Bizarre redactions in Pirate Bay founder’s ICANN registrar ban

ICANN has finally published a complaint from Pirate Bay founder Peter Sunde, who has been banned from owning an accredited registrar, but it’s full of bizarre redactions that serve only to make it look like the Org is hiding something.

You may recall that Sunde said in March that ICANN had rejected his application to have his registrar, Sarek, formally accredited.

He told DI that it happened because ICANN was worried he’d be a “pain in the ass” due to his previous association with the Pirate Bay file-sharing site and his criminal conviction for copyright infringement.

Not long after speaking to us, he filed a formal complaint with ICANN, which ICANN, five months later, published this week.

There’s not much in the complaint (pdf) that we have not already reported, but what’s notable is the amount of unnecessarily redacted text.

ICANN seems chiefly concerned with poorly obfuscating the identity of the staffer with whom Sunde was dealing on, and who ultimately rejected, his accreditation application.

The Org goes to the extent of redacting gender pronouns, so the reader can’t tell whether the person in question is male or female.

But the information that remains unredacted in the very same sentence is more than sufficient to identify the staffer concerned.

I’ve even been on national TV mentioning [NAME REDACTED] that I talked to today, regarding [PRONOUN REDACTED] failure to disclose the 3200 comments that was against the price cap removal of .ORG in [PRONOUN REDACTED] summary report for ICANN regarding the case.

The person who compiled the comment summary on the .org price caps issue, a public document (pdf), was Russ Weinstein, who’s also the guy in charge of registrar accreditation matters.

What possible benefit could be had from obfuscating his identity? And if doing so is so important, why do it in such an incompetent way?

The document also appears to redact the names of Facebook CEO Mark Zuckerberg and Swedish prog-rocker Björn Afzelius, both in the context of well-reported news stories mere seconds away in a search engine.

Reference to Sunde’s own criminal convictions, which are also well-reported and he has never been shy about addressing, also appear to be redacted.

For avoidance of doubt, I’m not saying that ICANN is hiding anything sinister, nor am I saying Sunde’s complaint has merit, but this redaction-happy attitude serves only to make the Org appear less transparent than it really should be.

If these redactions are attempts to hide personally identifiable information under ICANN’s privacy policy, they failed miserably on pretty much every count, even after five months.

This is privacy theater, created by people who don’t know the first thing about privacy.

ICANN has yet to respond Sunde’s complaint.

ICANN cuts the weekend from next public meeting

ICANN has changed the dates for ICANN 72, its 2021 annual general meeting, making it two days shorter.

The old plan was for the meeting to run October 23-28. Now it will be October 25-28.

Basically, this means nobody will have to work at the weekend. October 23 is a Saturday.

The presumably truncated schedule will be published October 4.

ICANN said it made the decision “to support better working hours for attendees and encourage greater participation”.

ICANN 72 came close to having an in-person component in Seattle, but the board of directors decided last month to stick to Zoom due to ongoing pandemic uncertainties.

As Kabul falls, Whois could present a danger to ordinary Afghans

With Afghanistan falling to the Taliban this week, there’s potential danger to .af registrants — both in terms of losing domain services and of Whois being used for possibly deadly reprisals.

At time of writing, it’s been four days since the fall of Kabul. The uneasy truce between NATO and Taliban forces has failed to prevent scenes of chaos at the city’s main airport and the PR machine of so-called “Taliban 2.0” is in full bluster.

The new Taliban is, its spokespeople suggest, more tolerant of western liberal values and more supportive of human rights than its brutal, pre-9/11 incarnation.

Few believe this spin, and there have been multiple reports of 1990s-style oppression, including revenge killings and the suppression of women’s rights, across the country.

With all that in mind, a blog post about .af domain names may seem trivial, but it’s not my intention to trivialize.

I’m as appalled as any right-minded observer by the situation on the ground in Afghanistan and the neglect that led to it. But I believe .af could prove a learning moment in the ongoing conversation about Whois privacy.

