Latest news of the domain name industry

Recent Posts

Exclusive: Tiny island sues to take control of lucrative .nu

Kevin Murphy, November 28, 2018, Domain Registries

The tiny Pacific island of Niue has sued the Swedish ccTLD registry to gain control of its own ccTLD, .nu, DI has learned.

The lawsuit, filed this week in Stockholm, claims that the Internet Foundation In Sweden (IIS) acted illegally when it essentially took control of .nu in 2013, paying its American owner millions of dollars a year for the privilege.

Niue wants the whole ccTLD registry transferred to its control at IIS’s expense, along with all the profits IIS has made from .nu since 2013 — many millions of dollars.

It also plans to file a lawsuit in Niue, and to formally request a redelegation from IANA.

While .nu is the code assigned to Niue, it has always been marketed in northern Europe, particularly Sweden, in countries where the string means “now”.

It currently has just shy of 400,000 domains under management, according to IIS’s web site, having seen a 50,000-name slump just a couple weeks ago.

It was expected to be worth a additional roughly $5 million a year for the registry’s top line, according to IIS documents dated 2012, a time when it only had about 240,000 domains.

For comparison, Niue’s entire GDP has been estimated at a mere $10 million, according to the CIA World Factbook. The island has about 1,800 inhabitants and relies heavily on tourism and handouts from New Zealand.

According to documents detailing its 2013 takeover, IIS agreed to pay a minimum of $14.7 million over 15 years for the right to run the ccTLD, with a potential few million more in performance-related bonuses.

The Niue end of the lawsuit is being handled by Par Brumark, a Swedish national living in Denmark, who has been appointed by the Niuean government to act on its behalf on ICANN’s Governmental Advisory Committee, where he is currently a vice-chair.

Brumark told DI that IIS acted illegally when it took over .nu from previous registry, Massachusetts-based WorldNames, which had been running the ccTLD without the consent of Niue’s government since 1997.

The deal was characterized by WorldNames in 2013 as a back-end deal, with IIS taking over administrative and technical operations.

But IIS documents from 2012 reveal that it is actually more like a licensing deal, with IIS paying WorldNames the aforementioned minimum of $14.7 million over 15 years for the rights to manage, and profit from, the TLD.

The crux of the lawsuit appears to be the question of whether .nu can be considered a “Swedish national domain”.

IIS is a “foundation”, which under Swedish law has to stick to the purpose outlined in its founding charter.

That charter says, per IIS’s own translation, that the IIS “must particularly promote the development of the handling of domain names under the top-level domain .se and other national domains pertaining to Sweden.”

Brumark believes that .nu is not a national domain pertaining to Sweden, because it’s Niue’s national ccTLD.

One of his strongest pieces of evidence is that the Swedish telecoms regulator, PTS, refuses to regulate .nu because it’s not Swedish. PTS is expected to be called as a witness.

But documents show that the Stockholm County Administrative Board, which regulates Foundations, gave permission in 2012 for IIS to run “additional top-level domains”.

Via Google Translate, the Board said: “The County Administrative Board finds that the Foundation’s proposed management measures to administer, managing and running additional top-level domains is acceptable.”

Brumark thinks this opinion was only supposed to apply to geographic gTLDs such as .stockholm, and not to ccTLD strings assigned by ISO to other nations.

The Stockholm Board did not mention .nu or make a distinction between ccTLD and gTLDs in its letter to IIS, but the letter was in response to a statement from an IIS lawyer that .nu, with 70% of its registrations in Sweden, could be considered a Swedish national domain under the IIS charter.

Brumark points to public statements made by IIS CEO Danny Aerts to the effect that IIS is limited to Swedish national domains. Here, for example, he says that IIS could not run .wales.

IIS did not respond to my requests for comment by close of business in Sweden today.

Niue claims that if .nu isn’t Swedish, IIS has no rights under its founding charter to run it, and that it should be transferred to a Niuean entity, the Niue Information Technology Committee.

That’s a governmental entity created by an act of the local parliament 18 years ago, when Niue first started its campaign to get control of .nu.

The history of .nu is a controversial one, previously characterized as “colonialism” by some.

