ICANN’s private Whois data request service goes live

ICANN has this evening gone live with its service that enables anyone to request private Whois data on any gTLD domain.

The Registration Data Request Service lets people request contact information on registrants that would otherwise be redacted in the public Whois due to laws such as the GDPR.

The press release announcing the launch seems to have come out an hour or two before the service actually became accessible, but it’s definitely live now and I’ve tried it out.

The system is defined largely by what it isn’t. It isn’t an automated way to get access to private data. It isn’t guaranteed to result in private data being released. It isn’t an easy workaround to post-GDPR privacy restrictions.

It is a way to request an unredacted Whois record knowing only the domain and not having to faff around figuring out who the registrar is and what their mechanisms and policies are for requesting the data.

After scaling back the extremely complex and expensive original community recommendations for a post-GDPR Whois service, ICANN based the RDRS on its now decade-old Centralized Zone Data Service, which acts as an intermediary between registries and people like myself who enjoy sniffing around in zone files.

The RDRS merely connects Whois data requestors — the default settings in the interface suggest that ICANN thinks they’ll mostly be people with court orders — with the registrars in charge of the domains they are interested in.

Anyone who has used CZDS will recognize the interface, but the requesting process is longer, more complex, and requires accepting more disclaimers and Ts&Cs. That said, it’s not particularly confusing.

At first glance, it looks fine. Slick, even. I’ve used it to submit a test request with GoDaddy for my own Whois data, specifying that whoever deals with the request is free to ignore it. Let’s see what happens.

ICANN accused of power grab over $271 million auction fund

ICANN has acted outside of its powers by ignoring community policy recommendations and leaving its $271 million gTLD auction windfall open to being frittered away on lawyers, according to community members.

The Intellectual Property Constituency of the GNSO has filed a formal Request for Reconsideration over a board resolution passed at ICANN 78 last month in Hamburg, and other constituencies may add their names to it shortly.

The row concerns the huge cash pile ICANN was left sitting on following the auction of 17 new gTLD contracts between 2014 and 2016, which raised $240 million (as of July, around $271 million after investment returns and ICANN helping itself to a portion to fund its operations reserve).

It was decided that the money should be used to fund a grant program for worthy causes, with organizations able to apply for up to $500,000 during discrete rounds, the first of which is due to open next year with a $10 million pot. Around $220 million is believed to be earmarked for the grant program over its lifetime.

But the Cross Community Working Group for Auction Proceeds (CCWG-AP) that came up with the rules of the program was concerned that unsuccessful applicants, or others chagrined by ICANN’s grant allocations, might challenge decisions using ICANN’s accountability mechanisms.

This would cause money earmarked for worthy causes to be spaffed away on lawyers, which the CCWG-AP wanted to avoid, so it recommended that ICANN modify its fundamental bylaws to exclude the grant program from mechanisms such as the Independent Review Process, which usually incurs high six-figure or seven-figure legal fees.

ICANN seemed to accept this recommendation — formally approving it in June last year — until ICANN 78, when the board approved a surprise U-turn on this so-called Recommendation 7.

The board said it was changing its mind because it had found “alternative ways” to achieve the same objective, “including ways that do not require modification to ICANN’s core Bylaws on accountability”. The resolution stated:

As a result, the Board is updating its action on Recommendation 7 to reflect that ICANN org should implement this Recommendation 7 directly through the use of applicant terms and conditions rather than through a change to ICANN’s Fundamental Bylaws.

This left some community members — and at least one ICANN director — scratching their heads. Sure, you might be able to ban grant applicants from using the IRP in the program’s terms and conditions, but that wouldn’t stop third parties such as an applicant’s competitors from filing an IRP and causing legal spaffery.

The board was well aware of these concerns when it passed the resolution last month. Directors pointed out in Hamburg that ICANN is still pursuing the bylaws amendment route, but has removed it as a dependency for the first grant round going ahead.

This left some community members nonplussed — it wasn’t clear whether ICANN planned to go ahead with the program ignoring community recommendations, or not. The reassuring words of directors didn’t seem to tally with the language of the resolution.