The .af ccTLD has been managed since not long after the US-led invasion by the country’s Ministry of Communications and IT as the Afghanistan Network Information Center.

The registry had previously been managed for free from London by NetNames, with an admin contact in Kabul, according to the report of the 2003 IANA redelegation, which happened at a time when Afghanistan was still under a transitional government heavily overseen by the foreign governments behind the invasion.

Domain policy for .af was created in 2002, and it includes provisions for an open, freely available Whois database that is still in effect today.

Domains registered via overseas registrars appear to be benefiting from the impact of the EU’s General Data Protection Regulation, which redacts personal information, but this obviously does not apply in Afghanistan.

This means the names, addresses, phone numbers and email addresses of .af registrants are available for querying via various Whois interfaces, including the registry’s own, which is managed by New Zealand-based back-end CoCCA.

Using a combination of web searches and Whois queries, it is possible to find personally identifiable information of registrants, including names and addresses, at local human rights groups, as well as local news media and technology providers supportive of human rights causes.

If the reports of Taliban fighters conducting house-to-house searches for enemies of the new state are accurate, the easy availability of this personal data could be a serious problem.

To a great extent, this could be a case study in what privacy advocates within the ICANN community are always warning about — public access to Whois data gives oppressive regimes a tool to target their oppression.

And as we have seen this week, oppressive regimes can appear almost literally overnight.

While it seems unlikely there’s anyone from the old Afghan ministry still in control of the registry, I think .af back-end provider CoCCA, as well as Whois aggregators such as DomainTools, should have a long think about whether it’s a good idea to continue to provide open access to .af Whois records at this time.

Fortunately, there doesn’t appear to be a great many .af domains under management. DomainTools reckons it’s under 7,000.

At the other end of the scale of seriousness, overseas .af registrants may also see issues with their names due to the Taliban takeover.

It seems incredible today, but in 2001 a Taliban decree restricted internet access to a single computer at a government ministry. Others in government could apply to use this computer by sending a fax to the relevant minister.

While it seems impossible that such a Draconian restriction could be reintroduced today, it still seems likely that the Taliban will crack down on internet usage to an extent, including introducing morality or residency restrictions to .af regs.

.af is currently open to registrants from anywhere in the world, with no complex restrictions and .com-competitive prices.

Many multinational corporations have registered .af names for their local presence.

The string “af” has in recent years become social media shorthand for “as fuck”, and a small number overseas registrants appear to be using it as a domain hack in that context — type “corrupt.af” into your browser and see what happens.

Others seem to be using .af, where short domains are still available, as shortcuts to their social media profiles.

I don’t believe ICANN will need to get directly involved in this situation. Its Whois query tool does not support .af, and IANA presumably won’t need to get involved in terms of redelegation any more than it would following a general election or a coup d’état.

ICANN director picks for 2021 revealed

ICANN’s Nominating Committee has revealed its three picks for the organization’s board of directors, with one member been swapped out for a newcomer.

Lito Ibarra will be replaced by Edmon Chung, while Danko Jevtović and Tripti Sinha see their seats kept safe for their respective second three-year terms.

Ibarra works for El Salvador’s .sv top-level domain registry and represented the Latin America region on the board. By the time the handover occurs in October, he will have served two of his possible three-year terms.

He’s being replaced by Chung, a long-time industry and ICANN participant perhaps best known as the CEO of DotAsia, which runs .asia. As you might expect, he represents the Asia-Pacific region.

While the appointments clearly alter the regional mix somewhat, they equally clearly do nothing to tilt the gender balance on the male-heavy board, which ICANN has stated is a desirable goal for NomCom.

NomCom also revealed its picks for two members of the GNSO Council, one member of the ccNSO Council and three members of the At-Large Advisory Committee, which include some familiar names.

NomCom said it had 116 applications in total, over half of which came from Africa and Asia-Pac.

For the first time since 2006, ICANN did not disclose the gender mix of the applicants. It’s not clear why.

The full list of successful applicants can be found here.

