Latest news of the domain name industry

Recent Posts

Pirates lose privacy rights under new ICANN rules

Kevin Murphy, January 22, 2016, Domain Registrars

People operating piracy web sites would have a harder time keeping their personal information private under new ICANN rules.

ICANN’s GNSO Council last night approved a set of recommendations that lay down the rules of engagement for when trademark and copyright owners try to unmask Whois privacy users.

Among other things, the new rules would make it clear that privacy services are not permitted to reject requests to reveal a domain’s true owner just because the IP-based request relates to the content of a web site rather than just its domain name.

The recommendations also contain safeguards that would allow registrants to retain their privacy if, for example, their safety would be at risk if their identities were revealed.

The 93-page document (pdf) approved unanimously by the Council carries a “Illustrative Disclosure Framework” appendix that lays out the procedures in some depth.

The framework only covers requests from IP owners to proxy/privacy services. The GNSO was unable to come up with a similar framework for dealing with, for example, requests from law enforcement agencies.

It states flatly:

Disclosure [of the registrant’s true Whois details] cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the Request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

This fairly explicitly prevents privacy services (which in most cases are registrars) using the “we don’t regulate content” argument to shoot down disclosure requests from IP owners.

Some registrars were not happy about this paragraph in early drafts, yet it remains.

Count that as a win for the IP lobby.

However, the new recommendations spend a lot more time giving IP owners a quite strict set of guidelines for how to file such requests in the first place.

If they persistently spam the registrar with automated disclosure requests, the registrar is free to ignore them. They can even share details of spammy IP owners with other registrars.

The registrar is also free to ignore requests that, for example, don’t give the exact or representative URL of an alleged copyright infringement, or if the requester has not first attempted to contact the registrant via an email relay service, should one be in place.

The registrant also gets a 15-day warning that somebody has requested their private details, during which, if they value their privacy more than their web site, they’re able to relinquish their domain and remain anonymous.

If the registrant instead uses that time to provide a good reason why they’re not infringing the requester’s rights, and the privacy service agrees, the request can also be denied.

The guidelines would make it easier for privacy service operators to understand what their obligations are. By formalizing the request format, it should make it easier to separate legit requests from the spurious requests.

They’re even allowed to charge IP owners a nominal fee to streamline the processing of their requests.

While these recommendations have been approved by the GNSO Council, they need to be approved by the ICANN board before becoming the law of the ‘net.

They also need to pass through an implementation process (conducted by ICANN staff and GNSO members) that turns the recommendations into written procedures and contracts which, due to their complexity, I have a hunch will take some time.

The idea is that the rules will form part of an accreditation program for privacy/proxy services, administered by ICANN.

Registrars would only be able to use P/P services that agree to follow these rules and that have been accredited by ICANN.

It seems to me that the new rules may be quite effective at cracking down on rogue, “bulletproof” registrars that automatically dismiss piracy-based disclosure requests by saying they’re not qualified to adjudicate copyright disputes.

ICANN confirms domain privacy is for all

Kevin Murphy, January 22, 2016, Domain Policy

Commercial entities will not be excluded from buying domain privacy services, ICANN’s GNSO Council has confirmed.

The Council last night voted unanimously to approve a set of recommendations that would make it compulsory for privacy and proxy services to be accredited by ICANN for the first time.

The recommendations govern among other things how privacy services are expected to behave when they receive notices of trademark or copyright infringement.

But missing is a proposal that would have prevented the use of privacy for “transactional” web sites, something which caused a great deal of controversy last year.

The newly adopted recommendations clearly state that nobody is to be excluded from privacy on these grounds.

The Council voted to adopt the final, 93-page report of the Privacy and Proxy Services Accreditation Issues (pdf) working group, which states:

Fundamentally, P/P services should remain available to registrants irrespective of their status as commercial or non-commercial organizations or as individuals. Further, P/P registrations should not be limited to private individuals who use their domains for non-commercial purposes.

The minority view that web sites that process financial transactions should not be able to use privacy came from intellectual property, anti-abuse and law enforcement community members.

However, opponents said it would infringe the privacy rights of home business owners, bloggers, political activists and others.

It could even lead to vicious “doxing”-related crimes, such as “swatting”, where idiots call in fake violent crime reports against rivals’ home addresses, some said.

It also turned out, as we revealed last November, that 55% of US presidential candidates operate transactional web sites that use privacy on their domains.

Two separate registrar initiatives, one backed by the Electronic Frontier Foundation, started letter-writing campaigns that resulted in over 20,000 comments being received on the the PPSAI’s initial report last July.

Those comments are acknowledged in the PPSAI final report that the GNSO Council just approved.

The adopted recommendations (which I’ll get into in a separate article) still have to be approved by the ICANN board of directors and have to undergo an implementation process that puts the rather broad policies into concrete processes and procedures.

Bladel romps home in ICANN election re-run

Kevin Murphy, November 24, 2015, Domain Policy

Go Daddy VP of policy James Bladel has been elected chair of ICANN’s Generic Names Supporting Organization Council.

