How Protect IP will get you hacked

The collection of DNS experts opposing the Protect IP Act today held a press conference to outline exactly why the proposed US piracy protection legislation is dangerous.
Protect IP, currently making its may through Congress, would force ISPs to intercept and redirect domain name look-ups for proscribed piracy sites.
It’s the latest in a series of attempts by the IP lobby to push through legislation aimed at curbing the widespread bootlegging of digital content such as music and movies.
But ICANN chair Steve Crocker, DNS uber-hacker Dan Kaminsky, David Dagon of Georgia Tech, VeriSign’s Danny McPherson and BIND supremo Paul Vixie all think the Act will have unintended and dangerous consequences.
They published a white paper explaining their concerns in May, which I wrote about here, and today ramped up the campaign by talking to reporters in Washington, DC.
Here’s the problem as they see it:
Today, the vast majority of internet users take the default DNS service from their ISP. Usually, the servers are configured automatically when you’re installing the ISP’s software.
Many users are also aware of alternative DNS providers such as Google and OpenDNS. Whatever you think of these services, you can be pretty confident they’re not out to steal your identity.
What Crocker et al are worried about is that content pirates will set up services similar to OpenDNS in order to enable users to visit domains that are blocked by Protect IP in their country.
Users can configure such a service in just 30 seconds, with a single click, the experts said. If they want access to the latest movies and music, they may do so without considering the consequences.
But if you sign up to use a DNS server provided by a bunch of movie pirates, you don’t necessarily have the same reassurances you have with OpenDNS or Google.
You’re basically signing up to pass all your domain name look-up data to proven rogues, what Kaminsky referred to during the press conference as “unambiguously bad guys”.
These bad guys may well direct you to the correct server for the Pirate Bay, but they may also hand you over to a spoof web site when you try to visit your bank.
You’ll think you’re looking at your bank’s site, and your computer will think it got a genuine IP address in response to its DNS query, but you’re really handing your login credentials to a crook.
DNS blocking already takes place with respect to content such as child pornography, of course, but it has not to date created a huge reaction with millions of users taking their DNS overseas.
“The scale of the reaction is what we fear,” Kaminsky said. Vixie added: “To the extent that the content is extremely popular the bypass mechanisms will also be popular.”
The measures proposed by Protect IP would also break DNSSEC, but that’s still pretty much pie-in-the-sky stuff, so the press conference did not spend much time focusing on that.

Victoria’s Secret seizes swimsuit domain, again

The lingerie retailer Victoria’s Secret has won a cybersquatting complaint over the domain name victoriasecretswimsuit.com for the second time in as many years.
Judging by the Whois history, it appears that the company lost the domain following the demise of rogue registrar Lead Networks, which lost its accreditation last year.
Victoria’s Secret first secured the domain with an easily won UDRP complaint in May 2009.
An attorney from its outside law firm was subsequently listed as the admin contact, but the registrar of record remained the same – the Indian outfit Lead Networks.
At some time between August and October last year, the Whois contact changed to the current registrant, who’s hiding behind a privacy service.
Probably not coincidentally, that was about the same time as ICANN, having terminated Lead Networks’ accreditation, bulk-transferred all of its domains to Answerable.com.
Lead Networks was placed into receivership in March 2010 following a cybersquatting lawsuit filed by Verizon.
Answerable.com, a Directi business also based in India, was the registrar’s designated successor under ICANN’s policies. It has subsequently changed its name to BigRock.com.
The latest UDRP decision does not explain how Victoria’s Secret managed to lose its registration, but I’d speculate the inter-registrar transfer may have had something to do with it.
When a registrar loses its accreditation the names are transferred to a new registrar but the term of the registration is not extended. If a registrant ignores or does not receive the notifications sent by the gaining registar, they may find they lose their domains.

Buy a .com in England, go to jail in America?

People who register .com or .net domain names to conduct illegal activity risk extradition to the United States because the domains are managed by an American company.
That’s the startling line reportedly coming from the Immigration and Customs Enforcement agency, which is trying to have the British operator of TVShack.net shipped out to stand trial in the US.
According to reports, 22-year-old student Richard O’Dwyer is fighting extradition to face charges of criminal copyright infringement.
ICE assistant deputy director Erik Barnett told The Guardian that any overseas web site using a .com or .net address to spread pirated material is a legitimate target for prosecution in the States.
The agency has already started shutting down .com and .net sites by seizing their domains, even if the sites in question had been found legal in their own overseas jurisdictions.
It does so by serving a court order to VeriSign, the registry manager, which is based in Virginia. The company is of course obliged to obey the order.
TVShack.net provided links to bootleg movies and TV shows, rather than hosting the content itself. It appears to be a matter of some confusion in the UK whether that behavior is actually illegal or not.
The site reportedly was hosted outside the US, and O’Dwyer never visited the US. The only link was the domain name.
I’m British, but DI is a .com, so I’d like to exercise my (presumed conferred) First Amendment rights to call this scenario utterly insane.
The issue of legal jurisdiction, incidentally, is one that potential new gTLD applicants need to keep in mind when selecting a back-end registry services provider.
Most incumbent providers are based in the US, and while we’ve seen plenty of upstarts emerge in Europe, Asia and Australia, some of those nations sometimes have pretty crazy laws too.

