Latest news of the domain name industry

Recent Posts

Is the new Whois policy group already doomed to fail?

Kevin Murphy, July 24, 2018, Domain Policy

ICANN’s Generic Names Supporting Organization has set itself extremely aggressive, some might say impossible, targets for its emergency Whois policy work.

The GNSO Council on Thursday approved the charter for a new working group that will attempt to come up with a consensus policy for how to amend the Whois system in light of the EU’s General Data Protection Regulation.

But the vote was not unanimous — three of the six Non-Commercial Stakeholder Group councilors abstained largely because they think intellectual property interests have managed to capture the discussion before it has begun.

The three abstentions were independent consultant Ayden Ferdeline, cybersecurity policy researcher Tatiana Tropina, and privacy consultant Stephanie Perrin.

Tropina said during the Thursday meeting: “I cannot vote ‘yes’ for a document that in my opinion has parts that are not properly worded and, instead of setting the scope of the EPDP [Expedited Policy Development Process] work, set up multiple possibilities to get the work sidetracked.”

She and Ferdeline pointed specifically to section J of the approved charter (pdf), which addresses “reasonable access” to non-public Whois data.

This is the part of the policy work that will decide whether, and to what extent, entities such as trademark owners and cybersecurity researchers will be able to peek behind the curtain of post-GDPR personal data redactions and see who actually owns domain names.

There are several “gating” questions that the working group must answer before it gets to J, however, such as: what data should be collected by registrars, how data transfer to registries should be handled, and are the reasons for this data to be collected all valid?

But when it comes to section J, the abstaining NCSG councilors reckon that the Intellectual Property Community has managed to sneak in the notion that its members should get access to private data as a fait accompli. Section J reads in part:

What framework(s) for disclosure could be used to address (i) issues involving abuse of domain name registrations, including but not limited to consumer protection, investigation of cybercrime, DNS abuse and intellectual property protection, (ii) addressing appropriate law enforcement needs, and (iii) provide access to registration data based on legitimate interests not outweighed by the fundamental rights of relevant data subjects?

Ferdeline said in his abstention:

I believe that Section J includes, first and foremost, questions that unnecessarily expand the scope of this EPDP and put perceived answers — rather than genuine, open ended questions — into this important document. Overall I think this section of the charter’s scope is unnecessary and will not allow the EPDP team to complete their work in a timely manner.

Tropina said J “poses the questions that, first of all, imply by default that issues related to intellectual property protection and consumer protection require the disclosure of personal data”, adding that she was bewildered that IP interests had been lumped in with security concerns:

This wording fails me: as I am criminal lawyer working in the field of frameworks for cybercrime investigation, I do not see why cybercrime investigations are separated from law enforcement needs and go to the same basket with intellectual property protection as they are on a completely different level of legitimate demands

In short, the newly approved EPDP charter has been framed in such a way as to make discussions extremely fractious from the outset, pitting privacy interests against those of the trademark lobby on some of the most divisive wedge issues.

This is problematic given that the working group has an extremely aggressive schedule — its members have not yet even been named and yet it expects to produce its Initial Report shortly after ICANN 63, which ends October 25 this year.

It’s an absurdly short space of time to resolve questions that have dogged ICANN for almost two decades.

Will this pressure to come to agreement against the clock work in favor of the trademark community, or will it doom the policy-making process to deadlock?

Attempting to steer the WG through this minefield will be Kurt Pritz, who was confirmed by the Council as its neutral chair on Thursday, as DI first reported a week ago.

The make-up of the group has also proved contentious.

While it is a GNSO process that would lead to a Consensus Policy binding on all gTLD registries and registrars, the decision has been made to bring in voices from other areas of the community, such as the Country Code Names Supporting Organization, which will not be directly affected by the resulting policy.

There will be 29 members in total, not counting the non-voting chair.

The GNSO gets 18 of these seats at the table, comprising: three registries, three registrars, two IPC members, two ISPs, two Business Constituency members, six NCSG members (which, I imagine would be split between the privacy-focused NCUC and more IP-friendly NPOC).

But also joining the group on an equal footing will be two members of the Root Server System Advisory Committee (I’ve no idea why), two from the Security and Stability Advisory Committee, two from the ccNSO, two from the At-Large Advisory Committee and three from the Governmental Advisory Committee.

The actual individuals filling these seats will be named by their respective constituencies in the next few days, ahead of the first WG meeting July 30.

It has been said that these people could expect to devote north of 30 hours a week (unpaid of course, though any necessary travel will be comp’d) to the discussions.

EnCirca partners with PandoraBots to push .bot names to brands

Specialist registrar EnCirca has partnered with bot development framework vendor PandoraBots to market .bot domains at big brands.

The two companies are pushing their wares jointly at this week’s International Trademark Association annual meeting in Seattle.

In a press release, the companies said that PandoraBots is offering bot-creation “starter kits” for brand owners that tie in with .bot registration via EnCirca.

Bots are rudimentary artificial intelligences that can be tailored to answer customer support questions over social media. Because who wants to pay a human to answer the phones?

Amazon Registry’s .bot gTLD is a tightly restricted space with strict preregistration verification rules.

