ICANN CEO to be announced Friday

ICANN will reveal the identity of its new CEO at a press conference this coming Friday.
But there’s a rumor going around that he or she is not expected to actually join the organization until September.
ICANN has just issued a press release stating that it will hold a news conference in Prague at 1600 local time (1400 UTC) during which Rod Beckstrom’s replacement will take questions from reporters.
People have been asking me for months if I know who it is and I have to say I haven’t got a clue.
The latest rumor doing the rounds, however, is that whoever has been selected will not actually take the helm until later this year.
I’ve heard September from some sources and October from others, but ICANN is currently declining to confirm or deny the rumor.
Beckstrom announced his departure from ICANN a year ago. His contract expires at the end of the month and is not expected to be extended.

Venue has “more reservations than bedrooms” for ICANN Prague

Anyone fancy a twos-up with another ICANN attendee in Prague?
The Hilton Prague Hotel has apologized for screwing up delegates’ reservations for the June 23-28 public ICANN meeting, and has reconfirmed the reservations of those affected.
But it’s told ICANN that it still doesn’t have enough rooms for that week. In a letter to ICANN meeting organizers, dated June 6, the hotel wrote:

The Hilton Prague still has more reservations than bedrooms for the period of the ICANN meeting, but both the Hilton Prague and ICANN event organizers are together working on minimizing the overbooking situation in order to be able to accommodate as many ICANN attendees as possible.

Not exactly encouraging, is it?
The overbooking problem seems to have been caused by the hotel running a special ICANN reservation system in parallel with its regular system, but not correctly linking the two.
Speculating, this might mean that only those who booked through official channels were affected.
Speculating further, it might also mean that those who booked independently are at risk of losing their reservations, should the Hilton decide to prioritize known ICANN delegates.
Even if I’m wrong on both counts, it does appear that not everyone who booked at the Hilton for the meeting will be staying where they hoped.

Hilton Prague screws over ICANN delegates

Lots of people attending ICANN’s public meeting in Prague later this month are complaining that the venue, the Hilton Prague Hotel, has rebooked them into hotels miles away.
It’s not clear how widespread the problem is, but I’d guess dozens of people are affected, judging by the chatter.
Amusingly, given recent events, it appears that a technical glitch with the hotel’s booking system is to blame.
One attendee, who was bumped to a hotel an hour’s walk away from the venue, was told the rebooking was “due to the unexpected circumstances with the reservation system”.
The Hilton is the venue and the first-choice hotel for the week-long meeting. ICANN had negotiated a special rate for attendees.
It’s not the first snafu to hit a meeting hotel recently. Last October, the venue one of the hotels chosen for the meeting in Dakar, Senegal, was slammed as smelly, dirty and insecure by many delegates.
However, with regard to the Prague snafu, I’ve been unable to confirm whether ICANN has filed an official complaint with the Czech minister of telecommunications yet.
While DI is attending Prague, your humble reporter is not affected by the mix-up. I’ll be sleeping on public transport and doing my morning ablutions in McDonald’s as usual.

TAS to reopen May 22. Big Reveal on for Prague?

ICANN’s bug-plagued TLD Application System will reopen on May 22 and close on May 30, according to a statement just issued by chief operating officer Akram Atallah.
The dates, which are only “targets”, strongly suggest that that the Big Reveal of all new gTLD applications is going to happen during the public meeting in Prague in late June.
If ICANN still needs two weeks to collate its application data before the reveal, we’re looking at June 14, or thereabouts, as the earliest possible reveal date.
But that’s just ten days before ICANN 44 officially kicks off, and I think it’s pretty unlikely ICANN will want to be distracted by a special one-off event while it’s busy preparing for Prague.
For the Big Reveal, my money is on June 25.
Atallah also said this morning that all new gTLD applicants have now been notified whether they were affected by the TAS bug, meaning ICANN has “met our commitment to provide notice to all users on or before 8 May”.
That said, some applicants I spoke to this morning, hours after it was already May 9 in California, said they had not received the promised notifications. But who’s counting?
The results of ICANN’s analysis of the bug appear to show that no nefarious activity was going on.
“We have seen no evidence that any TAS user intentionally did anything wrong in order to be able to see other users’ information,” Atallah said.
ICANN has also discovered another affected TAS user, in addition to the 50 already disclosed, according to Atallah’s statement.

ICANN cancels Fridays. Bad for transparency.

