Latest news of the domain name industry

Recent Posts

Registrants guilty until proven innocent, say UK cops

Kevin Murphy, August 19, 2015, Domain Registrars

UK police have stated an eyebrow-raising “guilty until proven innocent” point of view when it comes to domain name registrations, in comments filed recently with ICANN.

In a Governmental Advisory Committee submission (pdf) to a review of the Whois accuracy rules in the Registrar Accreditation Agreement, unspecified “UK law enforcement” wrote:

Internet governance efforts by Industry, most notably the ICANN 2013 RAA agreement have seen a paradigm shift in Industry in the way a domain name is viewed as “suspicious” before being validated as “good” within the 15 day period of review.

UK law enforcement’s view is that a 45 day period would revert Industry back to a culture of viewing domains “good” until they are proven “bad” therefore allowing crime to propagate and increase harm online.

The GAC submission was made August 13 to a public comment period that closed July 3.

The Whois Accuracy Program Specification Review had proposed a number of measures to bring more clarity to registrars under the 2013 RAA.

One such measure, proposed by the registrars, was to change the rules so that registrars have an extra 30 days — 45 instead of 15 — to validate registrants’ contact information before suspending the domain.

That’s what the UK cops — and the GAC as a whole — don’t like.

They have a point, of course. Criminals often register domains with bogus contact information with the expectation that the domains will not have a long shelf life. Fifteen days is actually quite generous if you want to stop phishing attacks, say.

The Anti-Phishing Working Group says phishing attacks have an average up-time of 29 hours.

Clearly, ICANN’s Whois accuracy program is doing little to prevent phishing as it is; a switch to 45 days would presumably have little impact.

But the number of domains suspended for lack of accuracy at any given time is estimated to be in the hundreds of thousands, and registrars say it’s mostly innocent registrants who are affected.

Verisign said this March that .com domains “on hold” grew from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.

In June 2014, registrars claimed that over 800,000 domains had been suspended for want of Whois accuracy in the first six months the policy was in place.

Sharp wants dot-brand Whois requirement relaxed

Electronics firm Sharp wants to remove part of its new gTLD registry contract relating to Whois.

The company has filed a Registry Services Evaluation Process request to get its requirement to offer “searchable Whois” dropped. RSEP is the mechanism registries use to amend their contracts.

ICANN’s initial review has not found any security, stability or competition problems and has now opened the request up for public comment.

Because .sharp will be a dot-brand, all the domains would belong to Sharp and its affiliates, reducing the value of searchable Whois.

Searchable Whois is an enhanced Whois service that allows users to search on all fields (such as registrant, email address, etc) rather than just the domain name.

Such services are not mandatory under ICANN’s new gTLD rules, but applicants that said they would offer them could score an extra point in their Initial Evaluation.

In Sharp’s case, a one-point difference would not have affected the outcome of its IE. In any event, it did not score the extra point.

Sharp said it was requesting the change because it’s switching back-ends from GMO Internet to JPRS, which apparently does not or does not want to support searchable Whois.

Whois privacy supporters to top 20,000

Over 20,000 people have put their names to statements slamming proposals that would ban some commercial web sites from using Whois privacy on their domains.

ICANN’s public comment period on a working group’s Whois privacy reform proposals closes today after two months, with roughly 11,000 individual comments — the vast majority against changes that would weaken privacy rights — already filed.

Separately, Michele Neylon of Blacknight Solutions, which hosts SaveDomainPrivacy.org, tells DI that a petition signed by more than 9,000 people will be submitted to ICANN tonight.

If we count the signatories as commenters, that would make this the largest ICANN comment period to date, outstripping the 14,000 comments received when religious groups objected to the approval of .xxx in 2010.

SaveDomainPrivacy.org and RespectOurPrivacy.org, separate registrar-led initiatives, are responsible for the large majority of comments.

While registrars no doubt have business reasons for objecting to the muddling the Whois privacy market, their letter-writing outreach has been based on their claims that they could be forced to unmask the Whois of vulnerable home-business owners and such.

The Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) report, published in May, sketches out a framework that could allow intellectual property owners to have privacy removed from domains they suspect of hosting infringing content.

A minority position appended to the report by MarkMonitor, Facebook, LegitScript and supported by members of the Intellectual Property and Business Constituencies, would put a blanket ban on using privacy on domains used to commercially transact.

ICANN dragged into Gamergate as Whois reform cast as misogynist threat

Kevin Murphy, July 2, 2015, Domain Policy

What do ICANN’s current Whois privacy reform proposals have to do with the “Gamergate” controversy?

Quite a lot, according to the latest group to slam the proposals as an enabler for “doxing… harassment… swatting… stalking… rape and death threats.”

The Online Abuse Prevention Initiative was formed in March by female software developers in the wake of a sexism slash online abuse scandal that continues to divide the video game community.

