IRP panel tells ICANN to stop being so secretive, again

ICANN’s dismal record of adverse Independent Review Process decisions continued last week, with a panel of arbitrators telling the Org to shape up its transparency and decision-making processes.

The panel has essentially ruled that ICANN did everything it could to be a secretive as possible when it decided to remove price controls from its .org and .info registry contracts in 2019.

This violated its bylaws commitments to transparency, the IRP panel found, at the end of a legal campaign by Namecheap commenced over three years ago.

Namecheap wanted the agreements with the two registries “annulled”, but the panel did not go that far, instead merely recommending that ICANN review its decision and possibly enter talks to put the price caps back.

But the decision contains some scathing criticisms of ICANN’s practice of operating without sufficient public scrutiny.

Namecheap had argued that ICANN broke its bylaws by not only not applying its policies in a non-discriminatory manner, but also by failing to adequately consult with the community and explain its decision-making.

The registrar failed on the first count, with the IRP panel ruling that ICANN had treated registry contract renegotiations consistently over the last 10 years — basically trying to push legacy gTLDs onto the 2012-round base Registry Agreement.

But Namecheap succeeded on the second count.

The panel ruled that ICANN overused attorney-client privilege to avoid scrutiny, failed to explain why it ignored thousands of negative public comments, and let the Org make the price cap decision to avoid the transparency obligations of a board vote.

Notably, the panel unanimously found that: “ICANN appears to be overusing the attorney-client privilege to shield its internal communications and deliberations.”

As one example, senior staffers would copy in the legal team on internal communications about the price cap decision in order to trigger privilege, meaning the messages could not be disclosed in future, the decision says.

ICANN created “numerous documents” about the thinking that went in to the price cap decision, but disclosed “almost none” of them to the IRP due to its “overly aggressive” assertion of privilege, the panel says.

As another example, staffers discussed cutting back ICANN’s explanation of price caps when it opened the subject to public comment, in order to not give too much attention to what they feared was a “hot” and “sensitive” topic.

ICANN’s failure to provide an open and transparent explanation of its reasons for rejecting public comments opposing the removal of price controls was exacerbated by ICANN’s assertion of attorney-client privilege with respect to most of the documents evidencing ICANN’s deliberations…

ICANN provided a fairly detailed summary of the key concerns about removing price caps, but then failed to explain why ICANN decided to remove price caps despite those concerns. Instead, ICANN essentially repeated the explanation it gave before receiving the public comments.

The panel, which found similar criticisms in the earlier IRP of Dot Registry v ICANN, nevertheless decided against instructing ICANN to check its privilege (to coin a phrase) in future, so the Org will presumably be free to carry on being as secretive as normal in future.

Namecheap also claimed that ICANN deliberately avoided scrutiny by allowing Org to remove the price caps without a formal board of directors resolution, and the panel agreed.

The Panel finds that of the removal of price controls for .ORG, .INFO, and .BIZ was not a routine matter of “day-to-day operations,” as ICANN has asserted. The Price Cap Decision was a policy matter that required Board action.

The panel notes that prior to the renewal of .org, .info and .biz in 2019, all other legacy gTLD contracts that had been renewed — including .pro, which also removed price caps — had been subject to a board vote.

“ICANN’s action transitioning a legacy gTLD, especially one of the three original gTLDs (.ORG), pursuant to staff action without a Board resolution was unprecedented,” the panel writes.

Quite why the board never made a formal resolution on the .org contract is a bit of a mystery, even to the IRP panel, which cites lots of evidence that ICANN Org was expecting the deal to go before the board as late as May 13, 2019, a month before the anticipated board vote.

The .org contract was ultimately signed June 30, without a formal board resolution.

(Probably just a coincidence, but Ethos Capital — which went on unsuccessfully to try to acquire .org registry Public Interest Registry from ISOC later that year — was formed May 14, 2019.)

The IRP panel notes that by avoiding a formal board vote, ICANN avoided the associated transparency requirements such as a published rationale and meeting minutes.

The panel in conclusion issued a series of “recommendations” to ICANN.

It says the ICANN board should “analyze and discuss what steps to take to remedy both the specific violations found by the Panel, and to improve its overall decisionmaking process to ensure that similar violations do not occur in the future”.