ICANN’s next public meeting, and all its public meetings thereafter, will be a day shorter than usual, following a decision to cancel the regular Friday morning program.
No Friday means no public meeting of the board of directors.
While the move is being characterized as an effort to enhance the effectiveness of ICANN’s board – a particular concern, frequently voiced, of chairman Steve Crocker – it’s also a perplexing shift away from ICANN’s core tenet of transparency.
One of the effects could be to mask dissent on the board.
From now on, it appears that all of ICANN’s top-level decision-making will happen in private.
Instead of wrapping up each public meeting with a board session at which resolutions get voted on, each meeting will instead be book-ended by less formal “community sessions”.
During these sessions, the board will apparently report to attendees about what it has been doing since the last meeting and what it plans to do before the next meeting.
Crocker said in a statement:

We believe that the removal of the Friday public Board meeting and its replacement with two Board community sessions will improve the effectiveness of both the Board and the staff and increase the time that the Board has to interact with the community.

That may well be true — time will tell — but let’s look at what the ICANN community is almost certainly losing.
First, there will be no more transcripts of board meetings at all.
Today, only the public meetings have published recordings and transcripts. Intersessional meetings are minuted, but not transcribed. If recordings are made, they are not published.
Killing off transcripts completely is a pretty obvious step backwards for an organization committed by its bylaws to “operate to the maximum extent feasible in an open and transparent manner”.
Second, if there is dissent on the board, it will be essentially shielded from the community’s view for some time after the fact.
Take, for example, the approval of the new gTLD program or the approval of ICM Registry’s .xxx contract – the two most controversial decisions ICANN made in 2011.
In both cases, certain directors read prepared statements into the record harshly criticizing the majority view.
In March 2011, for example, George Sadowsky stated that ICM’s purported community support for .xxx was “illusory” and that approving the TLD could lead to DNS Balkanization.
And with new gTLDs last June, Mike Silber abstained in the belief that the program was incomplete and that the vote had been scheduled “based on artificial and ego-driven deadlines”.
In both cases, the ICANN community heard the dissenting views – in person, webcast, recorded and transcribed – moments before the vote actually took place.
With no public board meetings, it seems likely that in future that we’re going to have to wait a week to read the voting record for any given resolution and a month or more to read directors’ statements.
Under ICANN’s bylaws, the voting record, which breaks down who voted for and against resolutions, is contained in a preliminary report that is not published for seven days after the vote.
Also under the bylaws, directors’ voting statements are not published until the minutes of the meeting are approved at the board’s next meeting, typically one to two months later.
If the new procedures had been in effect last year, the statements of Sadowsky and Silber would not have been published for over a month after they were made.
With that in mind, it’s clear that killing off the public board meetings could in no way be seen as a positive step for transparency at ICANN.
It’s true that these meetings have for several years been pure theater, but it was theater with value.

Beckstrom breaks TAS bug silence, says Big Reveal could be as late as Prague

ICANN may not reveal its list of new generic top-level domain applications until as late as the last week of June, according to CEO Rod Beckstrom.
In his first interview since ICANN took its TLD Application System offline due to a security bug, Beckstrom told DI that he “hopes” to host the Big Reveal before he steps down as ICANN’s CEO.
He said he expects to have the new gTLD program back on track before he hands the reins to the organization over to his successor at the end of the ICANN 44 meeting in Prague, June 29:

I’d like to see us obviously get the technical issues resolved, notify applicants, reopen the window and publish the strings before I pass the baton in Prague. That’s not a commitment at this point in time, it’s an indication as CEO that it’s absolutely my intention to push for a timely resolution of this issue… If we can get things done sooner, then the sooner the better.

That’s two months away, a full month later than anyone was expecting.
The Big Reveal was originally scheduled for today. However, the TAS delays made this impossible. Following an ICANN update on Friday, a late-May date for the Big Reveal was looking more probable.
But Beckstrom would not commit even to the Prague date. He said:

That’s my hope as a CEO, to get these issues resolved by that time-frame and have the string reveal in that time-frame. I haven’t committed the organization, I’m indicating to you volitionally my desire as CEO and the person who’s running the organization.

He framed the issue as a blip on a nine-year process (six years of policy development, one year of outreach and application filing, and up to two years of evaluation). He said:

In the context of nine-year program, a delay of between here and Prague of a few months is undesirable, it’s not what we want to have happen, but the quality of this program is more important to everyone involved than the specific date and time. We’re all focused on quality here and not just doing things in a hurry. This program is too important.

He said he is “sympathetic” to applicants that are burning through start-up funding waiting for ICANN to sort this out, but he noted that the same concerns have been raised over the years whenever the program has previously missed a launch deadline.

We know that some parties have been very patient and we know it’s got to be frustrating right now to see any delay in the program. At the same time, I’m sure that those parties are very concerned that this be done well and that the program be reopened and administered successfully.

Beckstrom reaffirmed ICANN’s promise to notify all applicants whether or not they were affected by the TAS bug – which revealed user names and file names to other TAS users – by May 8.
But TAS will not, it seems, reopen immediately after the notifications have been sent. As well as the log audit, ICANN is also working on performance upgrades.
While Beckstrom confirmed that the plan is to open TAS for five business days, to give applicants a chance to finish uploading their applications and confirm that their data has not been corrupted, he would not say when this window is due to open.

