Whois reform to take four years, cost up to $107 million A YEAR, and may still be pointless

ICANN’s proposed post-GDPR Whois system could cost over $100 million a year to run and take up to four years to build, but the Org still has no idea whether anyone will use it.

That appears to be the emerging conclusion of ICANN’s very first Operational Design Phase, which sought to translate community recommendations for a Standardized System for Access and Disclosure (SSAD) into a practical implementation plan.

SSAD is supposed to make it easier for people like trademark owners and law enforcement to request personal information from Whois records that is currently redacted due to privacy laws such as GDPR.

The ODP, which was originally meant to conclude in September but will now formally wrap up in February, has decided so far that SSAD will take “three to four years” to design and build, costing between $20 million and $27 million.

It’s calculated the annual running costs at between $14 million and $107 million, an eye-wateringly imprecise estimate arrived at because ICANN has pretty much no idea how many people will want to use SSAD, how much they’d be prepared to pay, and how many Whois requests they will likely make.

ICANN had previously guesstimated startup costs of $9 million and ongoing annual costs around the same level.

The new cost estimates are based on the number of users being anywhere between 25,000 and three million, with the number of annual queries coming in at between 100,000 and 12 million.

And ICANN admits that the actual demand “may be lower” than even the low-end estimate.

“We haven’t been able to figure out how big the demand is,” ICANN CEO Göran Marby told the GNSO Council during a conference call last month.

“Actual demand is unknowable until well after the launch of the SSAD,” an ICANN presentation (pdf) states. The Org contacted 11 research firms to try to get a better handle on likely demand, but most turned down the work for this reason.

On pricing, the ODP decided that it would cost a few hundred bucks for requestors to get accredited into the system, and then anywhere between $0.45 and $40 for every Whois request they make.

Again, the range is so laughably broad because the likely level of demand is unknown. A smaller number of requests would lead to a higher price and vice versa.

Even if there’s an initial flurry of SSAD activity, that could decline over time, the ODP concluded. In part that’s because registries and registrars would be under no obligation to turn over records, even if requestors are paying $40 a pop for their queries.

It’s also because SSAD would not be mandatory — requestors could still approach contracted parties directly for the info they want, for low or no cost, if they think the price of SSAD is too high or accreditation requirements too onerous.

“There’ll always be a free version of this for everybody,” Marby said on the conference call.

In short, it’s a hell of a lot of money for not much functionality. There’s a better than even chance it could be a huge waste of time and money.

An added complication is that the laws that SSAD is supposed to address, mainly GDPR, are likely to change while it’s being implemented. The European Union’s NIS2 Directive stands to move the goalposts on Whois privacy substantially, and not uniformly, in the not-too-distant future, for example.

This is profoundly embarrassing for ICANN as an organization. Created in the 1990s to operate at “internet speed”, it’s now so bloated, so twisted up it its own knickers, that it’s getting lapped by the lumbering EU legislative process.

The ODP is set to submit its final report to ICANN’s board of directors in February. The board could theoretically decide that it’s not in the interest of ICANN or the public to go ahead with it.

Marby, for his part, seems to be thinking that there could be some benefit from a centralized hub for submitting Whois requests, but that it should be simpler than the current “too complex” proposal, and funded by ICANN.

My take is that ICANN is reluctant to move ahead with SSAD as it’s currently proposed, but because top-down policy-making is frowned upon its hands are tied to make the changes it would like to see.

Hamburg to have second crack at hosting ICANN meeting

The City of Hamburg is to try again to bring in the ICANN crowd, after getting cancelled due to the pandemic last year.

German ccTLD registry DENIC, along with the city and local trade group eco, is taking a run at being selected as the host for ICANN 78, currently penciled in for October 2023, the company said this week.

It had been picked to host ICANN 69 in October 2020, but pandemic travel restrictions scuppered that opportunity.

The last six public ICANN meetings have been online-only, as will next March’s ICANN 73, which had been due to take place in Puerto Rico.

Hamburg’s chances would have to be said to be strong. Three other cancelled host cities — Kuala Lumpur, The Hague and Cancun — have already been confirmed for meetings in 2022 and 2023.

Of course, the ultimate decision-maker is a nucleic acid molecule wearing a spiky protein coat.