The ccTLD was claimed by Boston-based WorldNames founder Bill Semich and an American resident of the island, in 1997. That’s pre-ICANN, when the IANA database was still being managed by Jon Postel.

At the time, governments had basically no say in how their ccTLDs were delegated. It’s not even clear if Niue was aware its TLD had gone live at the time.

The official sponsor of .nu, according to the IANA record, is the IUSN Foundation, which is controlled by WorldNames.

Under ICANN/IANA policy, the consent of the incumbent sponsor is required in order for a redelegation to occur, and WorldNames has been understandably reluctant to give up its cash cow, despite Niue trying to take control for the better part of two decades.

The 2000 act of parliament declared that NITC was the only true sponsor for .nu, but even Niuean law has so far not proved persuasive.

So the lawsuit against IIS is huge twist in the tale.

If Niue were to win, IIS would presumably be obliged to hand over all of its registry and customer data to Niue’s choice of back-end provider.

Both Afilias and Danish registrar One.com have previously expressed an interest in running .nu, providing a share of the revenue to Niue, according to court documents.

Brumark said that a settlement might also be possible, but that it would be very costly to IIS.

Readers might also be interested in my 2011 article about Niue, which was once widely referred to as the “WiFi Nation”.

Donuts loses to ICANN in $135 million .web auction appeal

Kevin Murphy, October 16, 2018, Domain Registries

Donuts has lost a legal appeal against ICANN in its fight to prevent Verisign running the .web gTLD.

A California court ruled yesterday that a lower court was correct when it ruled almost two years ago that Donuts had signed away its right to sue ICANN, like all gTLD applicants.

The judges ruled that the lower District Court had “properly dismissed” Donuts’ complaint, and that the covenant not to sue in the Applicant Guidebook is not “unconscionable”.

Key in their thinking was the fact that ICANN has an Independent Review Process in place that Donuts could use to continue its fight against the .web outcome.

The lawsuit was filed by Donuts subsidiary Ruby Glen in July 2016, shortly before .web was due to go to an ICANN-managed last-resort auction.

Donuts and many others believed at the time that one applicant, Nu Dot Co, was being secretly bankrolled by a player with much deeper pockets, and it wanted the auction postponed and ICANN to reveal the identity of this backer.

Donuts lost its request for a restraining order.

The auction went ahead, and NDC won with a bid of $135 million, which subsequently was confirmed to have been covertly funded by Verisign.

Donuts then quickly amended its complaint to include claims of negligence, breach of contract and other violations, as it sought $22.5 million from ICANN.

That’s roughly how much it would have received as a losing bidder had the .web contention set been settled privately and NDC still submitted a $135 million bid.

As it stands, ICANN has the $135 million.

That complaint was also rejected, with the District Court disagreeing with earlier precedent in the .africa case and saying that the covenant not to sue is enforceable.

The Appeals Court has now agreed, so unless Donuts has other legal appeals open to it, the .web fight will be settled using ICANN mechanisms.

The ruling does not mean ICANN can go ahead and delegate .web to Verisign.

The .web contention set is currently “on-hold” because Afilias, the second-place bidder in the auction, has since June been in a so-called Cooperative Engagement Process with ICANN.

CEP is a semi-formal negotiation-phase precursor to a full-blown IRP filing, which now seems much more likely to go ahead following the court’s ruling.

The appeals court ruling has not yet been published by ICANN, but it can be viewed here (pdf).

The court heard arguments from Donuts and ICANN lawyers on October 9, the same day that DI revealed that ICANN Global Domains Division president Akram Atallah had been hired by Donuts as its new CEO.

A recording of the 32-minute hearing can be viewed on YouTube here or embedded below.

Afilias sues India to block $12 million Neustar back-end deal

Kevin Murphy, August 27, 2018, Domain Registries

Afilias has sued the Indian government to prevent it awarding the .in ccTLD back-end registry contract to fierce rival Neustar.

The news emerged in local reports over the weekend and appears to be corroborated by published court documents.

According to Moneycontrol, the National Internet Exchange of India plans to award the technical service provider contract to Neustar, after over a decade under Afilias, but Afilias wants the deal blocked.

The contract would also include some 15 current internationalized domain name ccTLDs, with another seven on the way, in addition to .in.

