Tributes as “great mentor” Marilyn Cade dies

Social media was flooded with tributes today after it was sadly announced that one of ICANN’s elder statespeople, Marilyn Cade, has died.

Cade, who participated in ICANN and the wider internet governance community for decades, was widely admired not only for her dedication to fighting her corner, but also her habit of taking the time to bring newcomers, particularly women, the young, and those from under-served regions, into the community.

Reading through tributes on social media and elsewhere today, the word “mentor” appears over and over again.

“She was incredibly dedicated and always trying to bring new people into the multi-stakeholder Internet Governance world. Every time I saw her at an ICANN meeting she would be introducing me to someone new,” wrote one community member.

“What meeting have I been to where Marilyn have not been? She was a mentor, a fighter, lots of energy, but also with attitude,” wrote another.

I myself recall being schooled, and charmed, by Cade over drinks in Mar Del Plata, when I was still a little green, over 15 years ago.

In the ICANN context, Cade was long a member of the Business Constituency of the GNSO, which she chaired for three years from 2010.

She was such a fixture at ICANN, reliably showing up to the open mic during Public Forum sessions at almost every meeting, that the simple introductory sentence “My name is Marilyn Cade” became something of a catchphrase and a source of friendly ribbing.

The phrase regularly showed up on Public Forum Bingo cards, and I once caught an ICANN technician using it to test the audio on a public webcast before the meeting went live.

But she is also fondly remembered in the wider internet governance governance community for many of the same reasons. At the Internet Governance Forum USA, she held the role of “Chief Catalyst”, a job title that perhaps speaks volumes.

The Internet Governance Forum, which kicks off its 2020 meeting online today, announced that it will hold a special session in Cade’s remembrance tomorrow, via Zoom.

“She was a staunch supporter and advocate of the IGF and Internet governance in general,” IGF wrote. “Her energy, enthusiasm and dedication, in particular to the meaningful inclusion of communities from developing countries resulted in dozens of countries establishing their National, Regional and Youth initiatives (NRIs).”

“We were blessed by her passion, her will and her immense love for IGF and the NRI community. I know many of you will be as shocked as us tonight; your pain and anguish is shared,” IGF-USA wrote.

The IGF has opened a comment forum for tributes. Details of the remembrance session can be found at the same link.

Free speech, or bad faith? UDRP panels split on Everything.sucks domains

The first wave of UDPR cases targeting domains used by Everything.suck have seen split decisions by the panels.

At least four .sucks domains, all owned by the same Turks and Caicos company, have been hit by UDRP complaints recently, and two have already been decided.

One case, over the domain miraplex.sucks, resulted in victory for the registrant while the other, over bioderma.sucks, led to defeat and a transfer.

Both domains are owned by Honey Salt Ltd, and both redirect to a page on Everything.sucks, a Wikipedia-style site that uses content scraped from third-party sites and social media to present a scrappy form of gripe microsite.

In both UDRP cases, Honey Salt chose to mount a “free speech” defense, claiming that it had rights to the names because they were being used to publish criticism of the brands in question.

As I noted last week, UDRP panels have historically been divided on when this defense should be successful. WIPO guidance suggests that gripe sites should be permitted as long as the criticism is genuine and non-commercial.

But Everything.sucks was decidedly commercial at the time these two complaints were filed. Each site featured a banner leading to a page on Sedo or Uniregistry where the domain could be purchased (usually at registry wholesale prices).

Miraplex is a brand of Parkinson’s disease medicine. In this case, the panel decided that the complainant, a pharmaceuticals company, failed to make the case that Honey Salt had no legitimate interests in the domain, writing:

the Complainant argues that the website linked to the disputed domain name displays information about the Complainant and its MIRAPEX medicines, but failed to explain (let alone substantiate) why this should be regarded as a lack of rights or legitimate interests in the disputed domain name (which seems to have a criticism purpose). Also, the Panel finds that the offering for sale of a domain name is not by itself a proof of lack of rights or legitimate interests.