ICANN budget: staff bloat making a comeback

ICANN plans to ramp up its headcount starting next year to support the development of the new gTLD program.

Newly published budgeting documents show that average headcount is expected to rise to 406 for the year ending June 30, 2022, from 395 at the end of this June, with an even steeper increase to 448 a year later.

That’s after several years in which staffing levels have been fairly stable, even sometimes declining a little.

The main culprit is the Operational Design Phase for the next new gTLD round(s), which is expected to kick off soon.

ICANN expects to hire or assign nine people to manage the ODP before the end of June 2022, ramping that up to an average of 22 over the following year. The amount of non-ODP operational staff is expected to rise by 28 over the same period.

ICANN currently advertises 31 open positions on its web site, having added eight listings just this week.

This chart shows the expected growth:

At the time of the last new gTLD application round, in 2012, ICANN had 152 staffers, nine of whom were assigned to new gTLD project — and that was after the programs rules had already been developed, implemented and the application window opened and closed.

ICANN budget: no more new gTLDs before 2028

ICANN is not accounting for any revenue from a future round of new gTLDs in its just-published budget, which plots out the Org’s finances all the way through 2028.

The budget, which I gave a high-level summary of here, even predicts that dozens of 2012-round new gTLDs will disappear over the next six years.

The Org is predicting that there will be 1,091 gTLDs on the internet by the end of its fiscal 2027 (that is, June 30, 2028) down by 58 or 5% from July 2022.

Given that it’s only expecting to lose four gTLDs in FY23, this projection implies a speeding up of the rate at which gTLDs start cancelling their contracts or going out of business in the later part of the five-year budget.

The forecast comes with a big asterisk, however. A footnote reads:

These scenarios do not assume any further TLD delegations arising from the resumption of the New gTLD Program. While there is ongoing work and an intent to launch a subsequent round, the timing of its release remains unclear and potential impact(s) on funding indeterminate. Given this, ICANN org has deemed it prudent not to assume any prospective impacts from a subsequent round across the described scenarios.

In other words, ICANN is not yet ready to commit to a runway for the next application round, subsequent delegations and eventual revenue.

As I reported Monday, the next round is unlikely to be approved until the fourth quarter of next year at the earliest, and my view is that 2024 is the soonest the next application window could open.

I don’t think we can read too much into the fact that ICANN isn’t budgeting for any next-round impact on funding until after 2027.

If you’re pessimistic, you could infer that ICANN believes it’s at least a possibility that the next round could take that long, or not be approved at all, but the safer bet is probably that it merely lacks visibility and is acting in its usual risk-averse manner.

ICANN budget: mild optimism amid maturing industry

ICANN thinks the domain industry, including the new gTLD industry, is maturing and will continue to grow, in its just-published draft budget for fiscal 2023.

The Org is predicting growing transactions across the board, as well as an increase in the number of accredited registrars and a slowing decline in the number of contracted gTLDs.

ICANN is expecting funding of $152 million for FY23, which includes the $4 million bung it negotiated with Verisign as part of the deal to allow the company to raise .com prices.

That’s up from the $149.1 million is expects to receive in the current fiscal year.

As usual, the bulk of the funding comes from gTLD transaction fees — the taxes registrants pay through their registrars and registries whenever they register, renew or transfer a domain name.

Legacy gTLD transaction fees are expected to amount to $93.1 million, up 3% on a forecast of $90.1 million in the current year, while new gTLD transaction fees are expected to rise modestly from $9.5 million to $9.9 million, a 4% increase.

Transactions in legacy gTLDs are expected to be 201.2 million, versus 193.6 million in the current year.

New, post-2012 gTLDs are expected to process 25.8 million transactions, up from 24.8 million, of which 21.1 million will be billable, up from 20.3 million. New gTLDs only pay transaction fees after 50,000 domains under management.

ICANN is expecting to lose four registries in FY23 — this almost always means dot-brands that cancel their contracts — with the total declining from a June 2022 total of 1,149 to 1,145 a year later. This will have a modest impact on fixed registry fees.

But the Org is once again expecting to see an increase in the number of registrars paying fixed accreditation fees, up by 28 to 2,447 at the end of FY23.