That’s something Afilias reckons Neustar is not technically capable of, according to reports.

Afilias’ lawsuit reportedly alleges that Neustar “has no experience or technical capability to manage and support IDNs in Indian languages and scripts and neither does it claim to have prior experience in Indian languages”.

Neustar runs plenty of IDN TLDs for its dot-brand customers, but none of them appear to be in Indian scripts.

NIXI’s February request for proposals (pdf) contains the requirement: “Support of IDN TLDs in all twenty two scheduled Indian languages and Indian scripts”.

I suppose it’s debatable what this means. Actual, hands-on, operational experience running Indian-script TLDs at scale would be a hell of a requirement to put in an RFP, essentially locking Afilias into the contract for years to come.

Only Verisign and Public Interest Registry currently run delegated gTLDs that use officially recognized Indian scripts, according to my database. And those TLDs — such as Verisign’s .कॉम (the Devanagari .com) — are basically unused.

Neither Neustar nor Afilias have responded to DI’s requests for comment today.

.in has over 2.2 million domains under management, according to NIXI.

Neustar’s Indian subsidiary undercut its rival with a $0.70 per-domain-year offer, $0.40 cheaper than Afilias’ $1.10, according to Moneycontrol.

That would make the deal worth north of $12 million over five years for Afilias and over $7.7 million for Neustar.

One can’t help but be reminded of the two companies’ battle over Australia’s .au, which Afilias sneaked out from under long-time incumbent Neustar late last year.

That handover, the largest in DNS history, was completed relatively smoothly a couple months ago.

In GDPR case, ICANN ready to fight Tucows to the bitter end

Kevin Murphy, June 14, 2018, Domain Policy

ICANN has appealed its recent court defeat as it attempts to force a Tucows subsidiary to carry on collecting full Whois data from customers.

The org said yesterday that it is taking its lawsuit against Germany-based EPAG to a higher court and has asked it to bounce the case up to the European Court of Justice, as the first test case of the new General Data Protection Regulation.

In its appeal, an English translation (pdf) of which has been published, ICANN argues that the Higher Regional Court of Cologne must provide an interpretation of GDPR in order to rule on its request for an injunction.

And if it does, ICANN says, then it is obliged by the GDPR itself to refer that question to the ECJ, Europe’s highest judicial authority.

The case concerns Tucows’ refusal to carry on collecting contact information about the administrative and technical contacts for each domain name it sells, which it is contractually obliged to do under ICANN’s Whois policy.

These are the Admin-C and Tech-C fields that complement the registrant’s own contact information, which Tucows is of course still collecting.

Tucows says that these extra fields are unnecessary, and that GDPR demands it minimize the amount of data it collects to only that which it strictly needs to execute the registration contact.

It also argues that, if the Admin-C and Tech-C are third parties, it has no business collecting any data on them at all.

According to Tucows legal filings, more than half of its 10 million domains have identical data for all three contacts, and in more than three quarters of cases the registrant and Admin-C are identical.

In its appeal, ICANN argues that the data is “crucial for the objectives of a secure domain name system, including but not limited to the legitimate purposes of consumer protection,
investigation of cybercrime, DNS abuse and intellectual property protection and law enforcement needs”.

ICANN uses Tucows’ own numbers against it, pointing out that if Tucow has 7.5 million domains with shared registrant and Admin-C data, it therefore has 2.5 million domains where the Admin-C is a different person or entity, proving the utility of these records.

It says that registrars must continue to collect the disputed data, at the very least if it has secured consent from the third parties named.

ICANN says that nothing in the Whois policy requires personal data to be collected on “natural persons” — Admin-C and Tech-C could quite easily be legal persons — therefore there is no direct clash with GDPR, which only covers natural persons.

Its appeal, in translation, reads: “the GDPR is irrelevant if no data about natural persons are collected. In this respect, the Defendant is contractually obliged to collect such data, and failure to do so violates its contract with the Applicant.”

It goes on to argue that even if the registrant chooses to provide natural-person data, that’s still perfectly fine as a “legitimate purpose” under GDPR.

ICANN was handed a blow last month after a Bonn-based court refused to give it an injunction obliging EPAG (and, by inference, all registrars) to continue collecting Admin-C and Tech-C.