So the IPC took the initiative and unironically invoked an accountability mechanism — the RfR — to get ICANN to change its mind again. I gather the request was filed as a precaution within the 30-day filing window due to the lack of clarity on ICANN’s direction.

The RfR states:

the impetus behind the Bylaws change was to prevent anyone from challenging grant decisions, including challenges from parties not in contractual privity with ICANN. The Board’s hasty solution would only prevent contracting grant applicants from challenging decisions; it would not in any way affect challenges by anyone else – including anyone who wished to challenge the award of a grant. The grant program could be tied in knots by disgruntled parties, competitive organizations or anyone else who wished to delay or prevent ICANN from carrying out any decision to grant funds. This is exactly what the CCWG-AP sought to prevent

The IPC says that by bypassing the bylaws amendment process, which involves community consent, the ICANN board is basically giving itself the unilateral right to turn off its bylaws-mandated accountability mechanisms when it sees fit. A power grab.

It wants the Hamburg resolution reversed.

Discussing the RfR a few days before it was filed, other members of the GNSO Council suggested that their constituencies might sign on as fellow complainants if and when it is amended.

RfRs are handled by ICANN’s Board Accountability Mechanisms Committee, which does not currently have a publicly scheduled upcoming meeting.

ICANN cans Freenom

Controversial free-domains company Freenom has lost its ICANN accreditation, signalling the end of its life as a gTLD registrar.

Org said that as of November 25, Freenom (aka OpenTLD) will no longer be able to sell or renew any domains.

The termination follows the company’s failure to resolve or respond to three separate breach notices, covering dozens of infractions, that Compliance sent between September and October.

Real damage to registrants was caused — many could not rescue their expired domains or transfer names to another registrar.

The company has 16,521 gTLD domains under management at the end of July, according to the most-recent registry transaction reports. They will now be moved to a more-reliable registrar under ICANN’s De-Accredited Registrar Transition Procedure.

Freenom may have been a small fish in the gTLD space, but it gave away tens of millions of free domains in five ccTLDs it controlled, mostly to spammers and other ne’er-do-wells.

It was recently reported that it has lost or is losing its deals with these ccTLDs, notably .tk, after their governments became aghast at how badly they were being abused.

Call for ICANN to dump anti-Semitic partner

A senior Jewish member of the ICANN community is calling on the Org to end its partnership with a company run by a Palestine-born Jordanian businessman who recently broadcast some outrageously anti-Semitic remarks.

Jeff Neuman of JJN Solutions and Dot Hip Hop, who has spent the last quarter-century involved in countless ICANN community roles, made the plea in an open letter he posted on his blog today following remarks by Talal Abu-Ghazaleh on Jordanian TV on October 12.

The letter follows an exchange at the ICANN Annual General Meeting in Hamburg last week in which Neuman raised concerns about some on-site graffiti that he considered anti-Semitic.

Abu-Ghazaleh’s comments, rather than being just some coded anti-Semitic dog-whistles, appear to directly attempt to justify the Holocaust, according to a translation by Middle-East media monitoring organization MEMRI.

Along with some less-extreme anti-Semitic tropes, he said, during an interview discussing the war in Gaza:

The Jews do not have any ideology. All they care about is money and interests. I had a friend who was a German cabinet member. I once asked him: ‘When Hitler, may God forgive him, carried out the Holocaust, why didn’t he finish the job and kill all the Jews?’ He said to me: ‘It’s the other way around, but don’t tell anyone I said this. He left a group of them on purpose, so that people would know why we carried out the Holocaust. When you would be tormented by them, you would know the reason.’

It turns out the Talal Abu-Ghazzaleh Organization (TAG-Org) that he runs hosts an instance of ICANN’s L-root server in Jordan — one of scores of redundant nodes at data centers around the world — and Neuman wants this relationship terminated.

Revealing that family members were killed in the Holocaust, he says in his letter to ICANN leadership:

I believe ICANN must take immediate action to remove this instance from TAG-Org and find a new home for this instance. In addition, ICANN should make an unequivocal statement ASAP that it does not condone such hate speech and that it will not have any partnerships whose founders or leaders espouse such views.