Over 2,000 attendees for ICANN 73?

Puerto Rico is expecting as many as 2,100 people to show up to ICANN’s public meeting there next year, according to a local report.

A local business publication, NimB, cites Pablo Rodríguez of NIC.pr as saying ICANN 73 could have about 2,100 attendees, bringing as much as $8 million to $10 million to the San Juan economy.

My first thought was that the dollar figure seemed high — it works out to about $5,000 per head — until I realized that most attendees are funded by either ICANN or their company credit cards, and not everyone is as frugal as yours truly.

But then I realized that 2,100 is by far the more surprising number.

Consider that it’s by no means assured that there will be an in-person component to the meeting at all. ICANN is certainly planning for one, but like everyone else the Org is subject to the whims of a microscopic glob of goo.

The plan is for a “hybrid”, a mix of face-to-face and Zoom, with some recognition that there are some parts of the world that will show up with extremely light delegations.

Consider also that the last time ICANN met in San Juan in March, just a couple years ago, the grand total was 1,564 people, 37% of whom hailed from outside the Americas.

With that in mind, 2,100 seems like an incredibly ambitious prediction.

ICANN spills beans on Marby’s million-dollar payday

ICANN appears to have increased its transparency when it comes to executive pay, at least when it comes to the CEO.

Göran Marby was revealed earlier this year to have banked more than $1 million in ICANN’s fiscal 2020, and he received another 5% boost at a board meeting this February.

Six months later, the board of directors has finally approved the minutes of that meeting, and for the first time it actually minutes the meeting, revealing the contents of the discussion and the names of the three dissenting directors.

In the past, minutes of decisions involving pay typically just restate the resolution and rationale with no additional context. They don’t usually even reveal the vote tally.

According to the minutes, there was some debate about the method used to determine how much Marby should be paid.

ICANN’s longstanding policy has to offer executive pay within the “50% and 75% percentile of comparable position salaries” in the general for-profit industries, high-tech industry, and non-profits.

What often bothers ICANN watchers, and bothered some directors in February, is how these three comparable industries are mixed and weighted when figuring out how much an ICANN employee is worth.

If high-tech is given more weight, that would pull in the direction of a higher salary. If non-profits were weighted more, that would pull in the opposite direction.

According to the minutes, Avri Doria raised this issue in February, suggesting that non-profit salaries should be more influential in the mix, when future CEOs are selected.

Chair Maarten Botterman said in the minutes that the blend of comparisons doesn’t really matter all that much because Marby’s compensation is “well below” the percentile threshold ICANN has set itself, regardless of the mix.

The discussion continued:

Nigel Roberts noted that looking at sectors other than non-profit is important because while ICANN might not be a big commercial company, it is certainly in competition with those companies for executive leadership candidates and that he believes ICANN needs to compensate well because of that. Becky Burr similarly noted that it is important to understand from where ICANN is drawing its leadership so that the compensation can be competitive, while also acknowledging that the compensation level under discussion is below the target range.

The problem with these arguments is that Marby was not hired from any of the three sectors ICANN uses for comparison.

While he has a background in tech, he was a telecoms regulator on a government salary in Sweden when he applied for the ICANN gig. He’s being paid more than his predecessors who did come directly from high-tech.

The minutes go on to note that director Ihab Osman pointed out that Marby gets paid more than the secretary-general of the United Nations and the CEO of the American Red Cross.

He wondered aloud whether the skill set of an ICANN CEO is the same as a high-tech CEO, while director Mandla Msimang questioned whether ICANN’s revenue should play a factor in setting compensation.

Osman also noted the potentially poor optics of giving Marby a big pay rise in the midst of a pandemic.

When it came to a vote, Doria, Osman and Msimang all voted against the 5% pay increase, but the remaining 11 directors voted in favor. Marby and Ron Da Silva were not present for the discussion.

ICANN 73 will be “virtual first”

ICANN’s public meeting next March will prioritize online participation, according to chair Maarten Botterman.

