Comments (16)

1. Project dotVinum says:

   May 9, 2013 at 8:57 am

   There is a “relevant regulatory body” for the wine industry, it is the OIV (www.oiv.int) but unfortunately it is too late. ICANN should have considered this earlier in its applicant guidebook.
   Also agree all generic strings cannot have a regulatory body.

   Reply
2. steve machin says:

   May 9, 2013 at 9:53 am

   We plan to run a similarly high-security domain as artemis and applaud the stance that Alex and the .secure folks are taking for their particular string.
   Clearly that approach does not suit all business models and all sectors, however if the registry has a plan to keep a name clean and it can work out how to do that in a commercially viable fashion, and the registrants are also happy to sign up to the license agreement then why not?

   Reply
   • Kevin Murphy says:

     May 9, 2013 at 12:28 pm

     Isn’t it a bit worrying that the GAC, with its apparent focus on security, didn’t put .secure or .security on its list?

     Reply
     • steve machin says:

       May 9, 2013 at 5:10 pm

       the inconsistencies are astonishing, as you have just pointed out in a great follow up post. some of the sentiment behind the advice is well intentioned, i just think the execution of the advice is appalling. I agree with you that it MUST have been rushed.. despite the ocean of (extended) time allowed

       Reply
       • Rubens Kuhl says:

         May 9, 2013 at 5:19 pm

         GAC only works during the meetings, not between meetings. The industry thinks 24×7 about the program. This mismatch is one of the issues GAC needs to address. I’ve already suggested privately they could mimic UN security council and have one country from each ICANN region as a full-time body. Unless they do something towards being more Internet-time, these issues will repeat themselves.

         Reply
         • Alex Stamos says:

           May 9, 2013 at 6:53 pm

           This seems like a serious issue, especially now that Durban is going to be such an important meeting for the gTLD program. The GAC should really publish this kind of communique a week or two before an ICANN meeting, otherwise the GNSO, RySG, RrSG, NTAG and others are all talking (or yelling) about issues that could be completely mooted by the GAC.

     • Alex Stamos says:

       May 9, 2013 at 6:39 pm

       It *is* strange that .secure and .security were not on the list. According to a GAC member we asked about this, both of those domains were actually included in early drafts of the communiqué, but in the frantic last minutes of merging and negotiating those (and several others) were lost. This GAC member reinforced that this list is *not* comprehensive and will probably expand by Durban.
       As for sucking up, I think that is a really unfair characterization. I am not a domain person; I have spent my entire career in information security, dealing with real problems for real people. The unfortunate truth is that the level of trust and safety on the Internet is so abysmal that almost no normal consumer can use it safely. Every time Average Joe or Jane buys something from their mobile device, logs into their retirement account from a coffee shop, or even browses random sites, they are safe only because they are not being targeted at that exact moment.
       The domain industry plays a small but significant role in this problem, especially with the “race to the bottom” in the registrar space. I refuse to accept that pushing for a short-term best interest, namely not allowing the GAC to slow down delegation, outweighs the long-term interest in making the Internet a more viable mechanism for commerce and communication. That is what motivated our response.

       Reply
3. JS says:

   May 9, 2013 at 1:09 pm

   I don’t understand the “top-down” argument. The GAC has been in the picture since the inception of the program. Everyone knew that the GAC could shoot down any application at will (almost).

   Reply
   • Kevin Murphy says:

     May 9, 2013 at 1:19 pm

     If it had done so, the argument would fail. But it didn’t, it decided it wanted to impose an arbitrary regulatory environment instead.

     Reply
   • Jean Guillon says:

     May 9, 2013 at 1:21 pm

     We yet have not seen if they can shoot down an application. The ICANN new gTLD program is always full of surprises anyway.
     I think applicants knew about the power of the GAC but they did not know how far it could go.
     A lesson learnt for round 2.

     Reply
     • Rubens Kuhl says:

       May 9, 2013 at 4:56 pm

       Because of .xxx most applicants underestimated GAC. We are now overestimating GAC, and the results of round 1 will provide a balanced view of what GAC can do; not as unimportant as once thought, not as important as now people think.

       Reply
4. Jean Guillon says:

   May 9, 2013 at 5:17 pm

   Agree!
   If .XXX passed the test, all other TLDs can pass the test easily.
   Well…apparently, not.

   Reply
5. zack says:

   May 9, 2013 at 7:51 pm

   “it would be inappropriate, and impossible, to find a “relevant regulatory body” with whom to establish a relationship related to the use of .ENGINEER.”
   While I might agree with that statement. This is not the first time this subject has been raised. Everyone should be reminded of the language in the application itself in the Notes to Question 30a:
   “Criterion 5 calls for security levels to be
   appropriate for the use and level of trust
   associated with the TLD string, such as, for
   example, financial services oriented TLDs.
   “Financial services” are activities performed
   by financial institutions, including: 1) the
   acceptance of deposits and other repayable
   funds; 2) lending; 3) payment and
   remittance services; 4) insurance or
   reinsurance services; 5) brokerage services;
   6) investment services and activities; 7)
   financial leasing; 8) issuance of guarantees
   and commitments; 9) provision of financial
   advice; 10) portfolio management and
   advice; or 11) acting as a financial
   clearinghouse. Financial services is used as
   an example only; other strings with
   exceptional potential to cause harm to
   consumers would also be expected to
   deploy appropriate levels of security.”
   I don’t think the GAC is not saying something new – it appears they already had a very similar statement included in the Guidebook. What I think is ludicrous is that for many strings there is no common body or regulatory authority to define “appropriate levels of security”.
   Perhaps we can ask the technical panels how they passed certain strings and use that criteria to help establish some sort of baseline?

   Reply
   • Kevin Murphy says:

     May 9, 2013 at 8:39 pm

     You raise an interesting point.
     My understanding of the Guidebook is that Question 30 relates to security measures in place *at the registry*.
     The GAC advice, on the other hand, asks registries to look at the security measures in place *at the registrants*.
     It’s true that some applicants — fTLD’s .bank for example — want to impose some security requirements on registrants (see bullet 29 at http://www.ftld.com/SSWGtoICANN.pdf).
     fTLD seems to be asking for registrants to use transport-layer security (eg SSL), whereas the GAC advice (vague as it is) seems to want more.
     It looks like the GAC wants .art registrants, for example, to implement greater security measures than fTLD has proposed for its own limited number of future .bank customers.

     Reply
     • Rubens Kuhl says:

       May 10, 2013 at 10:02 am

       Artemis .secure also has registrant-side security requirements, stricter than .bank.
       Q30 is indeed about Information Security at the registry, not about eligibility requirements, content enforcement, registrant behavior, or transforming the DNS Industry into World Police.

       Reply
6. Zack says:

   May 10, 2013 at 4:01 am

   You give the GAC too much credit here by assuming they know the difference. I think they assumed that 30a had broader implications.

   Reply