Latest news of the domain name industry

Recent Posts

Atallah encourages domainers to get involved in ICANN

Kevin Murphy, June 7, 2018, Domain Policy

ICANN Global Domains Division chief Akram Atallah today encouraged domain investors to participate more in the ICANN community.

“Domain investors’ voices need to be heard in ICANN,” he said during brief remarks opening NamesCon Europe here in Valencia this morning.

“Your voices are as important as everyone else’s and should be heard,” he said.

He noted to the largely European crowd here that ICANN has a public meeting coming up in Barcelona toward the end of the year.

The call came within the context of comments that focused almost exclusively on GDPR and Whois.

Atallah said that the absence of Whois would make it difficult to track down bad guys and harder for the average person to ensure that the information they get online comes from a reputable source.

“Not everything on the internet is true,” he said, to an faux-incredulous “WHAT?!?” from a member of the audience. “You need to know who is behind this information.”

He said that ICANN hopes to keep Whois as transparent as possible, and played up the fact that most community members are now in agreement that a tiered access system seems like the best way forward, which he called a “major shift from 12 months ago, when the community could not agree on anything”.

He added that now that the Article 29 Working Party has been replaced by the European Data Protection Board, it could help ICANN figure out how to proceed on GDPR compliance efforts.

“I think we’ll get more clarity,” he said.

Disclosure: I’m at NamesCon on my own dime, but with a complementary complemintary complimentary press pass.

US asks if it should take back control over ICANN

Kevin Murphy, June 6, 2018, Domain Policy

The US government has asked the public whether it should reverse its 2016 action to relinquish oversight of the domain name system root.

“Should the IANA Stewardship Transition be unwound? If yes, why and how? If not, why not?”

That’s the surprisingly direct question posed, among many others, in a notice of inquiry (pdf) issued yesterday by the National Telecommunications and Information Administration.

The inquiry “is seeking comments and recommendations from all interested stakeholders on its international internet policy priorities for 2018 and beyond”. The deadline for comments is July 2.

The IANA transition, which happened in September 2016, saw the NTIA remove itself from the minor part it played, alongside meatier roles for ICANN and Verisign, in the old triumvirate of DNS root overseers.

At the handover, ICANN baked many of its previous promises to the US government into its bylaws instead, and handed oversight of itself over to the so-called Empowered Community, made up of internet stakeholders of all stripes.

The fact that the question is being asked at all would have been surprising not too long ago, but new NTIA chief David Redl and Secretary of Commerce Wilbur Ross expressed their willingness to look into a reversal as recently as January.

Back then Redl told Congresspeople, in response to questions raised primarily by Senator Ted Cruz during his confirmation process:

I am not aware of any specific proposals to reverse the IANA transition, but I am interested in exploring ways to achieve this goal. To that end, if I am confirmed I will recommend to Secretary Ross that we begin the process by convening a panel of experts to investigate options for unwinding the transition.

Cruz had objected to the transition largely based on his stated (albeit mistaken or disingenuous) belief that it gave China, Iran and a plethora of bad guys control over Americans’ freedom of speech, something that has manifestly failed to materialize.

But in the meantime another big issue has arisen — GDPR, the EU’s General Data Protection Regulation — which is in the process of eroding access rights to Whois data, beloved of US law enforcement and intellectual property interests.

NTIA is known to be strongly in favor of retaining access to this data to the greatest extent possible.

The notice of inquiry does not mention Whois or GDPR directly but it does ask several arguably related questions:

A. What are the challenges to the free flow of information online?

B. Which foreign laws and policies restrict the free flow of information online? What is the impact on U.S. companies and users in general?

C. Have courts in other countries issued internet-related judgments that apply national laws to the global internet? What have been the practical effects on U.S. companies of such judgements? What have the effects been on users?

NTIA’s statement announcing the inquiry prominently says that the agency is “working on” items such as “protecting the availability of WHOIS information”.

It also says it “has been a strong advocate for the multistakeholder approach to Internet governance and policy development”.

While GPDR and Whois are plainly high-priority concerns for NTIA, it’s beyond my ken how reversing the IANA transition would help at all.

GDPR is not ICANN policy, after all. It’s a European Union law that applies to all companies doing business in Europe.