TAG-Org’s relationship with ICANN does not stop at the L-root instance, however. Abu-Ghazaleh is a noted champion of intellectual property rights in the Middle-East region and his companies are naturally involved in the domain industry and ICANN community.

TAG-Domains, part of Abu-Ghazaleh Intellectual Property (AGIP), is an ICANN-accredited registrar specializing in brand protection services. It has only about 1,200 gTLD domains under management.

And the group seems to be intimately involved with the Arab Center for Dispute Resolution, the only ICANN-approved UDRP service provider in the region. It was approved in 2013 with an application managed by Talal Abu-Ghazaleh Legal and there appears to be an ongoing relationship.

Neuman, who makes it clear he is not currently holding ICANN at fault for its partnerships, does not appear to be calling for ICANN to end these other relationships with the Abu-Ghazaleh group and I don’t think the Registrar Accreditation Agreement has a morality clause anyway.

Since Abu-Ghazaleh’s comments have come to light, two IP news publications — Managing IP and IAM — have publicly distanced themselves from him.

Managing IP said it was reviewing all awards it had given to AGIP and removing the company’s profile from its site, while IAM said it was removing Abu-Ghazaleh from its IP Hall of Fame.

While to my knowledge Neuman is the only person to date to ask ICANN for a similar censure, his voice does carry weight. You’d be hard-pressed to find anyone else in the community who’s put in as many hours and knows as much about ICANN policy-making.

I think it’s quite likely ICANN will say something condemning racism in response; I’m less certain that it will pull the plug on the Amman L-root or do anything concrete to distance itself from the Abu-Ghazaleh companies.

ICANN chair Tripti Sinha has already expressed dismay at graffiti that Neuman considered anti-Semitic that appeared for 24 hours on a mural at ICANN 78 in Hamburg last week.

This does NOT belong at an ICANN meeting! It’ is wholly inappropriate at ICANN. #icann78 pic.twitter.com/2KN6Eiel5D

— Jeff Neuman (@jintlaw) October 26, 2023

Saying on Twitter that the graffiti implied endorsement of the murder of Jews and that he felt unsafe at an ICANN meeting for the first time, Neuman used the Public Forum last Thursday to ask ICANN’s board of directors to condemn such behavior.

“This is not the place to make statements like that,” Sinha said, referring to the graffiti. “This is meant to be a safe place for discourse and interchange of ideas. so please do not engage in any kind of political dialogue and hurtful dialogue.”

Freenom is “essentially finished as a company”

Freenom is “essentially finished as a company”.

That’s the conclusion of a truly excellent piece of reporting at the MIT Technology Review today, which takes a deep dive into the company’s ccTLD antics over the last couple of decades, particularly regarding Tokelau’s .tk domain.

The article reveals not only that all four of Freenom’s African ccTLDs have severed ties with it (we already knew about two) but that Tokelau has asked .nz operator InternetNZ to help it wrest away control of .tk, the company’s flagship.

Officials in Tokelau, a tiny Pacific island territory with extremely poor and expensive internet infrastructure, say they get very little money from Freenom and are appalled that Tokelau’s reputation has been dragged through the mud by decades of abusive .tk registrations.

Freenom’s business model is to give away domains for free and then monetize them when they expire or, more usually, are suspended for abuse. It’s seen .tk become one of the largest TLDs by volume, with at one point over 40 million names.

The company hasn’t been selling any domains in the five ccTLDs it operated since January and it seems quite likely ICANN will suspend or terminate its gTLD registrar accreditation in the coming days or weeks.

It’s also fighting a cybersquatting lawsuit filed by Facebook owner Meta earlier this year that seeks damages sufficiently large to bankrupt it.

The MIT article is long but meticulously researched and sourced and well worth your time. It’s certainly one of the best pieces of mainstream journalism about the domain industry I’ve read.

Gap drops some dot-brands

American clothing retailer Gap has dumped two of its unused dot-brand gTLDs.

The company has told ICANN to terminate its registry contracts for .oldnavy and .bananarepublic, the names of two of its store chains, saying it isn’t using them.

Gap still owns .gap, and hasn’t yet asked for it to be cancelled, but it isn’t using that either.

The company’s TLDs all run on GoDaddy’s back-end and are managed by Fairwinds Partners.