“Super Lawyers” not famous enough to win gripe site UDRP fights

Three lawyers have failed to win cybersquatting complaints against a blogger who registered domains matching their personal names in order to criticize them.
Gregg Mashberg, Allen Fagin and Joseph Leccese, all attorneys with the international law firm Proskauer Rose, have lost three separate UDRP complaints recently.
Self-professed “investigative blogger” Crystal Cox registered josephleccese.com, allenfagin.com and greggmashberg.com last October, in order to publish a handful of unreadable and potentially defamatory blog posts alleging various forms of criminality.
The three men do not hold registered trademarks matching their names, so were forced to rely upon various awards they have won and media appearances they have made to show common law rights.
All three have apparently been named “Super Lawyers” by something called New York Super Lawyers, for example.
But the three-person WIPO panel which heard all three cases found, in virtually identical decisions, that the lawyers had failed to acquire common law trademark rights to their names.
The decisions read:

The record before the Panel suggests that Complainant is a highly respected, prominent lawyer who is a partner with a major law firm. There is insufficient evidence here that Complainant markets or provides services independently of the Proskauer law firm. Rather, it appears that the Proskauer firm is the platform on which Complainant provides his legal services.

It’s not unusual for a celebrity or public figure to win a UDRP complaint on the basis of their fame, but it appears in this case that the complainants were just not famous enough.

DirecTV wins first-ever .so UDRP

The recently relaunched .so top-level domain has seen its first UDRP case. DirecTV, the American satellite TV provider, won its complaint over the domain directv.so.
As you might imagine, it was found by WIPO to be a slam-dunk case of cybersquatting, with the respondent not even bothering to respond.
The domain was registered April 1, the first day .SO Registry opened its doors to general availability.
The registrant merely parked the domain with his registrar, which is enough nowadays to show commercial use and thus bad faith.
It will be interesting to see how badly .so is cybersquatted. It was not a particularly high-profile launch, and it lacks the attractiveness of, say, .co, so I expect we won’t see a great many UDRP cases filed.
.SO Registry, which has GMO Registry as its back-end provider, had pretty much the same trademark protection mechanisms built-in as .co, and used some of the same counsel to create them.
.so is the ccTLD for Somalia.

Beckstrom gets his bonus again

ICANN president and CEO Rod Beckstrom has been awarded a performance-related bonus for the 12-month period ending today, it has emerged.
The undisclosed amount was approved by the ICANN board of directors during an unannounced meeting last Saturday.
As it is classed as a personal personnel matter, the portion of his “at risk component” approved was not revealed, but it is known that Beckstrom’s annual bonus is capped at $195,000.
His base salary is $750,000.
It’s the second consecutive year that he has received some part of his bonus. For the year ended June 30, 2010, the board voted it through in December.
As Beckstrom enters the third year of his three-year contract, it’s understood that he has already been making overtures to the board to extend his tenure for a second term.

US extends ICANN’s IANA contract

ICANN has received a six-month extension to its crucial IANA contract, apparently in order to give the US government more time to take public comments and make amendments.
The contract may have been extended some weeks ago, but I believe the first public acknowledgment from ICANN came in a presentation before the ccNSO at its meeting in Singapore last week.
The IANA contract is what gives ICANN the power to make changes to the DNS root – including adding new top-level domains to the internet.
It is granted by the US National Telecommunications and Information Administration.
The contract is now set to expire March 31, 2012, towards the end of the newly approved first-round new gTLDs application window, which is expected to be open from January 12 until April 12.
It would be helpful, from an applicant confidence perspective, if the contract is renewed on a longer-term basis before January 12, when money will start changing hands.
The NTIA currently has a Further Notice Of Inquiry (pdf) open, soliciting public comments on what terms should and should not be included in the contract.
Quite a few civil liberty types are annoyed about the fact that the NTIA has added a clause that may enable it to block new gTLDs from the root if governments find them disagreeable.