We’re going to share more precise dates when we have them. What I can tell you precisely right now is that the key thing we’re working on is combing through this large data set we have so that the parties that were affected are notified within the seven days. When we have clarity on the next milestone in the process we’ll communicate that openly.
…
We’re still doing system testing, we’re still looking at some of the performance issues. We have a whole set of things to do and feel comfortable that we’re ready and have full internal sign off. We’ll notify you and other parties when we have that clarity. Right now we have the clarity that we’re going to get the notification done in seven days – that’s the key dating item at this time.
…
We have very strong reason to believe we understand the bug and we’ve fixed the bug, but every day that we continue to test we gain a higher level of confidence in the system that this specific issue will not reappear.

While the first report of the bug was received March 19, it was not until April 12 that ICANN managed to “connect the dots” and figure out that the problem was serious and recurring, Beckstrom said.
ICANN saw the bug show up again repeatedly on April 12, as many TAS users logged in to finish off their applications, which was why it chose to take the system down with just 12 hours to go before the filing deadline.
ICANN is currently analyzing a 500GB log containing a record of every data packet that went into and out of the TAS between January 12 and April 12, to reconstruct every user session and determine who could see what and when, Beckstrom said.
He refused to comment on whether this analysis has revealed any attempts by TAS users to deliberately exploit the bug for competitive intelligence on other applicants.
He also declined to comment on whether ICANN has discovered instances of data leakage between two applicants for the same gTLD string.
The full packet capture system was introduced following a third-party security audit of the system conducted late last year, he said.
That audit, of course, did not reveal the data leakage vulnerability that continues to delayed the program.
When I put it to him that this is precisely the kind of problem ICANN wanted to avoid, due to the confidentiality of the applications, Beckstrom played down the seriousness of the bug.

Let’s be clear here: some user names and file names were visible, not the contents of applications and not the contents of those files. I think that if that had occurred it would be an even more undesirable situation and we have no indication that that occurred.
I wouldn’t call this a security issue, I’d call this… every major software system we use has bugs in it or bugs that are discovered over time. Whether that’s our operating systems or desktop applications or specific applications, you conduct the best tests you can. You assemble a testing suite, you assemble testers, you take various methods, but there’s never a guarantee that software is bug-free. The issue is that if and when bugs are encountered you deal with them appropriately, and that’s what we’re doing right now.

But Beckstrom admitted that the problem is embarrassing for ICANN, adding that sorting out the mess is currently the top priority.

Obviously any time you have a software problem or technical problem with any program you come under enhanced scrutiny and criticism, and I think that’s understandable, that’s fair. What we’re focused on is resolving this successfully and I think ICANN has dealt with many challenges in its past successfully and we’re committed to resolve this issue professionally.
…
I should tell you that this is our top priority right now internally right now. The resolution of this issue is our number one priority, the number one issue for me as CEO, number one for most members of the executive management team and for a large part of the organization. We’re extremely focused on this.

ICANN plans to reveal how many applicants were affected by the bug at the same time as it notifies applicants, Beckstrom said. It will not publish information about who could see what, he said.
Unfortunately for applicants, it seems they will have to wait well into next week before they have any more clarity on the timetable for TAS coming back online and the application window finally closing.
With Prague now emerged as a potential deadline for the reveal, the delays could in fact be much worse than anyone was expecting.
DI PRO subscribers can read a full transcript of the 30-minute interview.

Ombudsman reports on ICANN 43 “girls” scandal

ICANN Ombudsman Chris LaHatte has delivered his official report on the ICANN 43 sexism controversy.
As you may recall, during the ICANN 43 meeting in Costa Rica last month, domain name lawyer John Berryhill complained to LaHatte about a booth operated by Czech ccTLD operator CZ.nic.
Marketing ICANN 44, which CZ.nic is hosting in Prague this June, the booth offered cartoon postcards advertising “girls” as one of several reasons — alongside “beer”, “culture” etc — to attend the meeting.
Berryhill complained that the cards objectified women and were inappropriate for an ICANN meeting.
LaHatte writes:

The complainant says the use of the postcard was demeaning to women and an unnecessary objectification of them.
…
After some discussion, they [CZ.nic] understood the way in which this was seen, from another perspective, and quickly agreed to remove the postcards as an option in the kiosk display. What they saw as a light-hearted tribute to attractive woman in the Czech Republic, they then were able to see as offensive to others. Because they were so ready to perceive and accept the alternative view, it was not necessary to take any further action

A presentation by CZ.nic later in the week at the Costa Rica meeting eschewed any mention of the cards in question.
In the interests of disclosure, since first reporting this story I’ve discovered that Berryhill discovered the postcards via one of my own tweets, so I’m probably partly responsible for creating my own controversy here.