it has not.

For the record, here’s the GAC’s GDPR advice from its Puerto Rico communique (pdf).

the GAC advises the ICANN Board to instruct the ICANN Organization to:

i. Ensure that the proposed interim model maintains current WHOIS requirements to the fullest extent possible;

ii. Provide a detailed rationale for the choices made in the interim model, explaining their necessity and proportionality in relation to the legitimate purposes identified;

iii. In particular, reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;

iv. Distinguish between legal and natural persons, allowing for public access to WHOIS data of legal entities, which are not in the remit of the GDPR;

v. Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;

vi. Ensure that limitations in terms of query volume envisaged under an accreditation program balance realistic investigatory crossreferencing needs; and

vii. Ensure confidentiality of WHOIS queries by law enforcement agencies.

b. the GAC advises the ICANN Board to instruct the ICANN Organization to:

i. Complete the interim model as swiftly as possible, taking into account the advice above. Once the model is finalized, the GAC will complement ICANN’s outreach to the Article 29 Working Party, inviting them to provide their views;

ii. Consider the use of Temporary Policies and/or Special Amendments to ICANN’s standard Registry and Registrar contracts to mandate implementation of an interim model and a temporary access mechanism; and

iii. Assist in informing other national governments not represented in the GAC of the opportunity for individual governments, if they wish to do so, to provide information to ICANN on governmental users to ensure continued access to WHOIS.

Muslim world still thinks .islam isn’t kosher

Kevin Murphy, April 23, 2018, Domain Policy

The Organization of Islamic Cooperation has repeated its objection to the gTLDs .islam and .halal ever seeing the light of day.

OIC Secretary General Yousef Al-Othaimeen wrote to ICANN earlier this month to declare that its position on the two controversial applications has not changed since it initially objected to them in 2013.

The OIC comprises the foreign ministers from 57 majority-Muslim countries and these ministers recently voted unanimously to re-adopt the 2013 objection, Al-Othaimeen said (pdf).

The group “maintain the position that the new gTLDs with Islamic identity are extremely sensitive in nature as they concern the entire Muslim nature” he wrote.

He reiterated “official opposition of the OIC Member states towards the probable authorization that might allow the use of these gTLDs .islam and .halal by any entity.”

This puts ICANN between a rock an a hard place.

The applicant for both strings, Turkish outfit Asia-Green IT Systems (AGIT), won an Independent Review Process case against ICANN last November.

The IRP panel ruled that ICANN broke its own bylaws when it placed .islam and .halal into permanent limbo — an “On Hold” status pending withdrawal of the applications or OIC approval — in 2014.

ICANN’s board accepted the ruling and bounced the decision on whether to finally approve or reject the bids to its Board Accountability Mechanisms Committee, which is currently mulling over the problem.

Technically, it’s “non-consensus Governmental Advisory Committee advice”, which means the board has some wriggle room to simply accept the advice and reject the applications.

But AGIT’s lawyer disagrees, recently telling ICANN (pdf) its options are to approve the bids or facilitate dialogue towards their approval, rather like ICANN is doing with .amazon right now.

Is ICANN over-reacting to Whois privacy law?

Kevin Murphy, March 20, 2018, Domain Policy

Is ICANN pushing the domain industry to over-comply with the European Union’s incoming General Data Protection Regulation privacy law?

Governments and plenty of intellectual property and business lobbyists think so.

After days of criticism from unhappy IP lawyers, ICANN’s public meeting in Puerto Rico last week was capped with a withering critique of the organization’s proposed plan for the industry to become GDPR compliant as pertains Whois.

The Governmental Advisory Committee, in unusually granular terms, picked apart the plan in its usual formal, end-of-meeting advice bomb, which focused on making sure law enforcement and IP owners continue to get unfettered Whois access after GDPR kicks in in May.

Key among the GAC’s recommendations (pdf) is that the post-GDPR public Whois system should continue to publish the email address of each domain registrant.

Under ICANN’s plan — now known as the “Cookbook” — that field would be obscured and replaced with a contact form or anonymized email address.

The GAC advised ICANN to “reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;”.