The board “should consider creating and implementing a process to conduct further analysis of whether including price caps in the Registry Agreements for .ORG and .INFO is in the global public interest”

Part of that process should involve an independent expert report into whether price caps are appropriate in .info and especially .org.

If it concludes that price controls are good, ICANN should try to amend the two registry agreements to restore the caps. If it does not conduct the study, it should ask the two registries if they want to voluntarily restore them.

Finally, the panel wrote:

the Panel recommends that the Board consider revisions to ICANN’s decision-making process to reduce the risk of similar procedural violations in the future. For example, the Board could adopt guidelines for determining what decisions involve policy matters for the Board to decide, or what are the issues on which public comments should be obtained.

ICANN is on the hook to pay the panel’s fees of $841,894.76.

ICANN said in a statement that it is “is in the process of reviewing and evaluating” the decision and that the board “will consider the final declaration as soon as feasible”.

UDRPs up in 2022, firm says

The World Intellectual Property Organization saw an increase in cybersquatting disputes this year, according to WIPO data compiled by VPN maker AtlasVPN.

There were 5,616 UDRP complaints filed with WIPO, up almost 10% from 2021, the company said.

The report does not appear to include data from the several other UDRP providers, so may not reflect the state of the system as a whole.

WIPO has processed 61,284 UDRP cases since the system was founded over two decades ago, the company said.

More details on ICANN’s CEO handover

ICANN has published more information on its change of CEO, which saw Göran Marby’s shock resignation last week.

Interim CEO Sally Costerton has been employed on an automatically renewing six-month contract that will only end if she quits, is fired, or a permanent replacement is found.

The ICANN board of directors has approved a “monthly stipend”, a bonus payment while she holds the interim position, but the amount, based on advice from compensation consultancy Willis Towers Watson, was not disclosed.

In fact, Costerton’s salary has never been disclosed in the decade she has worked for the Org. It is assumed that she is paid via the UK-based company she set up with her husband around the same time she was hired by ICANN.

That company, Sally Costerton Advisory Ltd, had about £1.3 million ($1.6 million) in net assets as of March, company records, which include no income statement, show. ICANN’s tax returns, which report executive salaries, do not reflect any payments to the company.

The board’s resolutions also confirm that Marby, who will stay as a consultant until May 2024, has will have his contract renegotiated, but the terms were redacted.

Merry Christmas! Marby finally out as ICANN CEO

Göran Marby has “resigned” as the CEO of ICANN.

Chair Tripti Sinha informed staff of his departure last night, saying Marby had been working with the board “over the past few days” to ensure a “smooth transition” that will see him stay on the payroll as a consultant until May 23, 2024.

That’s the date his employment contract was due to expire anyway. There’s no word yet on whether his eye-watering salary will be reduced.

Sinha herself is a new installation, taking over after the board ousted Maarten Botterman a few months ago.

Sally Costerton, senior vice president of global stakeholder engagement, has taken over on an interim basis, while ICANN recruits a successor, but she has an added bonus of being likable and one assumes she’s a leading candidate to take over on a permanent basis.

Costerton, a British former PR professional, has been itching for the gig for over a decade, first applying after Rod Beckstrom quit in 2012 and immediately brought into the senior ranks by Fadi Chehadé, who hired both of his unsuccessful fellow short-listers.

A CEO with a background in public relations in theory is good news for ICANN transparency. The Org has been criticized for ignoring the media and other transparency obligations under its current leadership.

Marby’s achievements in his six and a half years as CEO include being the first person to persuade the board to pay him over a million dollars a year and

Abuse crackdown likely in next gTLD registrar contract

ICANN and its accredited registries and registrars have formally kicked off contract renegotiations designed to better tackle DNS abuse.

The aim is to create a “baseline obligation” for contracted parties to “take reasonable and appropriate action to mitigate or disrupt malicious registrations engaged in DNS Abuse”, according to recent correspondence.

This may close the loophole in the contracts identified this year that hinder ICANN Compliance’s ability to take action against registrars that turn a blind eye to abuse.

The current contracts require registrars to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse”, which lacks clarity because there’s no agreement on what an appropriate response is.