Even if the US were to fully nationalize ICANN tomorrow and rewrite Whois policy to mandate the death penalty for any contracted party that refused to openly publish full Whois records, that would not make GDPR go away, it would probably just kick off a privacy trade war or mean that all US contracted parties would have to stop doing business in Europe.

That sounds like an extreme scenario, but Trump.

The NTIA’s inquiry closes July 2, so if you think the transition was a terrible idea or a wonderful idea, this is where to comment.

Court denies ICANN’s GDPR injunction against Tucows

Kevin Murphy, May 31, 2018, Domain Policy

A German court has refused ICANN’s request for a GDPR-related injunction against Tucows’ local subsidiary EPAG, throwing a key prong of ICANN’s new Whois policy into chaos.

EPAG now appears to be free to stop collecting contact information for each domain’s administrative and technical contacts — the standard Admin-C and Tech-C fields.

The ruling may even leave the door open for registrars to delete this data from their existing Whois databases, a huge blow to ICANN’s Whois compliance strategy.

According to an ICANN-provided English translation of the ruling (pdf), the Bonn judges (whose names are redacted — another win for GDPR?) decided that the Admin-C and Tech-C records are unnecessary, because they can be (and usually are) the same person as the registrant.

The judges said that if the additional contact names were needed, it would have historically been a condition of registration that three separate people’s data was required.

They wrote that this “is proof that any data beyond the domain holder — different from him — was not previously necessary”.

“Against the background of the principle of data minimization, the Chamber is unable to see why further data sets are needed in addition to the main person responsible,” they wrote.

Data minimization is a core principle of GDPR, the General Data Protection Regulation, which came into force in the EU less than a week ago. Tucows and ICANN have different interpretations on how it should be implemented.

The judges said that the registrant’s contact information should be sufficient for any criminal or security-related investigations, which had been one of ICANN’s key claims.

They also said that ICANN’s attempt to compare Whois to public trademark databases was irrelevant, as no international treaties govern Whois.

If the ruling stands, it means registries and registrar in at least Germany could no longer have to collect Admin-C and Tech-C contacts.

Tucows had also planned to delete this data for its existing EPAG registrations, but had put its plan on hold ahead of the judge’s ruling.

The ruling also gives added weight to the part of ICANN’s registry and registrar agreements that require contracted parties to abide by local laws.

That’s at the expense of the new Temporary Policy governing Whois introduced two weeks ago, which still requires Admin-C and Tech-C data collection.

There was no word in ICANN’s statement on the ruling last night as to the possibility of appealing.

But the org seized on the fact that the ruling does not directly state that EPAG would be breaching GDPR rules by collecting the data. General counsel John Jeffrey is quoted as saying:

While ICANN appreciates the prompt attention the Court paid to this matter, the Court’s ruling today did not provide the clarity that ICANN was seeking when it initiated the injunction proceedings. ICANN is continuing to pursue the ongoing discussions with the European Commission, and WP29 [the Article 29 Working Party], to gain further clarification of the GDPR as it relates to the integrity of WHOIS services.

Tucows has yet to issue a statement on the decision.

It may not be the last time ICANN resorts to the courts in order to seek clarity on matters related to GDPR and its new Temporary Policy.

Million-euro Tucows GDPR lawsuit may not be ICANN’s last

Kevin Murphy, May 29, 2018, Domain Policy

ICANN has filed a lawsuit against a Tucows subsidiary in Germany in an effort to resolve a disagreement about how new European privacy law should be interpreted, and according to ICANN’s top lawyer it may not be the last.

The organization said late Friday that it is taking local registrar EPAG to court in Bonn, asking that the registrar be forced to continue collecting administrative and technical contact information for its Whois database.

According to an English translation of the motion (pdf), and to conversations DI had with ICANN general counsel John Jeffrey and Global Domains Division president Akram Atallah over the weekend, ICANN also wants an injunction preventing Tucows from deleting these fields from current Whois records.

At its core is a disagreement about how the new General Data Protection Regulation should be interpreted.

Tucows plans to continue collecting the registrant’s personal information, but it sees no reason why it should also collect the Admin-C and Tech-C data.

Policy director Graeme Bunton argues that in the vast majority of cases the three records are identical, and in the cases they are not, the registrar has no direct contractual relationship with the named individuals and therefore no business storing their data.

