Cops get special Whois access rights

Law enforcement agencies will be able to get access to private Whois records in under 24 hours under ICANN policy introduced yesterday, but the powers are toothless for now.

ICANN has updated its Registration Data Policy to add a section handling “urgent requests” for Whois data, normally redacted in the public RDAP databases due to privacy laws and ICANN policy.

Normally, registrars have as much as 30 days to respond to disclosure requests, but they will only have 24 hours when the request relates to “circumstances that pose an imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation in cases where disclosure of the data is necessary in combatting or addressing this threat”.

Because it’s a formal Consensus Policy, it’s already binding on all contracted parties.

But it’s currently pretty useless. The policy only requires the fast disclosure when the requestor is an “authenticated” law enforcement agency, and as of today ICANN has no mechanism to authenticate LEAs.

Figuring out how to authenticate requestors has been under discussion privately in the Governmental Advisory Committee’s Public Safety Working Group for some time, with ideas about domain-based authentication being floated.

But it seems the real work will be carried out by the GNSO Council’s forthcoming Supplementation Recommendations on the EPDP Phase 2 working group, which will be tasked with revisiting earlier, subsequently rejected, work on Whois access.

The pencilled-in deadline for that working group to reach recommendations is January 2027, a lot faster (but critics say less democratic) than a full-blown Policy Development Process, which would take years.

2026 new gTLD round has actually opened

As of today, you can now apply to own a piece of the internet’s root zone for the first time since 2012.

Almost unbelievably, given some of its relatively recent history, ICANN has hit its deadline and opened up its systems for companies and organizations to file applications for new gTLDs.

The application window opened late April 30 and will close August 12. Many applicants will have been working on their bids for some time, but may hold out until later in the window to actually commit.

ICANN CEO Kurt Lindqvist said in a press release: “Whether building a brand for a company, spotlighting a geographic region or city, strengthening a community, or launching a business to offer domain names under a new registry, a new gTLD can be an innovative tool for commerce, security, and communication.”

ICANN noted that it’s expecting to receive applications for gTLDs in non-Latin scripts — 27 are available — to broaden the linguistic diversity of the DNS. Whether the Org has done enough awareness-raising outreach in non-Anglophone regions is an open question, however.

The cost of applying begins at $227,000. That’s the base application fee, but it will likely often be bumped up by thousands for applicants that need special extra evaluation services.

There’s also going to be an auction of last resort for competing applications for the same strings, where ICANN pockets the proceeds. Unlike the 2012 round, there’s no ICANN-endorsed pathway to privately resolving contention sets for cash.

As many as 75 organizations around the world may have qualified for the Applicant Support Program, which will subsidize application fees by as much as 80%.

We won’t know who has applied for what until probably around mid-October. Applicants then get two weeks to change their strings to their back-ups if they find themselves in unwelcome contention sets. Final strings are confirmed in November.

That’s all assuming the 2026 room is more or less the same size as the 2012 round, in which there were 1,930 applications. A larger batch of applications may delay things a little.

Applications can be filed via ICANN’s new TLD Application Management System (TAMS). The Org has also made a great number of documents and archived webinars available that talk prospective applicants through the process.

Applicants, or simply the curious, can also use DI’s free Stringtel tool to investigate the risks and opportunities associated with their chosen gTLD strings.

.io safe for now as Trump puts Chagos deal on ice

The uncertainty surrounding the future of .io domains is set to continue after the UK government froze its plans to cede sovereignty of the Chagos Islands due to lack of US support.

The UK has run out of time to pass legislation approving the treaty that would give Chagos to Mauritius in the current parliamentary session, which ends about a month from now.

It is reported that there are no plans to make a successor bill part of the King’s Speech — in which the government sets out its legislative agenda for the next session — on May 13.

The delay is believed to have come because the Trump administration, which has been blowing hot and cold on the issue since it came into power last year, has so far withheld its formal written consent.

That’s necessary for the treaty to pass because the largest of the Chagos archipelago, Diego Garcia, is home to a US-UK military base strategically important for American bombing raids in the Middle East.

Chagos, officially the British Indian Ocean Territory, owns the ccTLD .io, popular among tech startups. It’s managed by a UK-based Identity Digital subsidiary that makes over $40 million a year from registrations.

The UK’s decision to cede control of BIOT, following international human rights rulings, raised the spectre of .io ultimately being replaced or retired under ICANN’s rules governing ccTLDs.

While UK ministers have denied over the weekend that the Chagos deal is fully dead, its future seems to be dependent on Donald Trump, or his successor, changing the US position on the treaty.

WIPO doubles the speed of UDRP cases

The World Intellectual Property Organization has introduced a new, more expensive tier of its UDRP service that can effectively halve the time each case takes to about 30 days.

WIPO said last month that it now offers an “expedited case processing” option, which reduces the time from filing to decision to one month, under certain circumstances, compared to the usual roughly 60 days.