The terminations bring the total number of dead dot-brands this year to 23, spread across 12 companies.

Group to seek .io TLD takeover after OECD human rights ruling

A group composed of displaced Chagossians will ask ICANN to redelegate the increasingly popular .io top-level domain, according to the group’s lawyer.

The move, still in its very early stages, follows a recent ruling under the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct, which mildly chastised the current registry, Identity Digital.

“The next move is domain reassignment,” lawyer Jonathan Levy, who brought the OECD complaint on behalf of the Chagos Refugees Group UK, told us. The proposed beneficiary would be “a group composed of Chagossians” he said.

.io is the ccTLD for the archipelago currently known as the British Indian Ocean Territory. It’s one of those Postel-era “Just Some Guy” developing-world delegations that pre-date ICANN.

But BIOT is a controversial territory. Originally the Chagos Archipelago, the few thousand original inhabitants were forced out by the UK government in the 1970s so the US military could build a base on Diego Garcia, the largest island.

Most of the surviving Chagossians and their descendants live in Mauritius, but have been fighting for their right to return for decades. In 2019, the UN ruled the UK’s current administration of BIOT is unlawful.

In recent years, since .io became popular, the ccTLD has become part of the fight.

The original and technically still-current registry for .io is a UK company called Internet Computer Bureau. ICB was acquired by Afilias in 2017 for $70 million. Afilias was subsequently acquired by Donuts, which is now called Identity Digital.

Corporate accounts filed by ICB name its ultimate owner as Beignet DTLD Holdings of Delaware, which appears to be a part of $2.21 billion private equity firm Ethos Capital, Identity Digital’s owner, which is co-managed by former ICANN CEO Fadi Chehadé.

None of these companies have a connection to BIOT beyond paying a local company called Sure (Diego Garcia) Limited for a mail-forwarding service. The only people believed to reside in the territory at all are US and UK military and contractors.

Levy, on behalf of the Chagossian refugees and a group of victims of cryptocurrency scams operated from .io domains, filed a complaint with the Ireland National Contact Point for the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct — basically a mediation service operated by the Irish government — seeking a share of the money from .io sales and/or redelegation.

According to its most-recent public accounts, ICB had turnover of £16.4 million ($19.8 million) in 2021, up from £12.8 million ($15.5 million) in 2020, but also had absolutely horrible gross margins for a registry with only one employee.

The company had cost of sales of £15.8 million and a gross margin of 3.58%. It pays no ICANN fees and the UK government receives no cut beyond the regular corporate tax ICB pays (about £26,000 in 2021).

The OECD’s Guidelines are voluntary guidelines that countries sign up to that are meant to guide how multinational companies behave with regards human rights and so on. Enforcement seems to be relatively toothless, with national NCPs only having the power to “recommend” actions.

In fact, Afilias declined to participate in mediation and appears to have received only a mild finger-wagging in the Irish NCP’s decision (pdf), which was published in September. One of its recommendations reads:

The NCP recommends that in cases in which a product, including a digital asset, is associated with long-running disputes regarding human rights, multinational enterprises should be able to demonstrate that they have carried out human rights due diligence

Levy thinks the NCP’s decision is a big deal, saying it means the OECD has validated the Chagossians’ concerns. Coupled with the UN sanction on the UK related to BIOT, he reckons it could play in their favor in a future redelegation request.

.io domain owners shouldn’t be too worried right now, however. Redelegation takes a very long time even when the losing party agrees, and it doesn’t tend to happen without the consent of the incumbent.

Modest pay rises for ICANN top brass

ICANN’s six top executives have been given pay raises up to 3.5%, according to resolutions passed at ICANN 78 last week.

The increases are a little ahead of US inflation but a little below the market rate if these officers were to work elsewhere, according to the resolutions.

Interestingly, interim CEO Sally Costerton is named in a pay-rise resolution for the first time, perhaps indicating she’s no longer being paid through the UK-based consulting company she owns, which has allowed ICANN to hide her compensation in its annual tax filings.

The resolution raises her “salary” by up to 3.5% for her role as senior advisor to president and SVP, Global Stakeholder Engagement, but does not mention the fact that she’s also acting CEO.