The registries and registrars stakeholder groups (RySG and RrSG) note that there won’t be an expansion of the term “DNS abuse” to expand into web site content, nor will the talks cover Whois policy.

As is the norm for contract negotiations, they’ll be bilateral between ICANN and a select group of representative contracted parties, and conducted in private.

Talks are expected to take three to six months and the resulting amendments to the Registrar Accreditation Agreement and base Registry Agreement will be published for 30 days of public comment.

It’s been almost 10 years since the RAA was last updated.

ICANN expects to approve Whois Disclosure System next month

ICANN could be offering a centralized system for requesting private domain registration data as early as a year from now, a mere five and a half years after GDPR ruined the global Whois system for many.

The Org recently alluded to its “board’s anticipated January 2023 vote to move forward in implementing the new system to streamline the intake and routing of requests for access to nonpublic gTLD registration data” in a blog post.

It has previously stated that it will take nine months to develop and roll out the system, along with a three-month “ramp-up period”, but that preparatory work may have already started.

The system will be based on CZDS, the service that currently allows people to request zone file data from registries, and cost $3.3 million to develop and run for its anticipated two-year trial period.

Don’t expect it to be called the Whois Disclosure System though. Community feedback has been pretty clear that “disclosure” is an inappropriate word because the system merely manages requests and does not actually disclose anything.

It’s also going to be voluntary for both requesters and registrars/registries for now.

The system was previously known as SSAD Lite, a cut-down version of the community-recommended System for Standardized Access and Disclosure, which ICANN estimated would have cost infinity dollars and take a century to implement.

Industry outlook gloomy for next year, predicts ICANN

ICANN is forecasting a downturn of the domain industry’s fortunes over the coming year according to its draft fiscal 2024 budget, published today.

The Org’s beancounters are budgeting for slumps in both legacy and new gTLD transactions, along with declines in the number of contracted registries and registrars.

Global economic conditions, such as the post-Covid recessions and high inflation being experienced by many nations, are blamed for the poor outlook.

Overall, ICANN expects to have a couple million bucks less to play with in FY24, which runs from July 2023 to June 2024.

It’s planning to receive $145.3 million, down from the $147.7 million it expects to receive in the current fiscal year, which is only half-way through.

Most of ICANN’s money comes from transaction fees on legacy gTLDs — mainly Verisign’s .com — and that’s where it’s predicting a 1% decline, from $88.3 million to $87.1 million, or 185.8 million transactions compared to 187.9 million.

ICANN receives transaction fees on every domain added, renewed or transferred between registrars.

Verisign has been lowering its financial outlook all year, as .com shrinks. Fewer .com renewals means less money for ICANN.

ICANN also thinks new gTLD sales are going down, from 25.7 transactions in the current year to 24.2 million in FY24, taking about $600,000 from ICANN’s top line.

The number of contracted registries is also predicted to decline by 19, from 1,146 to 1,127 by the end of the year, while the number of registrars is expected to increase from 2,447 to 2,452.

Other funding sources, such as ccTLD contributions and sponsorships, are expected to remain unchanged.

The draft budget is open for public comment and could well change before it is finally approved, which usually comes in May or June.

Content police? ICANN mulls bylaws change

ICANN could change its bylaws to allow it to police internet content to an extent, it emerged this week with the publication of the Operational Design Assessment for the next stage of the new gTLD program.

Currently, ICANN’s bylaws state that the Org may not “regulate (i.e., impose rules and restrictions on) services that use the Internet’s unique identifiers or the content that such services carry or provide”, and it’s been adamant that it is not the “content police”.

But the community has recommended that future new gTLD applicants should be able to agree to so-called Registry Voluntary Commitments, statements of registry policy that ICANN would be able to enforce via contract.

RVCs would be much like the Public Interest Commitments many registries agree to in the 2012 application round, implemented before ICANN’s current bylaws were in effect.

As an example I’ve used before, Vox Populi Registry has PICs that ban cyberbullying and porn in its .sucks gTLD, and in theory could lose its contract if it breaks that rule by allowing .sucks sites to host porn (like this NSFW one, for example).