The panel seems to have given special consideration to the fact that it’s a .sucks domain, where one might expect to see criticism.

Given the nature of the “.sucks” domain name gTLD, and given the evidence (or lack of evidence) submitted by the parties, the Panel finds that the Complainant did not prove that the Respondent lacks rights or legitimate interests in the disputed domain name. In particular, the Panel would have expected the Complainant to target its arguments and evidence to the specific criticism-nature of “.sucks” domain names (which the Complainant failed to do).

The decision is written in such a way as to suggest that it is the complainant’s lack of substantiating evidence, rather than the panel’s gullibility, that is to blame for the complaint failing.

The Panel finds that the Respondent’s claim that the website available through the disputed domain name has a criticism purpose is not devoid of credibility. The Panel would have expected the Complainant to argue (and corroborate) why it considers this “.sucks” domain name and its purported free expression character as a “smoke screen” and why it is of the opinion that the predominant purpose of the Respondent is to sell this domain name rather than to provide a forum for discussion and criticism. The Complainant did not explain nor substantiate why it considers the criticism character of this website as a pretext. The Panel also finds that the offering of a domain name for sale is not by itself evidence of bad faith.

The bioderma.sucks case is an entirely different story, with the panel writing that Honey Salt’s “entire endeavour seems to the Panel to be a pretext for commercial activity”.

Honey Salt’s “pretext” is that it registers domain names on behalf of a non-profit entity called Everything Sucks Inc, which appears to have been formed in Delaware this April. It told the Miraplex panel that whenever a wiki page is created at Everything.sucks, it registers the corresponding domain name.

Given that over two thousand .sucks domains were registered in June in the space of a couple days, that seems unlikely to me.

The Bioderma panel wasn’t buying it either.

The process by which the disputed domain name was registered seems to be automatic and, importantly, took place before any criticism whatsoever was even present on the website (as may be inferred from the Parties’ evidence, namely the Complainant’s screenshot of June 24, 2020). The alleged criticism seems to have been added as an afterthought between that date and the date when the Response was filed, further calling its genuineness into question.

It also noted that the content of the site comes from third parties, rather than the registrant, again calling its genuineness into question. The panel added:

Even assuming a third party generated the page on the Respondent’s website in order to engage in non-commercial criticism, rather than the Respondent itself, the Respondent immediately proceeds to exploit the position commercially by registering and offering the disputed domain name for sale.

This blatant commercial use was important to the panel in establishing a lack of legitimate interests and also bad faith.

Respondent’s approach was to take unfair commercial advantage of the Complainant’s name and trademark while having no actual criticism or free speech of its own in which to engage. It looked to sell the disputed domain name on the open market before any criticism had even been published. The fact that the disputed domain name is used for a web page not containing genuine criticism content but only automatically generated links loosely related to the Complainant’s product (as demonstrated by the Complainant’s screenshot dating from before the filing of the present Complaint) constitutes further evidence of bad faith. The fact that the disputed domain name is used in a page containing links to other companies and where the relevant domain names (to which the links point) are systematically put on sale by the Respondent is additional evidence of cybersquatting.

The panel ordered bioderma.sucks transferred.

Two cases, two very different outcomes.

Both complaints were filed at the Czech Arbitration Court by the same lawyer within a few days of each other, and were decided within a week of each other, but by different three-person panels.

With this in mind, it seems likely that both panels were presented with a very similar set of facts and evidence, and that the make-up of the panel was important to which party emerged victorious.

Two additional cases, bfgoodrich.sucks and mandmdirect.sucks, both Honey Salt domains, are currently active at WIPO. It’s unclear whether they were filed before or after Everything.sucks removed its banner ads, which happened about a week ago.

ICANN may not meet again for a looong time

The grim reality of the ongoing coronavirus pandemic seems to be sinking in at ICANN.

Management and board all but confirmed yesterday that ICANN 70, currently still scheduled for Cancun, Mexico next March, will instead take place online via Zoom.