Looks like the fight for .hotel gTLD is over

One of the longest-running fights over a new gTLD may be over, after three unsuccessful applicants for .hotel appeared to throw in the towel on their four-year-old legal fight with ICANN.

In a document quietly posted by ICANN last week, the Independent Review Process panel handling the .hotel case accepted a joint request from ICANN and applicants Fegistry, Radix and Domain Venture Partners to close the case.

The applicants lawyers had told ICANN they were “withdrawing all of their claims” and the panel terminated the case “with prejudice”.

They had been fighting to get ICANN to overturn its decision to award .hotel to HOTEL Top-Level-Domain (HTLD), formerly affiliated with Afilias, which had won a controversial Community Priority Evaluation.

CPE was a process under the 2012 new gTLD program rules that allowed applicants in contention sets to avoid an auction if they could show sufficient “community” support for their bids, which HTLD managed to do.

The Fegistry complaint was the second IRP to focus on this decision, which was perceived as unfair and inconsistent with other CPE cases. The first ran from 2015 to 2016 and led to an ICANN win.

Part of the complaints focused on allegations that an HTLD executive improperly accessed private information on competing applicants using a vulnerability in ICANN’s applications portal.

The IRP complainants had also sued in Los Angeles Superior Court, but that case was thrown out in July due to the covenant not to sue (CNTS) that all new gTLD applicants had to agree to when they applied.

The fight for .hotel had been going on for longer than that for .web, but unlike .web it appears that this fight may finally be over.

.web fight back in “court”

ICANN is heading back to the quasi-courtroom of its Independent Review Process, after .web auction runner-up Altanovo Domains filed its second IRP complaint about the controversy-ridden gTLD.

I first reported that the complaint had been filed back in July, but it was not until last Thursday that ICANN published the document, along with thousands of pages of exhibits and its own response, almost all thoroughly redacted to remove references to the one contract at the heart of the mess.

Now-independent Altanovo, which was part of Afilias before that company was acquired by Donuts, claims that ICANN broke its bylaws commitments to apply its policies equitably to everyone.

The company remains incredibly cheesed off that it lost the 2016 auction for .web, which saw a company called Nu Dot Co pay ICANN $135 million for the domain, at a time when it was secretly backed by Verisign.

Altanovo claims that NDC broke the terms of ICANN’s Applicant Guidebook and the rules of the auction by declining to disclose the existence of the Domain Acquisition Agreement it had signed with Verisign.

That deal saw Verisign bankroll and dictate the terms of NDC’s handling of the auction; in exchange, NDC would transfer .web to Verisign shortly after signing its ICANN registry agreement.

Altanovo has already won one IRP about this. The panel in the first case ruled in May 2021 that ICANN broke its bylaws because its board did not make a decision on whether NDC’s behavior was kosher.

As a result of that ruling, the board spent over a year mulling and eventually decided this April that, no, NDC didn’t break the rules. It’s that decision that Altanovo is challenging now. The complaint says:

NDC had no independent business plan for .WEB that it intended to implement. Its sole purpose in applying for .WEB was to obtain it for the oldest of the incumbent players, not to market .WEB itself in any way or to compete in the market… No one in the Internet Community, including the other .WEB Contention Set members, had any clue that, as of August 2015, they were competing with Verisign and not NDC.

ICANN’s response to the complaint states that its board was exercising its “business judgement”, which must be deferred to, and that Altanovo’s claims about bylaws breaches merely amount to differences of interpretation.

Speaking to analysts on Verisign’s third-quarter earnings call last week, company CEO Jim Bidzos quoted from the conclusion of ICANN’s IRP response and added: “Altanovo’s IRP request should be denied. We agree with ICANN.”

“We continue to believe that this IRP filed by Altanovo and its backers has been filed for the purpose of delay,” he said.

Altanovo reckons that Verisign and ICANN have been colluding on their legal responses to the .web and that certainly seems likely in terms of the redactions ICANN has made to the complaint and response published last week.

All quotations of the Verisign-NDC DAA are redacted in the Altanovo complaint are redacted as “third party confidential”, presumably at Verisign’s request; in the ICANN response the single DAA quote remains unredacted.