Led by Randi Harper, OAPI’s first public move was to today write to ICANN to complain about the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.

The report, as previously reported, contains a minority opinion that would ban transactional e-commerce sites from using Whois privacy services.

OAPI said today that this posed a risk of “doxing” — the practice of publishing the home address and other personal information about someone with the aim to encourage harassment — and “swatting”, where people call up America’s notoriously trigger-happy cops to report violent crimes at their intended victim’s home address.

Harper, who was one of the targets of the Gamergate movement (Google her for examples of the vitriol) claims to have been a victim of both. The OAPI letter says she “was swatted based on information obtained from the WHOIS record for her domain.”

The letter, which is signed by groups including the Electronic Frontier Foundation, the National Network to End Domestic Violence, the National Council of Women’s Organizations, and dozens of noted digital rights voices, says:

We strongly oppose the Working Group’s proposal, which will physically endanger many domain owners and disproportionately impact those who come from marginalized communities. People perceived to be women, nonwhite, or LGBTQ are often targeted for harassment, and such harassment inflicts significant harm

Even the most limited definition of a “website handling online financial transactions for commercial purpose” will encompass a wide population that could be severely harmed by doxing, such as:

  • women indie game developers who sell products through their own online stores
  • freelance journalists and authors who market their work online
  • small business owners who run stores or businesses from their homes
  • activists who take donations to fund their work, especially those living under totalitarian regimes
  • people who share personal stories online to crowdfund medical procedures

To make things worse, the proposed definition of what constitutes “commercial purpose” could be expanded to include other types of activity such as running ads or posting affiliate links.

The letter does not directly refer to Gamergate, but some of the signatories are its most prominent victims and the allusions are clearly there.

Gamergate is described somewhere in its 9,000-word Wikipedia article as “part of a long-running culture war against efforts to diversify the traditionally male video gaming community, particularly targeting outspoken women.”

At its benign end, it was a movement for stronger ethics in video game journalism. At its malignant end, it involved quite a lot of male gamers sending abuse and violent threats to female players and developers.

The PPSAI report is open for comment until July 7. It has so far attracted over 10,000 emails, most of them rustled up by registrar letter-writing campaigns here and here.

Go Daddy advertising privacy petition on Facebook

Go Daddy appears to be putting its money where its mouth is when it comes to arguments about domain privacy.

The company is paying for “sponsored” posts on Facebook that promote the ongoing petition against proposed changes to Whois policy at ICANN.

This has been appearing on Facebook for me all day, seriously interrupting my Farmville time:

Go Daddy ad

Clicking the ad takes you directly to the Save Domain Privacy petition, rather than a Go Daddy sales pitch.

As I reported last week, thousands of internet users have blasted ICANN with template comments complaining about proposed limits on Whois privacy.

There are currently over 10,000 such comments, I estimate, with over a week left until the filing deadline.

Registrars, Go Daddy among them, are largely concerned about a minority proposal emerging from in a proxy/privacy service accreditation working group that would ban transactional e-commerce sites from having private registrations.

They’re also bothered that intellectual property owners could get more rights to unmask privacy users under the proposals.

Despite Go Daddy’s outreach, Repect Our Privacy, letter-writing campaign, backed by NameCheap and the Electronic Frontier Foundation, seems to be responsible for most of the comments filed to date.

Not that it’s necessarily relevant today, but NameCheap and Go Daddy were on opposing sides of the Stop Online Piracy Act debate — a linked controversy — a few years back.

Registrars open floodgate of Whois privacy outrage

Kevin Murphy, June 26, 2015, Domain Policy

A letter-writing campaign orchestrated by the leading domain registrars has resulted in ICANN getting hit with over 8,000 pro-privacy comments in less than a week.

It’s the largest volume of comments received by ICANN on an issue since right-wing Christian activists deluged ICANN with protests about .xxx, back in 2010.

The comments — the vast majority of them unedited template letters — were filed in response to the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.

That report attempts to bring privacy and proxy services, currently unregulated by ICANN, under ICANN’s contractual wing.

There are two problematic areas, as far as the registrars are concerned.

The first is the ability of trademark and copyright owners to, under certain circumstances, have the registrant of a privately registered name unmasked.

Upon receiving such a request, privacy services would have 15 days to obtain a response from their customer. They’d then have to make a call as to whether to reveal their contact information to the IP owner or not.

Possibly the most controversial aspect of this is described here:

Disclosure cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

In other words, the privacy services (in most cases, also the registrar) would be forced make a judgement on whether web site content is illegal, in the absence of a court order, before removing Whois privacy on a domain.

The second problematic area is an “additional statement” on domains used for commercial activity, appended to the PPSAI report, penned by MarkMonitor on behalf of Facebook, LegitScript, DomainTools, IP attorneys Smith, Gambreall & Russell, and itself.