“We would all like to get back to face-to-face, but at this moment Cancun is not looking good for now,” chair Maarten Botterman said during a community discussion about meetings at ICANN 69, also online-only.

CEO Goran Marby said that there’s a “high probability” that Cancun will be virtual.

The session, “Board/Community Focus on ICANN Meetings” was notable for being extremely depressing rather than merely boring.

Several participants spoke in terms of ICANN meetings being virtual “for the foreseeable future”.

“With the world as it is right now, it’s very hard to say when we come back to full-fledged physical meetings,” CEO Göran Marby said.

He said there’s a possibility of “hybrid” meetings, where a face-to-face gathering could take place in a part of the world where the pandemic was under control, but he noted that this would put online participants at a disadvantage.

The overall vibe of the session was that things probably aren’t going to be back to “normal” for some time.

Even though coronavirus vaccines are already reportedly rolling off the presses right now and will be in the hands of governments by the start of 2021, many experts say the logistical problem of distributing vaccine widely enough to ensure herd immunity is tough enough that the “return to normal” is still a long way off.

Meeting participant Susan Anthony predicted that airline fares will be sky-high next year, limiting the ability of many would-be participants, particularly the smaller, less well-funded ones, to show up in person.

She said virtual or hybrid meetings could be around for “the indefinite future”.

Afilias director Jonathan Robinson concurred, saying “the world may have changed immeasurably and somewhat permanently”.

ICANN director Tripti Sinha later compared the post-pandemic world to the aftermath of the 9/11 terrorist attacks.

There was lots of talk about dumping 2020’s practice of holding the meetings during the time zone of the originally planned host country — the Hamburg time zone has been particularly tough on those in the Americas, who have to start their working day at about midnight — in favor of a utilitarian approach that is least inconvenient for the largest number of participants.

It seems to me that one reason that ICANN has yet to formally cancel Cancun — it’s not even on the board’s agenda this week — is that it’s toying with longer-term plan that may mean standard face-to-face ICANN meetings are a long way off indeed.

It’s difficult to believe that it was only June when some ICANN directors thought Hamburg would be sufficiently safe to return to face-to-face meetings this week.

ICANN denies Whois policy “failure” as Marby issues EU warning

ICANN directors have denied that recently delivered Whois policy recommendations represent a “failure” of the multistakeholder model.

You’ll recall that the GNSO Council last month approved a set of controversial recommendations, put forward by the community’s EPDP working group, to create a semi-centralized system for requesting access to private Whois data called SSAD.

The proposed policy still has to be ratified by the ICANN board of directors, but it’s not on the agenda for this week’s work-from-home ICANN 69 conference.

That has not stopped there being some robust discussion, of course, with the board talking for hours about the recommendations with its various stakeholder groups.

The EPDP’s policy has been criticized not only for failing to address the needs of law enforcement and intellectual property owners, but also as a failure of the multistakeholder model itself.

One of the sharpest public criticisms came in a CircleID article by Fabricio Vayra, IP lawyer are Perkins Coie, who tore into ICANN last month for defending a system that he says will be worse than the status quo.

But ICANN director Becky Burr told registries and registrars at a joint ICANN 69 session last week: “We don’t think that the EPDP represents a failure of the multistakeholder model, we actually think it’s a success.”

“The limits on what could be done in terms of policy development were established by law, by GDPR and other data protection laws in particular,” she added.

In other words, it’s not possible for an ICANN working group to create policy that supersedes the law, and the EPDP did what it could with what it was given.

ICANN CEO Göran Marby doubled down, not only agreeing with Burr but passing blame to EU bureaucrats who so far have failed to give a straight answer on important liability issues related to the GDPR privacy regulation.

“I think the EPDP came as far as it could,” he said during the same session. “Some of the people now criticizing it are rightly disappointed, but their disappointment is channeled in the wrong direction.”

He then referred to his recent outreach to three European Commission heads, in which he pleaded for clarity on whether a more centralized Whois model, with more liability shifted away from registrars to ICANN, would be legal.