The new option only applies to cases involving one to five domains registered to the same registrant, decided by a single-member UDRP panel, and relies upon third parties such as registrars sticking to their timing obligations under the policy.

The option costs complainants $4,000, compared to the usual $1,500. WIPO’s cut doubles from $500 to $1,000, with the remainder going to the panelist. Registrants are also able to request an expedited process for a cost of $2,500.

Because WIPO cannot unilaterally change the UDRP, registrants still get the standard 20 days to respond when their domains are targeted. They also still get to pay to demand a three-person panel, which effectively counteracts the expedited timeline.

The option means that UDRP could now only be a week or so slower than the Uniform Rapid Suspension service, for those trademark owners willing to pay the higher fee.

WIPO said that the expedited service will be managed by a dedicated team and a “special roster of panelists”, which may or may not turn out to be important depending on which panelists are selected for this limited pool.

ICANN to throw millions more at cheapo gTLDs

ICANN wants to increase the number of new gTLD applications it will subsidize from its own coffers, as well as the size of the discounts it will provide.

The Applicant Support Program was originally budgeted at $10 million, with half coming from application fees and half coming from the proceeds of auctions from the 2012 application round.

The plan was to offer up to 45 qualifying applicants a 75% discount on their application fees, along with a collection of other perks such as hookups with pro-bono consultants.

But it turns out the ASP was oversubscribed — there are currently 75 organizations vying for the discount, and ICANN seems to suspect most or all will be found eligible for support.

About a month ago, after public comment, the ICANN board of directors requisitioned an extra $4.9 million from the auction proceeds war chest to cover the extra subsidies.

But the Governmental Advisory Committee and At-Large Advisory Committee have both recently recommended that ICANN increases the discount to 85% — about $192,500 of the $227,000 base evaluation fee.

So now the board wants to know if the community is cool with it dipping into the auction proceeds to cover the difference to the tune of an extra $3.2 million.

It’s asking for feedback via correspondence, outside of the usual more formal public comment process, by April 12.

ICANN hit with tinfoil-hat lawsuit

ICANN has been sued by a Louisiana woman who thinks the Org is surveilling her.

Wendy Renee’ Carlton (sic) filed a bizarre lawsuit last month claiming she “has experienced persistent and patterned interference affecting her cognitive processes, bodily integrity, and personal autonomy”.

Google, Microsoft, Wal-Mart and some John Does are also listed as defendants.

It’s difficult to describe the complaint (pdf), but here’s a chunk of it for flavor:

Plaintiff alleges that she has experienced persistent and patterned interference affecting her cognitive processes, bodily integrity, and personal autonomy, and that such interference is systemic in nature.

Plaintiff alleges that Defendants’ conduct resulted in the exploitation or misuse of her personal data and behavioral patterns, restricting her liberty interests and decision-making autonomy without notice, consent, or lawful authorization.

Plaintiff further alleges that Defendants collected, processed, analyzed, and/or derived her biometric, anatomical, and/or cognitive data through technological, commercial, and/or institutional frameworks without informed consent or procedural safeguards.

Plaintiff alleges that she experienced persistent surveillance, monitoring, and identity interference resulting in observable physical, cognitive, and biometric effects, including involuntary physiological responses and interference with normal bodily functions, consistent with assessment- or monitoring-based activity.

Carlton’s probably not far off — Google’s whole empire is based on mass surveillance after all — but it’s difficult to see what roles ICANN or Wal-Mart have in that enterprise.

The complaint doesn’t get into any factual specifics of what ICANN or any other defendant is supposed to have done, or what the effects on the complainant were.

ICANN has filed a motion to dismiss, claiming lack of jurisdiction and failure to state a claim.

ICANN boss: no plans to scrap Oman meeting

ICANN currently has no plans to cancel its 2026 Annual General Meeting, which is due to take place in Muscat, Oman, later this year, according to CEO Kurt Lindqvist.

Speaking at the public forum at ICANN 85 in Mumbai today, Lindqvist responded to a speaker who expressed concerns about the ongoing US-Israel war against Iran, which has seen Iran retaliate against neighbors including Oman.

“We’re obviously aware of the situation, and we’re monitoring it. The Oman meeting is 7 months out, so it’s still quite a long time to go, and a lot of things can change. So, at the moment, we are planning for this to go ahead,” he said.

The Muscat meeting was originally planned for October last year, but was called off due to Israel’s attacks on Iran in June, which affected flight corridors in the region.

Lindqvist added that ICANN always has contingency plans in case a venue becomes inappropriate. Last year, the Muscat meeting was rescheduled to Dublin, Ireland.

It seems likely that if the hostilities in the Middle East have not calmed down by June, ICANN could well pull the plug on Muscat for a second year, giving meeting participants about four months to plan their travel.