Botterman told members of the APAC Space community group this week that ICANN 73 will have “a meaningful ‘virtual first’ hybrid format to support the community’s ongoing priorities, policy advice, and development work”.

APAC Space, you will recall, had written to ICANN to protest the possibility of this October’s ICANN 72 meeting moving to a hybrid model with an in-person component that most Asia-Pacific community members would not be able to take advantage of due to ongoing pandemic-related travel restrictions.

But the ICANN board, in part due to these concerns, decided to keep 72 online-only rather than showing up in Seattle in person, while stating an intention to go hybrid for 73 if “feasible”.

ICANN 73 is due to take place in Puerto Rico, part of the North America region, next March. As a US territory, the venue will be easier to attend for Americans.

Indeed, APAC Space is skeptical about its members ability to attend 73 in person also.

Botterman addressed this, saying:

We appreciate you have similar concerns about holding a hybrid meeting for ICANN73. At this time, relevant experts have a higher level of confidence that the global pandemic situation, in particular vaccination and infection rates, will be much improved by early 2022. While we will continue to closely monitor the situation, our intentions are to hold ICANN73 as a hybrid meeting with an in-person component if it is feasible to do so.

The five online-only meetings ICANN has held since the pandemic hit are generally regarded as being pretty good as far as Zoom meetings go, but there can be no replacement for the corridor conversations, cocktail events and private dinners that face-to-face meetings permit.

Even the ICANN board of directors is affected — due to the annual turnover, some members haven’t even met each other face-to-face in a board context.

Another new gTLD applicant lawyers up on ICANN

Another rejected new gTLD applicant has filed an Independent Review Process complaint against ICANN, claiming the org failed to follow proper procedures on fairness and transparency.

And I think it’s got a pretty good chance of winning.

A Bahrain company called GCCXI has filed the IRP, eight years after its application for .gcc was thrown out by ICANN on the vague advice of its Governmental Advisory Community.

.gcc is for Gulf Cooperation Council, the short-hand English name for the Cooperation Council for the Arab States of the Persian Gulf, a proto-union of six states on the east coast of the Arabian peninsula.

The applicant’s problem is that it’s not affiliated with, nor supported by, the GCC or its member states.

The GAC, in its controversial Beijing communique of April 2013 objected to GCCXI’s application in the same breath and under the same power as it objected to DotConnectAfrica’s .africa bid.

Back then, the GAC was much more secretive than it is today, and did not have to provide a rationale for its advice. Its powers to object to gTLD applications pretty much amounted to a veto.

ICANN dutifully followed the GAC’s advice, throwing out the .gcc application later that year.

The applicant has evidently been trying to get ICANN to change its mind, using the Request for Reconsideration and then Cooperative Engagement Processes, since early 2014. That CEP concluded in May, and GCCXI filed for IRP in June.

Why did the CEP — a form of arbitration designed to avoid expensive IRP complaints and lawsuits — take so long and ultimately fail?

Don’t look to the IRP complaint published by ICANN (pdf) for answers — it’s redacted the whole ruddy lot, a few pages of text, without explanation.

That’s ironic given that a lack of transparency is one of GCCXI’s beefs against the org, along with an alleged failure to follow its bylaws on neutrality and fairness.

ICANN has ignored all of its carefully developed and documented policies, and instead has kowtowed to unspecified government concerns — devising a secret process to kill Claimant’s investment and opportunity, and completely disregarding the public interest in delegating the TLD for use.

The continued fight for a gTLD it surely has no hope of ever operating is a ballsy move by the applicant.

It’s roughly equivalent to some random European company applying to run .eu to represent the geographic region of EU member states without the consent of the EU institutions themselves and then complaining when it’s told to take a walk.

But that doesn’t necessarily mean it will lose the IRP. In fact, I think it has a pretty good chance of winning.

GCCXI does not deserve to prove it should be given .gcc, it only needs to show that ICANN broke its own bylaws.