ICANN counters that Admin-C and Tech-C are vital when domain owners need to be contacted about issues such as transfers or cyber-attacks and that the public interest demands such records are kept.

Its new Temporary Policy — which is now a binding contractual commitment on all registries and registrars — requires all this data to be collected, but Tucows feels complying with the policy would force it to break European law.

“Strategically, we wanted to make sure we don’t let the Whois and the pubic interest get harmed in a way that can’t be repaired,” Atallah said.

“The injunction is to actually stop any registrar from not collecting all the data and therefore providing the opportunity for the multistakeholder model to work and come up with a long-term plan for Whois,” he said. “”We don’t want to have a gap.”

Jeffrey said that the suit was also necessary because ICANN has not received sufficient GDPR guidance from data protection authorities in the EU.

EPAG is not the only registrar planning to make the controversial changes to data collection. There are at least two others, at least one of which is based in Germany, according to Jeffrey and Atallah.

The German ccTLD registry, DENIC, is not under ICANN contract but has also said it will no longer collect Admin-C and Tech-C data.

They may have all taken their lead from the playbook (pdf) of German industry group eco, which has been telling ICANN since at least January that admin and tech contacts should no longer be collected under GDPR.

That said, Tucows chief Elliot Noss is a vocal privacy advocate, so I’m not sure how much leading was required. Tucows was also a co-developer (pdf) of the eco model.

The injunction application was filed the same day GDPR came into effect, after eleventh-hour talks between ICANN legal and Tucows leadership including chief legal officer Bret Fausett hit an impasse.

Tucows has agreed to freeze its plan to delete its existing Admin-C and Tech-C stored data, however.

The suit has a nominal million-euro value attached, but I’m convinced ICANN (despite its budget crunch) is not interested in the money here.

It’s my sense that this may not be the last time we see ICANN sue in order to bring clarity to GDPR.

Recently, Jeffrey said that ICANN would not tolerate contracted parties refusing to collect full Whois data, and also that it would not tolerate it when they decline to hand the data over to parties with legitimate interests.

The German lawsuit does not address this second category of non-compliance.

But it seems almost certain to me that intellectual lawyers are just days or weeks away from starting to file compliance tickets with ICANN when they are refused access to this data, which could lead to additional litigation.

“Whether it would result in a lawsuit is yet to be determined,” Jeffrey told DI yesterday. “The normal course would be a compliance action. If people aren’t able to gain access to information they believe that they have a legitimate right to access they will file compliance complaints. Those compliance complaints will be evaluated.”

“If it’s a systematic decision not to provide that access, that would violate the [Temporary Policy],” he said. “If they indicated it was because of their interpretation of the law, then it could result in us asking questions of the DPAs or going to court if that’s the only action available.”

The injunction application is a “one-sided filing”, which Jeffrey tells me is a feature of German law that means the court could issue a ruling without requiring EPAG/Tucows to appear in court or even formally respond.

The dispute therefore could be resolved rather quickly — this week even — by the court of first instance, Jeffrey said, or it could be bounced up to the European Court of Justice.

Given how new GDPR is, and considering the wider implications, the latter option seems like a real possibility.

After outcry, ICANNWiki to get ICANN funding next year

Kevin Murphy, May 23, 2018, Domain Policy

ICANNWiki will continue to get funding from its namesake, after community members complained about ICANN’s plan to abandon its $100,000 annual grant.

The independent wiki project will get $66,000 instead in the year beginning July 1, which will drop to $33,000 in ICANN’s fiscal 2020.

The funding will then disappear completely.

It’s a slight reprieve for ICANNWiki, which uses the money not only for its 6,000-article web site but also in-person outreach at events around the world.

The organization had complained about the plans to drop funding back in December, and fans of the site later called on ICANN to change its mind.

Supporters say the site fulfills a vital educational service to the ICANN community.

ICANNWiki also receives over $60,000 a year from corporate sponsors.

ICANN has also offered a reprieve to its Fellowship program in the new draft budget, reducing the number of people accepted into the program by fewer than expected.

It said in January it would slash the program in half, from 60 people per meeting to 30. That number will now drop to 45, at a cost of $151,000.

As discussed in this February article, the community has differing opinions about whether the program is an important way to on-board volunteers into ICANN’s esoteric world, or a way for freeloaders to vacation in exotic locations around the globe.