ICANN’s Security and Stability Advisory Committee has told ICANN it needs to do more to address the problem of name collisions before it approves any more new gTLDs.
In its latest advisory (pdf), published just before Christmas, SSAC says ICANN is not doing enough to coordinate with other technical bodies that are asserting authority over “special use” TlDs.
The SAC090 paper appears to be an attempt to get ICANN to further formalize its relationship with the Internet Engineering Task Force as it pertains to reserved TLDs:
The SSAC recommends that the ICANN Board of Directors take appropriate steps to establish definitive and unambiguous criteria for determining whether or not a syntactically valid domain name label could be a top-level domain name in the global DNS.
Pursuant to its finding that lack of adequate coordination among the activities of different groups contributes to domain namespace instability, the SSAC recommends that the ICANN Board of Directors establish effective means of collaboration on these issues with relevant groups outside of ICANN, including the IETF.
The paper speaks to at least two ongoing debates.
First, should ICANN approve .home and .corp?
These two would-be gTLDs were applied for by multiple parties in 2012 but have been on hold since August 2013 following an independent report into name collisions.
Names collisions are generally cases in which ICANN delegates a TLD to the public DNS that is already broadly used on private networks. This clash can result in the leakage of private data.
.home and .corp are by a considerable margin the two strings most likely to be affected by this problem, with .mail also seeing substantial volume.
But in recent months .home and .corp applicants have started to put pressure on ICANN to resolve the issue and release their applications from limbo.
The second incident the SSAC paper speaks to is the reservation in 2015 of .onion
If you’re using a browser on the privacy-enhancing Tor network, .onion domains appear to you to work exactly the same as domains in any other gTLDs, but under the hood they don’t use the public ICANN-overseen DNS.
The IETF gave .onion status as a “Special Use Domain“, in order to prevent future collisions, which caused ICANN to give it the same restricted status as .example, .localhost and .test.
But there was quite a lot of hand-wringing within the IETF before this status was granted, with some worrying that the organization was stepping on ICANN’s authority.
The SSAC paper appears to be designed at least partially to encourage ICANN to figure out how much it should take its lead from the IETF in this respect. It asks:
The IETF is an example of a group outside of ICANN that maintains a list of “special use” names. What should ICANN’s response be to groups outside of ICANN that assert standing for their list of special names?
For members of the new gTLD industry, the SSAC paper may be of particular importance because it raises the possibility of delays to subsequent rounds of the program if ICANN does not spell out more formally how it handles special use TLDs.
“The SSAC recommends that ICANN complete this work before making any decision to add new TLD names to the global DNS,” it says.
ICANN should lift the freeze on new gTLDs .mail, .home and .corp, despite fears they could cause widespread disruption, according to applicants.
Fifteen applicants for the strings wrote to ICANN last week to ask for a risk mitigation plan that would allow them to be delegated.
The three would-be gTLDs were put on hold indefinitely almost three years ago, after studies determined that they were at risk of causing far more “name collision” problems than other strings.
If they were to start resolving on the internet, the fear is they would lead to problems ranging from data leakage to systems simply stopping working properly.
Name collisions are something all new TLDs run the risk of creating, but .home, .corp and .mail are believed to be particularly risky due to the sheer number of private networks that use them as internal namespaces.
My own ISP, which has millions of subscribers, uses .home on its home hub devices, for example. Many companies use .corp and .mail on their LANs, due to longstanding advice from Microsoft and the IETF that it was safe to do so.
A 2013 study (pdf) showed that .home received almost 880 million DNS queries over a 48-hour period, while .corp received over 110 million.
That was vastly more than other non-existent TLDs.
For example, .prod (which some organizations use to mean “production”) got just 5.3 million queries over the same period, and when Google got .prod delegated two years it prompted an angry backlash from inconvenienced admins.
While .mail wasn’t quite on the same scale as the other two, third-party studies determined that it posed similar risks to .home and .corp.
All three were put on hold indefinitely. ICANN said it would ask the IETF to consider making them officially reserved strings.
Now the applicants, noting the lack of IETF movement to formally freeze the strings, want ICANN to work on a thawing plan.
“Rather than continued inaction, ICANN owes applicants for .HOME, .CORP, and .MAIL and the public a plan to mitigate any risks and a proper pathway forward for these TLDs,” the applicants told ICANN (pdf) last Wednesday.