A failure to provide such clarity would be to acknowledge that the EPDP’s policy proposals are all just fine and dandy, despite what law enforcement and some governments believe, he suggested.

“If the European Union, the European Commission, member states in Europe, or the data protection authorities don’t want to do anything, they’re happy with the situation,” he told registrars and registries.

“If they don’t take actions now, or answer our questions, they’re happy with the way people or organizations get access to the Whois data… it seems that if they don’t change or do anything, they’re happy, and then were are where we are,” he said.

He reiterated similar thoughts at sessions with other stakeholders last week.

But he faced some pushback from members of the pro-privacy Non-Commercial Stakeholders Group, particularly during an entertaing exchange with EPDP member Milton Mueller, who’s unhappy with how Marby has been characterizing the group’s output to the EU.

He specifically unhappy with Marby telling the commissioners: “Should the ICANN Board approve the SSAD recommendations and direct ICANN org to implement it, the community has recommended that the SSAD should become more centralized in response to increased legal clarity.”

Mueller reckons this has no basis in what the EPDP recommended and the GNSO Council approved. It is what the IP interests and governments want, however.

In response, Marby talked around the issue and seemed to characterize it as a matter of interpretation, adding that he’s only trying to provide the ICANN community with the legal clarity it needs to make decisions.

These eight companies account for more than half of ICANN’s revenue

While 3,207 companies contributed to ICANN’s $141 million of revenue in its last fiscal year, just eight of them were responsible for more than half of it, according to figures just released by ICANN.

The first two entries on the list will come as no surprise to anyone — they’re .com money-mill Verisign and runaway registrar market-leader GoDaddy, together accounting for more than $56 million of revenue.

Registries and registrars pay ICANN a mixture of fixed fees and transaction fees, so the greater the number of adds, renews and transfers, the more money gets funneled into ICANN’s coffers.

It’s perhaps interesting that this top-contributors list sees a few companies that are paying far more in fixed, per-gTLD fees than they are in transaction fees.

Binky Moon, the vehicle that holds 197 of Donuts’ 242 gTLD contracts, is the third-largest contributor at $5.2 million. But $4.9 million of that comes from the annual $25,000 fixed registry fee.

Only 14 of Binky’s gTLDs pass the 50,000-name threshold where transaction fees kick in.

It’s pretty much the same story at Google Registry, formally known as Charleston Road Registry.

Google has 46 gTLDs, so is paying about $1.1 million a year in fixed fees, but only three of them have enough regs (combined, about one million names) to pass the transaction fees threshold. Google’s total funding was almost $1.4 million.

Not quite on the list is Amazon, which has 55 mostly unlaunched gTLDs and almost zero registrations. It paid ICANN $1.3 million last year, just to sit on its portfolio of dormant strings.

The second and third-largest registrars, Namecheap and Tucows respectively, each paid about $1.7 million last year.

The only essentially single-TLD company on the list is Public Interest Registry, which runs .org. Despite having 10 million domains under management, it paid ICANN less than half of Binky’s total last year.

The anomaly, which may be temporary, is ShortDot, the company that runs .icu, .cyou and .bond. It paid ICANN $1.6 million, which would have been almost all transaction fees for .icu, which peaked at about 6.5 million names earlier this year.

Here’s the list:

[table id=62 /]

Combined, the total is over $70.5 million.

The full spreadsheet of all 3,000+ contributors can be found over here.

Lockdown bump was worth $600,000 to ICANN, but end of Club Med saves 10x as much

The coronavirus pandemic lockdowns and the resulting bump in domain name sales caused ICANN’s revenue to come out $600,000 ahead of expectations, up 4%, the org disclosed last week.

But ICANN saved almost 10 times as much by shifting two of its fiscal year 2020 public meetings to an online-only format, due to travel and gathering restrictions.

The organization’s FY20 revenue was $141 million, up by $5 million on FY19, against a rounded projection of $140 million. ICANN’s financial years end June 30.