The result came a month after the GNSO Council embarrassingly failed to elect a chair to replace outgoing Jonathan Robinson.

This time Bladel ran unopposed, securing the unanimous support of both his own Contracted Parties House and the Non-Contracted Parties House, which did not field a candidate.

In the October vote, the NCPH had nominated academic Heather Forrest.

Due to personal friction between commercial and non-commercial NCPH Council members, Bladel lost that election to “none of the above” by a single vote.

Forrest has been elected vice-chair, along with Neustar’s Donna Austin.

Volker Greimann and David Cake, who had been running the Council on an interim basis for the last month, have stepped aside.

Why did the GNSO fail to pick a new leader?

Kevin Murphy, October 22, 2015, Domain Policy

Political infighting between sections of the Generic Names Supporting Organization seems to be responsible for the GNSO Council’s failure to elect a new chair yesterday.

Rumor has it that Contracted Parties House pick James Bladel, a VP at Go Daddy, only lost because of ructions in the Non-Contracted Parties House.

I stress these are just rumors — nobody with any first-hand knowledge of the situation was prepared to go on-record with me today — but they come from multiple sources.

As I reported earlier today, Bladel failed to secure the support of over 60% of the NCPH — the threshold to be elected chair — despite having the unanimous support of the CPH.

Roughly 47% of the NCPH chose to vote for “none of the above” instead, resulting in the GNSO Council now lacking a chair.

But I gather that this was not a diss against Bladel, his employer, or the CPH per se.

Rather, the story I’m hearing is that some councilors gave an empty chair their votes as a result of disagreements between the commercial and non-commercial sides of the NCPH.

Some say a deal had been made under which NCPH candidate Heather Forrest would receive at least 60% of the vote in round one, but some voters reneged on the deal, meaning she was knocked out of the running.

I don’t know if that’s true or not, but what it implies is that some votes that would have otherwise gone to Bladel in round two of voting were withheld, essentially out of spite.

Bladel only needed one additional NCPH vote to hit his 60%.

If this sounds like childish bickering, you may be right, but it wouldn’t be the first time a GNSO constituency has disrupted the council in order to make a point.

The last time that happened to a significant degree was over three years ago, when non-commercial users exploited a timing issue to protest new rights protection mechanisms for the Olympics, risking the new gTLD program timeline.

That led some at the time to predict the “death” of the GNSO.

That’s not happening this time. If anything, the wagons are circling.

Hastily reappointed council vice chair Volker Greimann, who became de facto chair at least for today, described the current situation as “business as usual” today, pointing out that ICANN bylaws envisaged and accounted for this kind of power vacuum.

The next vote on the chair’s position will take place at least a month from now.

Whois privacy reforms incoming

Kevin Murphy, May 6, 2015, Domain Policy

Whois privacy services will become regulated by ICANN under proposals published today, but there’s a big disagreement about whether all companies should be allowed to use them.

A working group has released the first draft of its recommendations covering privacy and proxy services, which mask the identity and contact details of domain registrants.

The report says that P/P services should be accredited by ICANN much like registrars are today.

Registrars should be obliged to disclose which such services they operate or are affilated with, presumably at the risk of their Registrar Accreditation Agreement if they do not comply, the report recommends.

A highlight of the paper is a set of proposed rules governing the release of private Whois data when it is requested by intellectual property interests.

Under the proposed rules, privacy services would not be allowed to reject such requests purely because the alleged infringement deals with the content of a web site rather than just the domain.

So the identity of a private registrant of a non-infringing domain would be vulnerable to disclosure if, for example, the domain hosted bootleg content.

Registrars would be able to charge IP owners a nominal “cost recovery” fee in order to process requests and would be able to ignore spammy automated requests that did not appear to have been manually vetted.

There’d be a new arbitration process that would kick in to resolve disputes between IP interests and P/P service providers.

The 98 pages of recommendations (pdf) were drafted by the Generic Names Supporting Organization’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) and opened for public comment today.

There are a lot of gaps in the report. Work, it seems, still needs to be done.

For example, it acknowledges that the working group didn’t reach any conclusions about what should happen when law enforcement agencies ask for private data.

The group was dominated by registrars and IP interests. There was only one LEA representative and only one governmental representative, and they participated in a very small number of teleconferences.

There was also a sharp division on the issue of who should be able to use privacy services, with two dissenting opinions attached to the report.

One faction, led by MarkMonitor and including Facebook, Domain Tools and fake pharmacy watchdog LegitScript, said that any company that engages in e-commerce transactions should be ineligible for privacy, saying: “Transparent information helps prevent malicious activity”.

Another group, comprising a handful of non-commercial stakeholders, said that no kind of activity should prevent you from registering a domain privately, pointing to the example of persecuted political groups using web sites to raise funds.

There was a general consensus, however, than merely being a commercial entity should not alone exclude you from using a P/P service.

Currently, registrar signatories to the 2013 RAA are bound by a temporary P/P policy that is set to expire January 2017 or whenever the P/P accreditation process starts.

There are a lot of recommendations in the report, and I’ve only touched on a handful here. The public comment period closes July 7.