The lower court had said that registrants would be able to continue to voluntarily provide Admin-C and Tech-C, but ICANN’s appeal points out that this is not true as EPAG is no longer requesting or collecting this data.

In ICANN’s estimation, the lower court declined to comment on the GDPR implications of its decision.

It says the appeals court, referred to in translation as the “Senate”, cannot avoid interpreting GDPR if it has any hope of ruling on the injunction request.

Given the lack of GDPR case law — the regulation has only been in effect for a few weeks — ICANN reckons the German court is obliged by GDPR itself to kick the can up to the ECJ.

It says: “If the Senate is therefore convinced that the outcome of this procedure depends on the interpretation of certain provisions of the GDPR, the Senate must refer these possible questions to the ECJ for a preliminary ruling”.

It adds that should a referral happen it should happen under the ECJ’s “expedited” procedures.

An ECJ ruling has been in ICANN’s sights for some time; late last year CEO Goran Marby was pointing out that a decision from the EU’s top court would probably be the only way full legal clarity on GDPR’s intersection with Whois could be obtained.

It should be pointed out of course that this case is limited to the data collection issue.

The far, far trickier issue of when this data should be released to people who believe they have a legitimate purpose to see it — think: trademark guys — isn’t even up for discussion in the courts.

It will be, of course. Give it time.

All of ICANN’s legal filings, in the original German and unofficial translation, can be found here.

Court denies ICANN’s GDPR injunction against Tucows

Kevin Murphy, May 31, 2018, Domain Policy

A German court has refused ICANN’s request for a GDPR-related injunction against Tucows’ local subsidiary EPAG, throwing a key prong of ICANN’s new Whois policy into chaos.

EPAG now appears to be free to stop collecting contact information for each domain’s administrative and technical contacts — the standard Admin-C and Tech-C fields.

The ruling may even leave the door open for registrars to delete this data from their existing Whois databases, a huge blow to ICANN’s Whois compliance strategy.

According to an ICANN-provided English translation of the ruling (pdf), the Bonn judges (whose names are redacted — another win for GDPR?) decided that the Admin-C and Tech-C records are unnecessary, because they can be (and usually are) the same person as the registrant.

The judges said that if the additional contact names were needed, it would have historically been a condition of registration that three separate people’s data was required.

They wrote that this “is proof that any data beyond the domain holder — different from him — was not previously necessary”.

“Against the background of the principle of data minimization, the Chamber is unable to see why further data sets are needed in addition to the main person responsible,” they wrote.

Data minimization is a core principle of GDPR, the General Data Protection Regulation, which came into force in the EU less than a week ago. Tucows and ICANN have different interpretations on how it should be implemented.

The judges said that the registrant’s contact information should be sufficient for any criminal or security-related investigations, which had been one of ICANN’s key claims.

They also said that ICANN’s attempt to compare Whois to public trademark databases was irrelevant, as no international treaties govern Whois.

If the ruling stands, it means registries and registrar in at least Germany could no longer have to collect Admin-C and Tech-C contacts.

Tucows had also planned to delete this data for its existing EPAG registrations, but had put its plan on hold ahead of the judge’s ruling.

The ruling also gives added weight to the part of ICANN’s registry and registrar agreements that require contracted parties to abide by local laws.

That’s at the expense of the new Temporary Policy governing Whois introduced two weeks ago, which still requires Admin-C and Tech-C data collection.

There was no word in ICANN’s statement on the ruling last night as to the possibility of appealing.

But the org seized on the fact that the ruling does not directly state that EPAG would be breaching GDPR rules by collecting the data. General counsel John Jeffrey is quoted as saying:

While ICANN appreciates the prompt attention the Court paid to this matter, the Court’s ruling today did not provide the clarity that ICANN was seeking when it initiated the injunction proceedings. ICANN is continuing to pursue the ongoing discussions with the European Commission, and WP29 [the Article 29 Working Party], to gain further clarification of the GDPR as it relates to the integrity of WHOIS services.

Tucows has yet to issue a statement on the decision.

It may not be the last time ICANN resorts to the courts in order to seek clarity on matters related to GDPR and its new Temporary Policy.