ICANN said it is “uncertain if these market trends will continue”.

Back in April, the organization lowered its revenue forecast for FY21 by 8%, or $11 million.

Expenses were down $11.1 million at $126 million, 8% lower that expectations and $4 million lower than the 2019 number.

That was mostly due to a $6.2 million saving from having two public meetings online-only.

ICANN typically spends $2 million per meeting funding over 500 travelers, both ICANN staff and community members, but that was down to almost nothing for the first two meetings of this year.

Pre-pandemic, ICANN expected these meetings, slated for Cancun and Kuala Lumpur, to cost $4.2 million and $3.4 million respectively, but the switch to Zoom brought them in at $1.4 million and $0.4 million.

ICANN would have occurred some pre-meeting travel expenses for the Cancun gathering, which was cancelled at the last minute, as well as cancellation fees on flights and hotels.

The org has previously stated that the switch away from face-to-face meetings could save as much as $8 million this calendar year.

The rest of the savings ICANN chalked down to lower-than-expected personnel costs, with hiring slowing during the pandemic.

Incidentally, if you’re wondering about the headline above, it’s a reference to a notorious 2009 WSJ article, and outrage about ICANN’s then $12 million travel budget.

Eleven years later, the FY20 travel budget was $15.7 million.

Holy Scheisse! Did you know ICANN 69 starts TOMORROW?

ICANN is starting its ICANN 69 public annual general meeting four days earlier than originally planned, and it appears to have only publicly announced the date change 24 hours in advance.

How’s that for transparency?

Usually, ICANN AGMs kick off formally on the Monday morning and run through the Thursday afternoon, but meetings between community groups start taking place the previous Friday, leading to a seven-day continuous meeting.

For ICANN 69, originally planned for Hamburg but now of course an online-only experience, ICANN has removed the Friday and weekend sessions and split the week in two.

There’ll be three “Community Days” from October 13 (which is tomorrow when I’m posting this but possibly today by the time you read it), three days off, and then four days of “Plenary Sessions”, beginning with the opening ceremony on Monday morning.

The community days include stuff like policy working group meetings, but they also include the top-level interactions between each constituency group, including the Governmental Advisory Committee, and the ICANN board of directors.

These traditional airing of grievances, usually on “constituency day” Tuesday, are where the tensions and hot topics of interest for the whole community are raised, and always worth listening to.

The decision to shake up the schedule appears to have been made some time in September. Last time I checked ICANN’s meetings page, September 2, it still showed the old October 17 start date.

What I find utterly baffling is that ICANN does not seem have made a formal public announcement of the date change, despite having blogged or made announcements about various aspects of the meeting several times.

I genuinely only found out today, reading this blog post that ICANN put out today, just one day before the meeting starts.

It certainly seems that the information has filtered out to the parts of the community that actually need to participate in the various sessions.

But what about the rest of us? Unless you’ve registered and logged in to the ICANN 69 web site since the changes were made, I’m not sure how you were meant to know.

Did you know?

I had plans to get my toenails done tomorrow.

Peaceful transfer of power? GNSO’s next chair is a shoo-in

Unlike other upcoming democratic processes we could mention, it looks like the transition to a new chair of ICANN’s GNSO Council will be peaceful, non-controversial, and probably won’t result in widespread looting and arson.

Philippe Fouquart is the sole candidate, and he’ll be voted in with an open ballot at the ICANN AGM later this month.

As a senior techie for telecoms company Orange, he’s sat on the Council as a representative of the Internet Service Providers Constituency for the last three years. He hails from France.

Fouquart was nominated by the Non-Contracted Parties House. The Contracted Parties House, representing registries and registrars, did not field a candidate.

Unlike normal procedure, which calls for a secret paper ballot, the Council will vote via a simple, public roll-call at the AGM.

He’ll replace Verisign VP Keith Drazek, who’s chaired the Council for the last two years.

In terms of vice-chairs, the CPH has reappointed Pam Little of Chinese registrar Alibaba for another year and the NCPH has selected cybersecurity policy expert Tatiana Tropina to replace Rafik Dammak.