How the US shaped the new ICANN

The US government pushed hard for ICANN to pay more attention to international governments, which caused it to delay .xxx and the new top-level domains program, a new document reveals.
A transcript of a December 2010 meeting between ICANN’s board and National Telecommunications and Information Administration chief Larry Strickling, published following a disclosure request by DomainIncite, outlines America’s “tough love” policy over ICANN.
It reveals that Strickling hauled ICANN over the coals over its opaque decision-making, its failure to adequately address its Affirmation of Commitments obligations, and its apparent lack of respect for its Governmental Advisory Committee.
The era of ICANN engaging maturely and in earnest with governments, witnessed over the last six months, arguably began in that meeting room in Cartagena, the evening of December 7, 2010.
But it did so partly because it fitted with Obama administration policy.
Strickling told the board that the multi-stakeholder model of internet governance was critical to US public policy on other matters, but that he wanted to ensure “the reality fits the model”:

we are cheerleaders for this. But as I’ve said to several of you, there’s a model but then there’s the reality. And it is incumbent on us at this particular point in time, more so than perhaps ever before, to do what we can to ensure the model, that the reality fits the model.
…
what it comes back to at the end of the day is our concern that we want to be able to demonstrate to the rest of the world that the quality of decision-making by this organization is absolutely top drawer.

ICANN was failing to live up to these ideals, he said. This was particularly true in the case of the new gTLD program, which many had expected ICANN to approve in Cartagena.
Strickling said that ICANN had not done enough to evaluate the pros and cons of the program:

I’ve heard expressed the idea that somehow I or the United States is opposed to the expansion of top-level domains. That’s not the case. I don’t have a view one way or the other. Frankly, that’s up to you to decide.
What I do care about is that when you decide that question, that you do it with a quality of decision-making with all of the information in front of you that you ought to have with the experts having given you the opportunity to ask questions and evaluate the pros and cons of decisions as fully as possible.

He later added:

It’s very clear that there are a lot of warning signs, just in the studies that have been done so far, incomplete as they are, to suggest that rushing headlong into this issue, I think, could be a mistake.
But I want to very quickly kind of backtrack from that remark in the sense that I don’t think it’s my place, in my role, to tell you how to make your decisions in terms of what the outcome should be.
And I do think I have a role to play and will play the role of evaluating the quality of decision-making, which largely is processes, but at the end of the day it really comes down to did the board have in front of it the facts it needed to have to make an informed decision, and does their decision, as reflected in their report of that decision, reflect a reasoned, mature, responsible decision.

It’s impossible to tell precisely what the tone of the meeting was from the transcript, but it’s possible to infer from the content that it was likely that of a parent scolding an unruly child.
At one point in the transcript, director Rita Rodin Johnston refers to Strickling as “Dad”, and Strickling says moments later that he does not want to “play schoolteacher” .
Seemingly pushing for it to mature as an organization, he urged ICANN to engage more seriously with the GAC, which had concluded a frustrating public meeting with the board just minutes earlier.

I don’t know what all of the top challenges are to ICANN in the next three to five years, but I absolutely believe that in that top three will be the issue of ICANN’s relations with foreign governments.
…
I think you all are missing a tremendous opportunity to deal with this issue of ICANN and Internet governance and the role of foreign governments, and it’s absolutely incumbent upon you all to find a way to work with the GAC along the lines that Heather [Dryden, GAC chair] and her fellow members expressed to you today.
…
I think that’s important for your ultimate preservation as an independent organization, and I cannot, I guess, emphasize enough the importance of working out these processes with the GAC in terms of receiving their advice, treating it with respect by responding to it promptly and fully, sitting down and mediating with them where it appears there are disagreements.

His words hit home.
Later that week, ICANN deferred a decision on approval of .xxx, pending formal discussions with the GAC, and it arranged to meet with the GAC in Brussels to discuss the new gTLDs program.
Over the last six months we’ve seen numerous changes to the Applicant Guidebook – addressing the concerns of trademark owners, for example – as a result of these consultations.
The structure of this process also appears to been formed during this private Cartagena meeting.
Strickling clashed with then-chairman Peter Dengate Thrush on their respective interpretations of ICANN’s bylaws as they relate to rejecting GAC advice.
Dengate Thrush expressed a view that could be characterized as “vote first, consult later” (my words, not his), which Strickling dismissed as “silliness”.
Strickling evidently won the argument; ICANN this year has started consulting formally with the GAC prior to voting on important issues.
The first beneficiary of this policy was .xxx applicant ICM Registry, which Strickling addressed directly during the Cartagena meeting:

But let me just say I don’t know how — based on, as I understand the facts on both top-level domains and ICM, how you can possibly have a mediation this week, in terms of the fact that information has not been provided to the GAC that they’ve asked for, the fact that they do not feel they understand exactly what the board has disagreed with and why.