But its rationale for the advice is a little wacky, suggesting that email addresses under some unspecified circumstances may not contain “personal data”:

publication of the registrant’s email address should be considered in light of the important role of this data element in the pursuit of a number of legitimate purposes and the possibility for registrants to provide an email address that does not contain personal data.

That’s kinda like saying your mailing address and phone number aren’t personal data, in my view. Makes no sense.

The GAC advice will have won the committee friends in the Intellectual Property Constituency and Business Constituency, which throughout ICANN 61 had been pressuring ICANN to check whether removing email addresses from public Whois was strictly necessary.

ICANN is currently acting as a non-exclusive middleman between community members and the 20-odd Data Protection Authorities — which will be largely responsible for enforcing GDPR — in the EU.

It’s running compliance proposals it compiles from community input past the DPAs in the hope of a firm nod, or just some crumbs of guidance.

But the BC and IPC have been critical that ICANN is only submitting a single, rather Draconian proposal — one which would eschew email addresses from the public Whois — to the DPAs.

In a March 13 session, BC member Steve DelBianco pressed ICANN CEO Goran Marby and other executives and directors repeatedly on this point.

“If they [the DPAs] respond ‘Yes, that’s sufficient,’ we won’t know whether it was necessary,” DelBianco said, worried that the Cookbook guts Whois more than is required.

ICANN general counsel John Jeffrey conceded that the Cookbook given to the DPAs only contains one proposal, but said that it also outlines the “competing views” in the ICANN community on publishing email addresses and asks for guidance.

But email addresses are not the only beef the GAC/IPC/BC have with the ICANN proposal.

On Thursday, the GAC also advised that legal entities that are not “natural persons” should continue to have their full information published in the public Whois, on the grounds that GDPR only applies to people, not organizations.

That’s contrary to ICANN’s proposal, which for pragmatic reasons makes no distinction between people and companies.

There’s also the question of whether the new regime of Whois privacy should apply to all registrants, or just those based in the European Economic Area.

ICANN plans to give contracted parties the option to make it apply in blanket fashion worldwide, but some say that’s overkill.

Downtime for Whois?

While there’s bickering about which fields should be made private under the new regime, there doesn’t seem to be any serious resistance to the notion that, after May, Whois will become a two-tier system with a severely depleted public service and a firewalled, full-fat version for law enforcement and whichever other “legitimate users” can get their feet in the door.

The problem here is that while ICANN envisions an accreditation program for these legitimate users — think trademark lawyers, security researchers, etc — it has made little progress towards actually creating one.

In other words, Whois could go dark for everyone just two months from now, at least until the accreditation program is put in place.

The GAC doesn’t like that prospect.

It said in its advice that ICANN should: “Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties”.

But ICANN executives said in a session on Thursday that the org plans to ask the DPAs for a deferral of enforcement of GDPR over Whois until the domain industry has had time to come into compliance while continuing to grant access to full Whois to police and special interests.

December appears to be the favored date for this proposed implementation deadline, but ICANN is looking for feedback on its timetable by this coming Friday, March 23.

But the IPC/BC faction are not stting on their hands.

Halfway through ICANN 61 they expressed support for a draft accreditation model penned by consultant Fred Felman, formerly of brand protection registrar MarkMonitor.

The model, nicknamed “Cannoli” (pdf) for some reason, unsurprisingly would give full Whois access to anyone with enough money to afford a trademark registration, and those acting on behalf of trademark owners.

Eligible accreditees would also include security researchers and internet safety organizations with the appropriate credentials.

Once approved, accredited Whois users would have unlimited access to Whois records for defined purposes such as trademark enforcement or domain transfers. All of their queries would be logged and randomly audited, and they could lose accreditation if found to be acting outside of their legitimate purpose.

But Cannoli felt some resistance from ICANN brass, some of whom pointed out that it had been drafted by just one part of the community

“If the community — the whole community — comes up with an accreditation model we would be proud to put that before the DPAs,” Marby said during Thursday’s public forum in Puerto Rico.

It’s a somewhat ironic position, given that ICANN was just a few weeks ago prepared to hand over responsibility for creating the first stage of the accreditation program — covering law enforcement — wholesale to the GAC.

The GAC’s response to that request?

It’s not interested. Its ICANN 61 communique said the GAC “does not envision an operational role in designing and implementing the proposed accreditation programs”.