Two American women appointed to ICANN board

In a move that will surprise nobody, ICANN’s Nominating Committee has maintained the status quo on the ICANN board of directors by reappointing two of its previous selections.

NomCom’s two picks are Sarah Deutsch and Avri Doria, both of whom were selected in 2017 and have their first three-year term expiring later this month.

Deutsch is an intellectual property lawyer in private practice. She spent most of her career lawyering for Verizon. She’s also a director of the Electronic Frontier Foundation.

Doria is a consultant who has spent most of her time at ICANN on the non-commercial side of the house.

Both appointees are classified as North American under ICANN’s geographical diversity quotas.

As I’ve previously reported, the reappointments were very likely. Not only are both directors hugely experienced community members, but ICANN had given NomCom strong hints that it wants to increase gender diversity on the board.

That won’t actually happen this year. The other directors whose terms are up this month are all male, and they’ve all either been reappointed or replaced with other men by their respective constituency groups.

Currently, just five of the 16 voting directors are female. Including the four non-voting members, that number rises to seven. With the new NomCom appointees, those numbers will remain the same for at least a year.

UPDATE October 5, 2020: Deutsch tells me she has not been with the Winterfeldt IP Group for two years. Her official bio on ICANN’s web site says she is with that company, but apparently those bios are no longer reliable. She’s now working for herself. My apologies for the error.

Europe’s top dogs could decide the future of Whois

ICANN is pleading with the European Commission for legal clarity to help solve the two-year-old fight over the future of Whois in the age of GDPR.

CEO Göran Marby has written to three commissioners to ask for a definitive opinion on whether a centralized, mostly automated Whois system would free up registries and registrars from legal liability if their customers’ data is inappropriately disclosed.

It’s a question ICANN has been asking for years, but this time it comes after the ICANN community has come up with a set of policy recommendations that would create something called SSAD, for System for Standardized Access/Disclosure.

SSAD is supported by registries, registrars and non-commercial interests, but has been broadly criticized by governments, intellectual property interests, security experts and others as being not fit for purpose.

While it would create a centralized gateway for funneling Whois queries to contracted parties, and an accreditation system for those making the queries, the decision to accept or refuse the query would still lie with registries and registrars and be largely human-powered.

It’s been described as a glorified, $9 million-a-year ticketing system that will fail to provide better access to Whois to those who say they need it (largely the IP interests).

But registries and registrars say they cannot accept a solution that offloads decision-making to a centralized third party such as ICANN, unless that third party shoulders all the legal liability for mistakes, and whether that’s possible is far from clear this early in the life of GDPR.

As Marby told the commissioners:

Legal clarity could mean the difference between ICANN having a fragmented system that routes most requests for access to non-public registration data from requestors to thousands of individual registries and registrars for a decision, on the one hand, versus ultimately being able to implement a centralized, predictable solution in which decisions about whether or not to disclose non-public registration data in most or all cases could be made consistently, predictably, in a manner that is transparent and accountable to requestors and data subjects alike.

In GDPR lingo, the question is who becomes the “controller” of the data in a centralized system. The controller is the one that could get slapped with huge fines in the event of a privacy breach.

There’s a concept of “successive controllers”, where data is passed through a chain of handlers. ICANN wants clarity on whether, should a registrar send data to an ICANN central gateway, its liability ends there, before the final disclosure decision is made.

It’s asking the European Commission to exercise its authority under the GDPR to force the European Data Protection Board to issue a blanket opinion clarifying these issues, with the expectation that SSAD as currently envisaged could evolve over time to be something more like what the IP folk want.

For ICANN, such a ruling could help quell criticism from its influential advisory bodies, notably the Governmental Advisory Committee, which have come out strongly against the SSAD proposals.

If ICANN chooses to wait for the European Commission and EDPB responses to its new request, it’s highly unlikely we’re going to see the ICANN board fully approve SSAD at its annual general meeting later this month.