ICANN’s board of directors expressed concern two years ago that its bylaws may prevent it from approving the RVC recommendation.

But Org staff have now raised, in writing and on a webinar today, the prospect that the board could change the bylaws to permit RVCs to go ahead. The ODA published on Monday states:

The Board may wish to consider how and whether it can accept the recommendations related to PICs and RVCs. One option may be to amend the Bylaws with a narrowly tailored amendment to ensure that there are no ambiguities around ICANN’s ability to agree to and enforce PICs and RVCs as envisioned

How worrying this could be would depend on the wording, of course, but even the chance of ICANN meddling in content is usually enough to raise eyebrows at the likes of the Electronic Frontier Foundation, not to mention supporters of blockchain alt-roots, many of whom seem to think ICANN is already censoring the internet.

It’s not clear whether the change is something the board is actively considering, or just an idea being floated by staff.

ICANN bloat to continue as new gTLD program begins

ICANN expects to hire so many new staffers over the next few years that it’ll need to rent a second office in Los Angeles to store them all in, according to a newly published new gTLD program planning document.

We’re looking at about 100 more people on the payroll, about 25% above the current level, judging by ICANN figures.

The Org said in the Operational Design Assessment published last night that the next new gTLD round will need it to hire another 25 to 30 dedicated staff during implementation of the program, along with 10 to 15 contractors, and then an additional 50 to 60 permanent staff to help manage the program going forward.

The number could be even higher if the board of directors and community encourage ICANN to speed up the roll-out of the round by reducing automation and relying more on the manual processing of applications.

The ODA says that ICANN has already identified an option to lease more office space close to its LA headquarters, to house the newcomers.

The budget for ICANN’s current fiscal year expects the Org to average 423 operational staff and another 25 employees dedicated to the new gTLD program.

ICANN reckons that the next round will require 125 full-time equivalents (FTE) during the implementation phase, reduced to 114 after the application phase kicks off.

For comparison, in May 2012, shortly after ICANN closed the application window for the last round, the whole organization comprised just 143 people. A year later, it had grown to 239.

The ODA does not break down how many additional staffers it will need to hire if the community plumps for the low-automation “Option 2”.

ICANN spunks a year, $9 million, on new gTLD plans destined for trashcan

ICANN has published the Operational Design Assessment for the next round of the new gTLD program, a weighty tome of 400 pages, most of which are likely destined to be torn up, burned, or used as toilet paper.

The ODA is the document, prepared by staff for board consideration, that lays out how the Org could implement the community’s policy recommendations for the next application round, how much it would cost, and how long it would take.

As I wrote last week, the paper outlines two options, the more expensive of which would take five years and cost $125 million before a single application fee is collected.

This option “reflects the goal of delivering on all outputs of the SubPro Final Report [the community’s 300-odd policy recommendations] to the maximum extent possible”.

This would see the clock ticking the moment ICANN gets the board’s nod and begins the implementation work — best case scenario, probably the first half of next year — and the first applications accepted at least five years later.

So, no new gTLD applications would be received until the first half of 2028 at the earliest. The first registry go-live would not happen until the 2030s, three decades after the first application window closed.

The second option, which was discussed on a webinar last week, would take about 18 months to roll out and cost half as much in up-front costs, but would not necessarily give the community every last thing it has asked for.

In this scenario, the next application window could open as early as 2025, followed by windows in 2026, 2027 and 2028. There’d be no per-window limit on applications, but ICANN would only start to process 450 each year, with the lucky applications selected by lottery.

What’s surprising about the ODA is how little airtime is given to the second option — known as the “cyclical” or “batching” option — which doesn’t really get a serious look-in until page 354.

The large majority of the document is devoted to the single-round, long-runway, more-expensive option, which Org surely knows will prove repellent to most community members and would, if approved, surely confirm that ICANN is mortally unfit for purpose.

Yet ICANN has nevertheless spunked over a year and $9 million of domain buyers’ money assessing an operational design it surely knows has no chance of ever going operational. It’s pure, maddening, bureaucratic wheel-spinning.

ICANN will hold two webinars tomorrow to discuss the document, so if you’re interested in the debate, best settle in for a night of tedious and rather frustrating reading.

The ODA itself is here (pdf).