A December 2015 study found that name collisions have occurred in new gTLDs, but that no truly serious problems have been caused.
That does not mean .home, .corp and .mail would be safe to delegate, however.
The United States Postal Service and Defender Security have both lost Legal Rights Objections over the new gTLDs .mail and .home, respectively.
In both cases it’s not the first LRO the objector has lost. USPS, losing here against Google, lost a similar objection against Amazon, while Defender has previously racked up six losses over .home.
The Defender case (pdf) this time was against .Home Registry Inc. The objection was rejected by the World Intellectual Property Organization panelist on pretty much the same grounds as the others — Defender acquired its trademark rights purely in order to be able to file LROs against its .home rivals.
In the USPS v Amazon case (pdf) the WIPO panelist also decided along the same lines as the previous case.
The decision turned on whether USPS, which owns trademarks on “U.S. Mail” but not “mail”, could be said to have rights in “mail” by virtue of the fact that it is the monopoly postal service in the US.
USPS argued that .mail is like .gov — internet users know a .gov domain is owned by the US government, so they’re likely to think .mail belongs to the official US mail service.
The panelist decided that users are more likely to associate the gTLD with email:
A consumer viewing the string <.mail> in the context of a domain name registration or an email address is presumably even more likely to think of the electronic (“email”) meaning, rather than the postal meaning, of the term “mail,”
WIPO has now decided 20 LRO cases. All have been rejected. Several more were terminated after the objector withdrew its objection.
While we were busy focusing on ICANN 47 last week, six new gTLD Legal Rights Objections were decided by the World Intellectual Property Organization.
These are the objections where the objector has trademark rights that it believes would be infringed by the delegation of a matching or confusingly similar gTLD.
All six cases, like the first six, were rejected for varying reasons. There has yet to be a decision in favor of an objector.
Here’s a rundown of the highlights of the decisions:
.home (Defender Security v Lifestyle Domain Holdings)
.home (Defender Security v Merchant Law Group)
.home (Defender Security v Uniregistry)
These cases are three of the nine filed by .home applicant Defender Security against its rival applicants. Defender had already lost one such objection, and these three were no different.
Defender acquired its trademarks and associated domains and companies from Constantine Roussos’ CGR E-Commerce shortly before the new gTLD application window opened.
The trademarks themselves, attached to hastily created Go Daddy reseller web sites, were obtained not much earlier.
Uniregistry, paraphrased by the WIPO panelist in its case, put the situation pretty close to the truth:
Objector is one of several parties who were solicited some months ago to purchase any of a number of cookie-cutter European trademark documents lacking any substantial basis in actual goodwill or commerce, which were filed solely to game this process, and do not reflect a bona fide acquisition of substantial rights.
The WIPO panelists did not disagree, with two of them finding that not only were the acquisition of trademark rights not bona fide, but also that there was a question as to whether Defender even owned the trademark.
One panelist wrote of “the misleading and sometimes deceptive presentation of the evidence in the Objection, and more generally the abusive nature of the Objection” and another said:
The [LRO] Procedure is not intended to provide a facility whereby existing or prospective applicants for a new gTLD may attempt to gain an advantage over other applicants for the same gTLD by way of the deliberate acquisition of trademark rights for no purpose other than to bring a Legal Rights Objection. It has not escaped the Panel’s notice that the evidence before it indicates that the present Objection might have been motivated by just such an attempt
All three cases were rejected largely on this basis.
The panelist in the Lifestyle Domain Holdings case decided that acquisition of the trademarks had in fact been bona fide, but rejected the objection anyway on the overall LRO test of whether the proposed gTLD would take “unfair advantage” of Defender’s trademark rights, stating:
If anyone has taken “unfair advantage,” it has been the Objector through its meritless Objection. The LRO process is not meant to be a game or crap shoot; rather, it should be invoked only when the applicant’s proposed string would “infringe” trademark rights. It is an abuse of the process to invoke an LRO against an applicant whose proposed use is clearly a fair use of a string for its descriptive meaning and not a use designed to “infringe” (that is, cause confusion as to source, authorization or affiliation). What is “unfair” here is that the Objector filed an Objection that is not only completely devoid of merit, causing the Respondent to waste time and effort defending its entirely appropriate application, but also full of misleading, deceptive, and demonstrably untrue statements and omissions
With the Roussos/Defender gaming strategy thus comprehensively trashed, I can only hope for Defender’s sake that there’s opportunity left for it to withdraw its remaining objections and ask for a refund.