Basically, you have to have a live, functioning bot before you can even request a domain there.

Only bots created using Amazon Lex, Botkit Studio, Dialogflow, Gupshup, Microsoft Bot Framework, and Pandorabots are currently eligible, though Amazon occasionally updates its list of approved frameworks.

The .bot space has been in a limited registration period all year, but on May 31 it will enter a six-month sunrise period.

Despite not hitting general availability until November, it already has about close to 1,800 domains in its zone — most of which were registered via EnCirca — and hundreds of live sites.

EnCirca currently offers a $200 registration service for brand owners, in which the registrar handles eligibility for $125 and the first year reg for $75.

Have your say on single-character .com domains

ICANN wants your opinion on its plan to allow Verisign to auction off o.com, with a potential impact on the future release of other single-character .com domain names.

The organization has published a proposed amendment to the .com registry contract and opened it for public comment.

The changes would enable Verisign to sell o.com, while keeping all other currently unallocated single-character names on its reserved list.

The company would not be able to benefit financially from the auction beyond its standard $7.85 reg fee — all funds would be held by an independent third-party entity and distributed to undisclosed non-profit causes.

The arrangement would also see the buyer pay a premium renewal fee of 5% of the initial outlay, doubling the purchase price over the course of 25 years.

They would not be able to resell the domain without selling the registrant company itself.

It’s a pretty convoluted system being proposed, given that there may well end up only being one bidder.

Overstock.com, the online retailer, has been pressuring ICANN and Verisign to release o.com for well over a decade, and the proposed auction seems to be a way to finally shut it up.

The company has a US trademark on O.com, so any other bidder for the name would probably be buying themselves a lawsuit.

The proposed auction system does not address trademark issues — there’s no sunrise period of trademark claims period.

One party already known to be upset about lack of rights protection is First Place Internet, a search engine company that has a US trademark on the number 1.

It told ICANN (pdf) back in January that the o.com deal would “set a dangerous precedent” for future single-character name releases.

The ICANN public comment period, which comes after ICANN received the all-clear from US competition regulators, closes June 20.

As a matter of disclosure, several years ago I briefly acted as a consultant to a third party in support of the Verisign and Overstock positions, but I have no current interest in the situation one way or the other.

Nominet to charge brands for no-name Whois access

Kevin Murphy, April 23, 2018, Domain Registries

Nominet has become the second major registry to announce that trademark lawyers will have to pay for Whois after the EU General Data Protection Regulation comes into effect next month.

The company said late last week that it will offer the intellectual property community two tiers of Whois access.

First, they can pay for a searchable Whois with a much more limited output.

Nominet said that “users of the existing Searchable WHOIS who are not law enforcement will continue to have access to the service on a charged-for basis however the registrant name and address will be redacted”.

Second, they can request the full Whois record (including historical data) for a specific domain and get a response within one business day for no charge.

Approved law enforcement agencies will continue to get unfettered access to both services — with “enhanced output” for the searchable Whois — for no charge, Nominet said.

These changes were decided upon following a month-long consultation which accepted comments from interested parties.

Other significant changes incoming include:

  • Scrapping UK-presence requirements for second-level registrations.
  • Doing away with the current privacy services framework, offloading GDPR liability to registrars providing such services.
  • Creating a standard opt-in mechanism for registrants who wish for their personal data to be disclosed in public Whois.

Nominet is the second registry I’m aware of to say it will charge brand owners for Whois access, after CoCCA 10 days ago.

CoCCA has since stated that it will sell IP owners a PDF containing the entire unredacted Whois history of a domain for $3, if they declare that they have a legitimate interest in the domain.

It also said they will be able to buy zone file access to the dozens of TLDs running on the CoCCA platform for $88 per TLD.

CoCCA to charge trademark owners for Whois access

Kevin Murphy, April 14, 2018, Domain Registries

CoCCA has become the first domain registry to publicly announce that it will charge trademark owners for access to Whois records.

The company said it plans to release an updated version of its software and registry service, containing a range of features for ensuring General Data Protection Regulation compliance, on April 20.

The public Whois records of affected TLDs will have the name, email, phone and physical address of the registrant omitted, but only if the registrant is an EU resident or uses an EU-based registrar or reseller.

There will be ways to opt-out of this, for registrants who want their information public.

The changes will come into effect first at .af, .cx, .gs, .gy, .ht, .hn, .ki, .kn, .sb, .tl, .kn, .ms and .nf, CoCCA said.

But the registry runs almost 40 gTLDs on its shared infrastructure and has almost 20 more running its software. They’re all pretty small zones, mostly ccTLDs.

CoCCA said that it will give access to private data to law enforcement and members of the Secure Domain Foundation, a DNS reputation service provider.

But trademark owners will get hit in the wallet if they want the same privileges. CoCCA said:

intellectual property owners or other entities who have a legitimate interest in redacted data will be able to order historical abstracts online for a nominal fee (provided they sign an attestation).

While the affected TLDs are probably small enough that the IP lobby won’t be overly concerned today, if CoCCA’s policy becomes more widespread in the industry — which it well could — expect an outcry.