Accompanying the budget, ICANN has published some industry trend analysis (pdf) outlining some of the assumptions behind the budget forecasts.

Basically, the document describes what regular readers already know — many domain companies benefited from pandemic-related lockdowns driving small businesses online, but overall industry volumes were driven down by low-cost new gTLDs experiencing huge junk drops.

For ICANN’s purposes, factors such as customer quality and pricing are irrelevant. A spammer registering 1,000 domains in bulk pays ICANN the same amount in fees as 1,000 small businesses building their first web sites.

The document reads:

Taken as a whole, DUMs failed to expand in the past twelve months ending in mid-2021. While this decline is at least partly attributable to lower promotional activity among some of the largest new gTLDs which could be reinitiated in the future, it nonetheless points to an industry that has shifted from a period of rapid expansion to one that is now witnessing steady maturation.

The draft ICANN budget covers the 12 months beginning July 1, 2023, and is now open for public comment before possible revisions and final approval.

ICANN says ODP will speed up new gTLDs in the long run

A time-consuming process to spec-out the next new gTLD application round before it is even formally approved will actually speed up the program over the long run, an ICANN veep has said.

The so-called Operational Design Phase is a bunch of planning, or issues such as cost and feasibility, that ICANN says it needs to do before the community’s policy recommendations can be put before the board of directors.

The board approved the ODP in September, giving the Org a $9 million budget and a 10-month deadline to complete the project, but the clock doesn’t start ticking until CEO Göran Marby formally starts the process.

Three months later, that still hasn’t happened. ICANN is still “organizing the resources needed and developing the roadmap for the work ahead”, according to a blog post from Karen Lentz, VP of policy research and stakeholder programs.

The Org is doing the preparation for the preparation for the preparation for the next round, in other words.

But Lentz says this will speed up the new gTLD program over the longer term.

We believe the ODP will actually streamline future work. It will have a positive impact on the duration of the implementation process by making the assumptions explicit, answering key questions, and considering how the recommendations on different topics work together in addition to providing a detailed timeline and visibility to the timing of implementation activities. If the Board approves the recommendations, the org and the Implementation Review team would be able to leverage a good amount of work already completed during the ODP. Future rounds would not be possible without the foundational work of an ODP. It’s important to note that without an ODP, this work would still be taking place, but without the structure and transparency that the ODP provides.

Another important consideration to note here is that we are not simply organizing only the next round. We are building a foundational structure for all of the work that the org, the community, and the Board will do over the coming years to continue to evolve the namespace along with the necessary procedures and tools. So the work from this ODP is not only for a single round — this is targeting a long-term plan and for multiple rounds.

If Marby were to start the ODP tomorrow, and ICANN managed to hit its deadline, October 2022 would be the absolute earliest the ICANN board would get the chance to approve the next round.

It’s possible, though not very likely given how intrinsic to ICANN’s mission the opening up of gTLD competition is, that the board could instead decide not to approve the next round.

After the next round gets the thumbs-up, there’s still a whole lot of extra work to do — the aforementioned Implementation Review, hiring contractors, a months-long marketing campaign — before companies would actually get to file their applications.

We’re still looking at 2024 at the earliest for that, in my view, but if there’s one thing we can rely on from ICANN, it’d delay.

Be the next “face” of dot-brands

The Brand Registry Group is seeking a new executive director, after incumbent Martin Sutton decided he’s to leave the group next year.

Sutton, who’s been in the role since 2015, said the BRG is looking for somebody to be the new “face of the dotBrand community”.

Arguably the group’s biggest issue right now is the next new gTLD application round, which still appears to be years away after a decade’s worth for navel-gazing by ICANN.

If BRG members are to be believed, a whole lot of companies that missed out on the 2012 round or have been founded since then are champing at the bit for the chance to get their own dot-brands.

It’s pretty clear from Sutton’s job posting that a long-time ICANN community member is being sought, and I can think of maybe two or three people who would make perfect candidates.

The BRG is not a formal ICANN structure, but it gets time on the agenda at ICANN meetings and has some political clout. Its members include the likes of Apple, Amazon, Fox, Honda and JP Morgan & Chase.

The executive director is its only full-time employee role.