Those companies believe it should be against the rules for anyone who commercially transacts via their web site to use Whois privacy.

Running ads on a blog, say, would be fine. But asking for, for example, credit card details in order to transact would preclude you from using privacy services.

The PPSAI working group didn’t even approach consensus on this topic, and it’s not a formal recommendation in its report.

Regardless, it’s one of the lynchpins of the current registrar letter-writing campaigns.

A page at SaveDomainPrivacy.org — the site backed by dozens of registrars big and small — describes circumstances under which somebody would need privacy even though they engage in e-commerce.

Home-based businesses, shelters for domestic abuse victims that accept donations, and political activists are all offered up as examples.

Visitors to the site are (or were — the site appears to be down right now (UPDATE: it’s back up)) invited to send a comment to ICANN supporting:

The legitimate use of privacy or proxy services to keep personal information private, protect physical safety, and prevent identity theft

The use of privacy services by all, for all legal purposes, regardless of whether the website is “commercial”

That privacy providers should not be forced to reveal my private information without verifiable evidence of wrongdoing

The content of the site was the subject of a sharp disagreement between MarkMonitor and Tucows executives last Saturday during ICANN 53. I’d tell you exactly what was said, but the recording of the relevant part of the GNSO Saturday session has not yet been published by ICANN.

Another site, which seems to be responsible for the majority of the 8,000+ comments received this week, is backed by the registrar NameCheap and the digital civil rights groups the Electronic Frontier Foundation and Fight For The Future.

NameCheap appears to be trying to build on the reputation it started to create for itself when it opposed the Stop Online Piracy Act a few years ago, going to so far as to link the Whois privacy reforms to SOPA on the campaign web site, which says:

Your privacy provider could be forced to publish your contact data in WHOIS or even give it out to anyone who complains about your website, without due process. Why should a small business owner have to publicize her home address just to have a website?

We think your privacy should be protected, regardless of whether your website is personal or commercial, and your confidential info should not be revealed without due process. If you agree, it’s time to tell ICANN.

The EFF’s involvement seems to have grabbed the attention of many reporters in the general tech press, generating dozens of headlines this week.

The public comment period on the PPSAI initial report ends July 7.

If it continues to attract attention, it could wind up being ICANN’s most-subscribed comment period ever.

Do geeks care about privacy more than Christians care about porn? We’ll find out in a week and a half.

Group uses FOI to demand entire .nyc Whois database

Former .nyc hopeful Connecting.nyc has requested a dump of the entire .nyc Whois database using freedom of information legislation.

According to a blog post, the group has filed a request under the New York Freedom of Information Law for all 75,000 Whois records.

Connecting.nyc says it wants the data in order to plot every .nyc registrant on a map of the city to see “if the name purchasers were spread evenly over the city or concentrated in a particular neighborhood or borough. And if they were from a particular social or economic strata.”

It says it has spent 10 weeks asking for the data via email but has been rebuffed.

Under ICANN Registry Agreements, registries are under no obligation to offer bulk Whois access. Registrars are supposed to allow it under their accreditation agreements, but are allowed to charge huge sums.

The .nyc space does not allow private registrations. Its Whois data is all publicly accessible and could conceivably be mined via sequential queries.

The new gTLD is managed by Neustar but assigned to the City of New York, making it essentially government-owned.

It will be interesting to see whether Whois access falls under FOI law. Many other geographic gTLDs have government links and may fall under their own respective FOI legislation.

Connecting.nyc once intended to apply for .nyc itself, but is now a sort of self-appointed community watchdog for the gTLD. It’s an At-Large structure within ICANN.

Whois privacy reforms incoming

Kevin Murphy, May 6, 2015, Domain Policy

Whois privacy services will become regulated by ICANN under proposals published today, but there’s a big disagreement about whether all companies should be allowed to use them.

A working group has released the first draft of its recommendations covering privacy and proxy services, which mask the identity and contact details of domain registrants.

The report says that P/P services should be accredited by ICANN much like registrars are today.

Registrars should be obliged to disclose which such services they operate or are affilated with, presumably at the risk of their Registrar Accreditation Agreement if they do not comply, the report recommends.

A highlight of the paper is a set of proposed rules governing the release of private Whois data when it is requested by intellectual property interests.

Under the proposed rules, privacy services would not be allowed to reject such requests purely because the alleged infringement deals with the content of a web site rather than just the domain.

So the identity of a private registrant of a non-infringing domain would be vulnerable to disclosure if, for example, the domain hosted bootleg content.

Registrars would be able to charge IP owners a nominal “cost recovery” fee in order to process requests and would be able to ignore spammy automated requests that did not appear to have been manually vetted.

There’d be a new arbitration process that would kick in to resolve disputes between IP interests and P/P service providers.

The 98 pages of recommendations (pdf) were drafted by the Generic Names Supporting Organization’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) and opened for public comment today.