.mail (United States Postal Service v Amazon)
Amazon is one of the many applicants for .mail, while USPS is the United States’ longstanding government-backed postal service and not an applicant.
USPS showed that it owned a wide array of trademarks that include the word “mail”, but not any for the word alone, and argued that internet users expect “mail” to mean the US mail.
Amazon said that the word is generic and that USPS is not the only organization to incorporate it in its trademarks.
Amazon said (ironically, given its intention to operate .mail as a closed generic) that USPS “improperly seeks to take the dictionary word ‘mail’ out of the English language for its exclusive use”.
The decision to reject the complaint hinged on whether USPS even has rights in .mail.
The WIPO panelist decided: “The fact that a nation’s postal system is vested by statute or otherwise associated with a single entity does not convert the generic term into a trademark.”
USPS has filed six more LROs against the other six .mail applicants, two of which have been terminated due to application withdrawals. We can only assume that the remaining four are also likely to fail.
.pin (Pinterest v Amazon)
Amazon is the only applicant for .pin. Again, it’s a closed generic for which the company has not explained its plans.
The objector, Pinterest, is a wildly popular photo-sharing service provider start-up, funded to the sum of $100 million by Amazon’s Japanese retail rival Rakuten.
It owns a US trademark for “Pinterest” and has applied for many more for “Pin” and “Pin It”.
The panelist, in ruling against Pinterest, decided that Pinterest, despite its popularity, failed to show that the dictionary word “pin” had acquired a secondary meaning beyond its usual descriptive sense.
.mls (Canadian Real Estate Association v. Afilias)
MLS, for readers based outside North America, means “multiple listing services”. It’s used by estate agents when aggregating lists of properties for sale.
The Canadian Real Estate Association — which has applied for .mls TWICE, one as a community once as a regular applicant — has owned a Canadian “certification mark” on the term “MLS” since 1960.
A substantial portion of the decision is devoted to examining whether this counts as a trademark for the purposes of an LRO, with the panelist deciding that “ownership of a certification trademark must confer the status of ‘rightsholder’.”
The case was therefore decided on the eight criteria specified for the LRO in the ICANN Applicant Guidebook. The panelist concluded:
The Panel cannot see the justification for refusing to allow the Applicant to operate in every country because the Objector has a certification mark for a generic term in Canada. Had the Objector’s certification been other than a generic term, its case might have been stronger but MLS it is a generic term used in English-speaking jurisdictions.
The decision cited the .rightathome case, in which the decision hinged on whether the new gTLD applicant had any nefarious intent in applying for the string in question.
A body of precedent seems to be emerging holding that a new gTLD application must be somewhat akin to a cybersquatting attempt in order for an objector to win.
While this may be fair, I think a likely impact is an increase in the number of dot-brand applications in future rounds, particularly in cases where the brand matches a dictionary word or collides with another trademark.
We’ve yet to see what a successful LRO looks like, but the standard appears to be high indeed.
Four new gTLD applications have been withdrawn so far this week, including the first to come from .info operator Afilias.
Afilias has pulled its bid for .mail — the second applicant to do so — due to the number of competitors for the string.
A spokesperson said in an email:
The company felt there were simply too many groups in contention for this domain and we’d rather focus our energy supporting and helping to grow the .POST domain, for which we are the [technical services provider].
There are now five applicants competing for the string, including Google, Amazon and Donuts, but they’re all facing objections from the United States Postal Service and the Universal Postal Union, which runs .post.
Elsewhere this week, Directi has ended its bid for .movie, a contention set with seven other bidders.
The company declined to comment on the reasons for the withdrawal, so we probably can’t entirely rule out some kind of partnership with one or more other applicants.
Today we’ve also seen the withdrawal of applications for .ltd and .inc, both belonging to a Dutch company called C.V. TLDcare. I don’t know much about these guys, other than it used OpenRegistry as its technical partner and that .inc and .ltd were its only two applications.
Interesting fact: not a single “corporate identifier” application (.llp, .corp, .ltd, .inc, .llc) has passed Initial Evaluation yet, but seven applications have been withdrawn.
It’s a controversial category, with many US state attorneys general very unhappy about any of these strings being delegated without safeguards.
The latest four withdrawals bring the total to 63.