Three ICANN directors wanted to go to Puerto Rico

The ICANN board of directors’ decision to scrap the in-person component of its next public meeting was not unanimous, it has emerged.

Three directors voted against the November 4 resolution, which said ICANN 73 would be ICANN’s seventh consecutive online-only gathering, according the a preliminary board report.

The plan for months was to have a “hybrid” meeting, with some face-to-face component at the convention center in San Juan, Puerto Rico, as an intermediate step towards post-pandemic normality.

But at the time of the vote travel restrictions in the US were such that getting to Puerto Rico was tough even for fellow Americans, so ICANN’s meetings team had not been able to do on-site preparation.

Nine directors voted to make 73 virtual, with four absent during the vote, the preliminary report states.

Five directors have taken their seats since the coronavirus pandemic began, and have therefore never officially met with their board colleagues in person.

It’s not the first time the board has been split on this matter. Last year, directors Ron Da Silva and Ihab Osman voted to return to face-to-face for the October 2020 Hamburg meeting.

Da Silva is no longer on the board, but there are at least two other directors among the current line-up on the same page.

The voting breakdown will not be revealed until the board approves the November 4 minutes, which could be months if history is any guide.

ICANN abandons face-to-face plan for Puerto Rico

ICANN has canceled its plans for a “hybrid” ICANN 73, saying this morning that the meeting will go ahead as an online-only virtual meeting.

Its board of directors yesterday voted to abandon efforts to have a face-to-face component in Puerto Rico as originally planned, as I predicted a few days ago.

"Impact of COVID-19 on ICANN73". That's the same language ICANN board uses in its agenda items when it's planning for no face-to-face component. Just saying. https://t.co/TZc7lExu7N

— Kevin Murphy (@DomainIncite) November 3, 2021

ICANN of course said it’s because of the coronavirus pandemic, and more particularly the associated travel restrictions and the lack of access to vaccines in some parts of the world from which its community members hail.

The US Centers for Disease Control currently rates Puerto Rico as its second-highest risk level, meaning ICANN’s meetings staff have been unable to travel there to do on-site planning. ICANN said:

While there has been progress that might make it feasible to plan for and convene a meeting in San Juan, Puerto Rico in March 2022, the current risks and uncertainties remain too high to proceed with an in-person meeting or with an in-person component.

Its board resolution stated:

Between the global inequity in vaccine availability across the world, continuing restrictions on persons from many countries or territories being allowed to enter the U.S., and backlogs in visa processing for those who are able to enter the U.S., ICANN org cannot estimate with any confidence the ability for attendees outside of the U.S. to attend ICANN73.

So 73 will be Zoom again. The time zone will remain UTC-4, Puerto Rico local time, which should make it less problematic for Europeans to attend.

The dates are still slated for March 5 to March 10 next year, but it seems likely that we’ll be looking at a March 7 kick-off, as March 5 is a Saturday and people don’t like working weekends if not somewhere they can also work on their tans.

ICANN said it “affirmed its intent” to attempt the hybrid model again for the mid-year ICANN 74 meeting, which is due to take place in The Hague, Netherlands, next June.

It’s bad news for ICANN participation, which has been declining in the new era of virtual meetings, but good news for its bank account. Virtual meetings cost a few million dollars less than in-person ones.

ICANN teases prices for private Whois lookups

ICANN has started to put some flesh on the bones of the forthcoming (?) SSAD system for accessing private Whois records, including teasing some baseline pricing.

During a session at ICANN 72 last week, staffers said responses to recent requests for information put the cost of having an identity verified as an SSAD user at about $10 to $20.

Those are vendor wholesale prices, however, covering the cost of looking at a government-issue ID and making sure it’s legit, and do not include the extra administration and cost-recovery charges that ICANN plans to place on top.

The verification fee would have to be renewed every two years under ICANN’s proposal, though the verification vendors are apparently pushing for annual renewals.

The fee also would not include the likely per-query charge that users will have to pay to request the true personal data behind a redacted Whois record.

It’s not currently anticipated that any money would flow to registrars, CEO Göran Marby said.

SSAD, the Standardized System for Access and Disclosure, is currently undergoing Operational Design Phase work in ICANN, with monthly webinar updates for the community.

ICANN expects to reveal more pricing details on the December webinar, staffers said.