There are a lot of gaps in the report. Work, it seems, still needs to be done.

For example, it acknowledges that the working group didn’t reach any conclusions about what should happen when law enforcement agencies ask for private data.

The group was dominated by registrars and IP interests. There was only one LEA representative and only one governmental representative, and they participated in a very small number of teleconferences.

There was also a sharp division on the issue of who should be able to use privacy services, with two dissenting opinions attached to the report.

One faction, led by MarkMonitor and including Facebook, Domain Tools and fake pharmacy watchdog LegitScript, said that any company that engages in e-commerce transactions should be ineligible for privacy, saying: “Transparent information helps prevent malicious activity”.

Another group, comprising a handful of non-commercial stakeholders, said that no kind of activity should prevent you from registering a domain privately, pointing to the example of persecuted political groups using web sites to raise funds.

There was a general consensus, however, than merely being a commercial entity should not alone exclude you from using a P/P service.

Currently, registrar signatories to the 2013 RAA are bound by a temporary P/P policy that is set to expire January 2017 or whenever the P/P accreditation process starts.

There are a lot of recommendations in the report, and I’ve only touched on a handful here. The public comment period closes July 7.

Verisign adds 750,000 .com names instantly with reporting change

Kevin Murphy, March 23, 2015, Domain Registries

Verisign has boosted its reportable .com domain count by almost 750,000 by starting to count expired and suspended names.

The change in methodology, which is a by-product of ICANN’s much more stringent Whois accuracy regime, happened on Friday afternoon.

Before the change, the company reported on its web site that there were 116,788,107 domains in the .com zone file, with another 167,788 names that were registered but not configured.

That’s a total of 116,955,895 domains.

But just a few hours later, the same web page said .com had a total of 117,704,800 names in its “Domain Name Base”.

That’s a leap of 748,905 pretty much instantly; the number of names in the zone file did not move.

.net jumped 111,110 names to 15,143,356.

The reason for the sudden spikes is that Verisign is now including two types of domain in its count that it did not previously. The web page states:

Beginning with the first quarter, 2015, the domain name base on this website and in subsequent filings found in the Investor Relations site includes domains that are in a client or server hold status.

I suspect that the bulk of the 750,000 newly reported names are on clientHold status, which I believe is used much more often than serverHold.

The clientHold EPP code is often applied by registrars to domains that have expired.

However, registrars signed up to the year-old 2013 Registrar Accreditation Agreement are obliged by ICANN to place domains on clientHold status if registrants fail to respond within 15 days to a Whois verification email.

The 2013 RAA reads (my emphasis):

Upon the occurrence of a Registered Name Holder’s willful provision of inaccurate or unreliable WHOIS information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen (15) calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the Registered Name Holder’s registration, Registrar shall either terminate or suspend the Registered Name Holder’s Registered Name or place such registration on clientHold and clientTransferProhibited, until such time as Registrar has validated the information provided by the Registered Name Holder.

Last June, registrars claimed that the new policy — which came after pressure from law enforcement — had resulted in over 800,000 domains being suspended.

It’s an ongoing point of contention between ICANN, its registrars, and cops.

Verisign changing its reporting methodology may well be a reaction to this increase in the number of clientHold domains.

While its top-line figure has taken a sharp one-off boost, it will still permit daily apples-to-apples comparisons on an ongoing basis.

UPDATE:

My assumption about the link to the 2013 RAA was correct.

Verisign CFO George Kilguss told analysts on February 5.

Over the last several years, the average amount of names in the on-hold status category has been approximately 400,000 names and the net change year-over-year has been very small.

While still immaterial, during 2014, we saw an increase in the amount of names registrars have placed on hold status, which appears to be a result of these registrars complying with the new mandated compliance mechanisms in ICANN’s 2013 Registrar Accreditation Agreement or RAA.

In 2014, we saw an increase in domain names placed on hold status from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.

Google leaks 282,000 private Whois records

Kevin Murphy, March 13, 2015, Domain Registrars

Google has accidentally revealed registrant contact information for 282,867 domain names that were supposed to be protected by a privacy service.

The bug reportedly affected 94% of the 305,925 domains registered via Google Apps, an eNom reseller.

The glitch was discovered by Cisco and reported to Google February 19. It has since been fixed and customers were notified yesterday.

Google acknowledged in an email to customers that the problem was caused by a “software defect in the Google Apps domain renewal system”.

It seems that anyone who acquired a domain with privacy through Google Apps since mid-2013 and has since renewed the registration will have had their identities unmasked in Whois upon renewal.

Names, addresses, emails and phone numbers were revealed.

Due to services such as DomainTools, which cache Whois records, there’s no putting the genie back in the bottle. The information is out there for good now.

It’s a pretty major embarrassment for Google, which recently launched its own registrar.