Previously, ICANN has relocated meetings due to be held in Puerto Rico and Panama due to hurricane damage and the Zika virus, and several were held entirely online during the Covid-19 pandemic.

ICANN maps out new gTLD timeline

ICANN’s 85th public meeting kicked off in Mumbai at the weekend, the last community face-to-face before the next round of new gTLDs kicks off, and the Org took the time to spell out exactly what is expected to happen and when.

Surprisingly, given ICANN’s track record, it will hit its target of April 2026 to open the doors to applications. Unsurprisingly, given ICANN’s track record, it’s picked April 30 — the last possible day of its promised window — to do so.

The application window will remain open for 104 days. Applicants will have until August 12 to file their paperwork. It doesn’t matter when they hit submit; it’s not first-come, first-served.

Then, the process goes into quiet mode for at least two months while ICANN filters through the applications. If there’s about the same number of applications at the 2012 round — about 2,000 — ICANN reckons Reveal Day could come before ICANN 87, which begins in Muscat October 17.

So far, the timeline closely follows the 2012 round, but this time there’s a new wrinkle — applicants can change their gTLD strings to preselected “replacement strings” if they want to.

From Reveal Day, they’ll have 14 days to swap their strings if, for example, they find themselves in a contention set they don’t like the look of or if they get the vibe that they’re probably face objections.

After those two weeks are up, its String Confirmation day, expected some time in November. From that moment, the applicants are locked into their string of choice.

That’s also the day when the timer starts on the objections period, 104 days in which companies and organizations can object to applications based on criteria such as intellectual property rights, the public interest, and community rights.

Governments can also object on essentially any basis, as long as it’s well-articulated. Unilateral GAC Early Warnings are available, but a full consensus of the Governmental Advisory Committee would be needed to stand a chance at nuking an application outright.

The objection period should end some time next February. While that’s going on, some time in December, ICANN will conduct the Prioritization Draw, a lottery to decide the order in which applications will be processed.

The 2012 draw was important because the gTLDs that were first out of the traps had a measurable first-mover advantage in terms of speculative registrations. With hundreds of gTLDs now on the market, I believe it will be less important this time around.

After the draw, applicants will have to wait half a year before they are finally notified which contention sets, if any, they fit into, after the results of the String Similarity Review have been published.

ICANN has yet to select the panel for this review or create its detailed guidelines, but it’s expect to name it chosen vendor some time in Q2.

War disrupts ICANN 85

It seems a bit tasteless to whine about disrupted flights when the Middle-East is erupting into war; nevertheless, that’s the immediate issue facing would-be attendees at this week’s public ICANN meeting.

ICANN 85 is taking place at the Jio World Convention Centre in Mumbai, India from this coming weekend.

While Mumbai is over 2,000km from Tehran, Iran has been attacking many neighbouring nations in retaliation for the ongoing US-Israeli bombardment, which has resulted in the closure of several airports as missiles, drones and fighter planes invade their airspace.

Some ICANN travellers, mainly those traveling west-to-east, will find that hub airports in Dubai or Bahrain are in their connections itinerary. Those flying Emirates will be particularly affected.

ICANN said in a statement at the weekend that 85 “will proceed as planned” and that would-be attendees feeling uncomfortable traveling can take advantage of online participation if they prefer.

The Org and its travel agent are together responsible for funding and arranging the travel of hundreds of participants, and ICANN said they were working to route travellers around the affected airspace.

Two former ICANN directors want back in

Gluttons for punishment? ICANN’s At-Large Community has named the first four candidates standing to join the Org’s board of directors, and two of them have form.

Sébastien Bachollet, Justine Chew, Maureen Hilyard and Lito Ibarra have all put themselves forward to replace term-limited León Sánchez, who is due to leave seat 15 of ICANN’s board in October after nine years’ service.

Bachollet and Ibarra are both former ICANN directors. Bachollet served as an At-Large appointee for four years from 2010. Ibarra served six years as a Nominating Committee appointee from 2015.

France-based Bachollet is the former chair of EURALO, the Regional At-Large Organization for Europe, and a former director of Afnic, the French ccTLD registry.

Malaysia-based lawyer Chew has extensive experience both on the At-Large Advisory Committee and the GNSO, as ALAC Liaison, and policy-making groups. She also has sat on the boards of Malaysian non-profits.

Hilyard, from the Cook Islands, is a former ALAC chair who has held senior board or advisory positions with Public Interest Registry and DotAsia and ISOC. The NGO she leads, the Cook Islands Internet Action Group, plans to apply for a new gTLD this year.

Ibarra has been in charge of the El Salvador ccTLD registry for over 30 years and has been inducted into the Internet Hall of Fame. He has sat on the boards of LACNIC and LACTLD.

At-Large has a complex structure and its electoral system reflects that, but essentially the nominees were self-selected and confirmed by a committee. The ALAC will vote with a view to announcing the successful candidate before April 22.