DotConnectAfrica, which was rejected by the GAC and then ICANN for pretty much the same unsubstantiated reasons — the GAC “veto” — won its IRP in 2015, with the panel finding that ICANN accepted the GAC’s unexplained advice without even rudimentary due diligence, violating its commitment to fairness.

It was particularly embarrassing for the GAC, whose then-chair admitted that the committee deliberately kept its advice vague and open to interpretation

While .africa is not exactly the same as .gcc (the former is officially a geographic string, the latter is not), GCCXI had DCA had their applications rejected based on the exact same piece of GAC advice.

It’s also similar to Amazon’s IRP fight for .amazon, which it won. That bid was also kicked out as a result of ICANN’s adoption of opaque GAC advice from the Beijing communique.

You’ve got to think GCCXI has a decent shot at a victory here, though if recent IRPs and general ICANN foot-dragging on accountability are any guide we won’t know for a couple years.

New gTLD buzz is back again as ICA hosts “second round” webinar

It’s beginning to feel a little like 2011 again.

The Internet Commerce Association today said it will host a Zoom webinar next month to pitch the looming second new gTLD round to prospective applicants.

Moderated by Christa Taylor, the panel features domain industry jacks-of-all-trades Jeff Neuman and Jothan Frakes, and consultant Phil Buckingham. All four know what they’re talking about.

The ICA said the session will cover “an examination of material changes, expected timing and operations within the broader ecosystem will help participants determining whether to pursue a new gTLD for their new entrepreneurial venture, global brand or growing business”.

Expect a lot more of these types of meetings over the next couple of years. The 2012 gold-rush may have disappointed many, but there’s still money to be made in selling shovels, especially to brands.

And the next round is still a ways off.

While policy changes have been approved by the Generic Names Supporting Organization, they need to be approved by the ICANN board of directors before the serious implementation work begins.

The policy won’t be put before the board until ICANN org has completed its Operational Design Phase work, which CEO Göran Marby recently said will take “longer than six months”.

Then there’ll be at least one revision of the Applicant Guidebook open for public comment, as well as the creation of new systems and a global outreach campaign lasting several months before the application window opens.

I’d say we’re looking at an absolute minimum of 18 months between the start of the ODP and the opening of the next application window, and I’m being incredibly generous to ICANN in that estimation.

Still, it doesn’t hurt to start thinking about these things early. The ICA webinar will be at 1800 UTC August 4. You can read more and register for free here.

Nope, no Seattle meeting for ICANN

ICANN’s planned public meeting in Seattle will have no face-to-face component, the board of directors decided yesterday.

In a resolution published last night, the board cited the global vaccine inequity and the ongoing difficulties with international travel and visas during the coronavirus pandemic.

But it added that it plans to go ahead with a hybrid online/in-person meeting for ICANN 73 in San Juan, Puerto Rico next March “if it is feasible to do so”.

The board noted that its last in-person AGM, held in late 2019, saw 68% of its participants come from outside the US, suggesting Seattle would go ahead with a majority of its community members absent.

It added that “it is likely that ICANN72 could be a meeting of in-person attendees from just a couple of regions, which does not serve global participants in ICANN’s multistakeholder model”

While some of the pandemic-related issues may be resolved by October, ICANN had to make the call now to avoid wasting money on a physical meeting it may have had to later cancel.

The results of the board vote have not yet been published. A similar resolution last year saw some directors vote in favor of a return to face-to-face meetings by October 2020.

The resolution states that ICANN org should use the next eight months to ensure the hybrid model planned for San Juan is as effective as possible for those who will still be unable or unwilling to attend in person due to the pandemic.

It adds that smaller regional meetings, where travel restrictions are less irrelevant, could still go ahead this year.

A recent poll showed a majority of community members from all regions were keen to return to in-person meetings for Seattle, but the majority was greater in North America than elsewhere.

A group of participants from the Asia-Pacific region recently wrote to ICANN to state that it was likely that nobody from that region would be able to show up in Seattle.

ICANN 72 will be the sixth consecutive public meeting to be held virtually.