This appears to be the reason we’re looking at .xxx domain names hitting the market in September, rather than right now.
Finally, I find it ironic that, given the meeting’s focus on transparency, it was Strickling, rather than ICANN, who asked for a transcription of the talks to be made.

>>PETER DENGATE THRUSH: We are currently scribing this session. But under our rules if you want us not to scribe this, we just turn it off.
>>LAWRENCE STRICKLING: I’m fine to be on the record. I have spoken to some of you individually, and I urged every one of you who I talked to individually to share my views as far as they wished. And I have absolutely no problem with anything I say here being in the public record.

Despite this exchange, the transcript did not become part of the public record until last Friday, 30 days after I filed a request using ICANN’s Documentary Information Disclosure Policy, which is a little like its Freedom Of Information Act.
I wish I’d filed it sooner.
You can download the PDF of the transcript here.

Calls to fix new gTLD “revolving door” at ICANN

ICANN’s CEO has acknowledged calls for a rethink of its ethics policies in light of the approval of the new generic top-level domains program and a recent high-profile staff departure.
Rod Beckstrom, during his opening remarks at ICANN’s international public meeting in Singapore last week, said he expects to lose staff to new gTLD applicants:

we could see a rise in departures as our highly qualified staff are recruited by other organizations, including some in this room, for their unique experience in this emerging area.
This would be a solid endorsement of our staff. Not unexpectedly, the first such resignation has already occurred.
I am pleased to hear the community begin discussions on whether ICANN ethics policies need to be strengthened.

The resignation referred to was that of Craig Schwartz, who has quit his job as ICANN’s chief gTLD registry liaison to head BITS’ application for .bank and other financial TLDs.
There are fears that the sudden influx of new money into the gTLD space could easily attract ICANN’s top talent away from the organization, making it less effective.
This looming problem is particularly troubling given ICANN’s recent staff retention problems.
Adrian Kinderis, CEO of likely applicant and registry services provider AusRegistry, said during a meeting between the ICANN board and the GNSO Council last week:

I need to ramp up some people very very quickly that know about this domain application process, and I’ll pay big dollars because there’s big dollars out there…
If you don’t do something, I will poach all your good people.

A small number of people who know the Applicant Guidebook inside-out – I’ve heard stories of meetings where ICANN executives use a whiteboard to brainstorm all the possible ways to game the program – would make invaluable recruits for registry services providers or consulting firms.
Senior vice president Kurt Pritz, who’s been heading the development of the Guidebook for the last few years, would be a killer hire if and when he decides to leave.
Currently, there’s nothing in these employees’ contracts that would prevent such talent leakage – although many have signed confidentiality agreements – Beckstrom said on Monday.
The GNSO has started talking about a policy that could help prevent a “revolving door” between the industry and ICANN, which is in many ways its regulator.
A very early-stage draft document compiled by Go Daddy’s Tim Ruiz has been circulated to the Council, outlining eight ideas for such a policy.
It could for example require contracted parties to agree not to hire ICANN staff during their employment and for a period thereafter, and vice versa.
It also suggests banning staff joining ICANN from a contracted party working on matters related to that company for two years after being hired.
Governments around the world already have such policies in place, although they vary wildly and are enforced with various degrees of effectiveness.
Perversely, the fact that everyone knows these talks are now underway may in fact accelerate registries’ headhunting of ICANN staff – there presumably can be no revolving door ethics policy violation before a revolving door ethics policy has been created.

Crocker picked to lead ICANN

Steve Crocker has been elected chairman of ICANN’s board of directors, following the departure of Peter Dengate Thrush, whose term on the board expired today.
Described earlier this week by CEO Rod Beckstrom as “one of the uncles of the internet”, Crocker is the creator of the Request For Comment format for internet standards.
Replacing Crocker as vice-chair is fellow geek Bruce Tonkin, chief strategy officer of Melbourne IT, the Australian domain name registrar.
Both men were selected by secret board poll.
The board revealed the unsuccessful candidates for the first time too: Cherine Chalaby and Sebastien Bachollet stood for chair, while Bachollet and Ray Plzak stood for vice-chair.
Because Crocker’s term on the board ends in October, his long-term future depends now on whether the ICANN Nominating Committee decides to renew his term for another three years.
I expect it will. Last year, NomCom kicked out all three of its appointees whose terms were up, irking some. Declining to re-appoint Crocker this year could look like regicide by committee.
This leaves NomCom with only one pick in 2011. It will almost certainly be a woman from a region currently under-represented on the board. My guess is Russia.
Also joining the board today was .au’s Chris Disspain, who replaces Dengate Thrush as ccNSO appointee, and Canadian consultant Bill Graham, who replaces Rita Rodin Johnston from the GNSO.