Facebook thinks ICANN is a bit rubbish

Facebook owner Meta came away from the recent ICANN 82 public meeting unimpressed and wondering why the community doesn’t actually seem to be doing much, according to the company’s representative.

Writing to ICANN’s CEO and chair last week, head of IP and DNS Mia Brickhouse praised ICANN’s organizational skills but said she was “concerned regarding the lack of tangible outcomes relative to the significant community investment of nearly one week in Seattle.”

“While there were pockets of progress, it was challenging to identify concrete policy-oriented outcomes that I would use to mark participation in the Seattle meeting as a productive success,” she said.

“Many participants I spoke with felt the experience was more focused on policy status updates and remaining entrenched in legacy positions, rather than making measurable progress,” she said.

Welcome to ICANN, Mia!

She goes on to criticize the amount of navel-gazing at the meeting and said the current review into ICANN’s meetings strategy should not only focus on cutting ICANN’s costs but also on making meetings produce results.

Meta’s pet issues are Whois and DNS abuse. Its social media sites get a tonne of phishing attacks using maliciously registered domains and the company is not above taking registrars to court if they fail to play along with its enforcement efforts.

The company is fairly influential in policy-making circles, and arguably may become increasingly so over the next few years, depending on how deeply Donald Trump can reach into Mark Zuckerberg’s trousers.

But the Brickhouse letter is just the latest critique of what I and other time-haggard ICANN observers have been banging on about for years — the “Do Nothing” ICANN. I first pointed out in January 2022 that ICANN hadn’t actually done anything in about five years, something ICANN acknowledged a few months later.

To be fair, the Org has actually started producing tangible output since then. The Registration Data Request System is, whatever its flaws, a thing that the ICANN community came up with and the ICANN Org delivered.

But RDRS, ICANN’s response to the General Data Protection Regulation, took longer to create and deploy than the GDRP itself. ICANN’s multistakeholder model was slower than the notoriously lumbering EU legislative process.

The next round of the new gTLD program is another deliverable that also seems to be hitting its deadlines ahead of a Q2 2026 launch. But it has still taken longer than NASA’s Apollo Program to get off the ground.

One of the most on-point things I’ve read this year came from GoDaddy policy veep James Bladel, who wrote in his board election candidacy statement that “ICANN must stop telling the world why its role is important and start showing clear examples of multistakeholder successes.”

While Bladel did not get elected, Brickhouse’s letter points to an exchange in Seattle between one current and one former ICANN director, in which both parties agreed that “the current process is not working”.

Michael Palage, a freelance consultant who served a term on the board two decades ago, took to the Public Forum mic to complain that ICANN and its contracted parties are increasingly turning to bilateral contract amendments to address issues of concern, rather that having the whole community come up with formal consensus policies.

Becky Burr, approaching the end of her nine-year directorship, concurred that the “policy development process is not efficient and it’s not working as it should”, but disagreed that bilateral deals were not appropriate for addressing pressing issues.

You’re got two people, both who’ve served on the ICANN board and have over half a century of ICANN experience between them, agreeing that the current multistakeholder policy-making model isn’t working.

I’m certain there are other recent examples of long-serving community members criticising the process that are not readily springing to mind.

Sadly, ICANN’s usual response to broad community concerns is to launch a consultation or working group or comment period or somesuch, which often adds to the bloat and drains already jaded volunteers’ available work hours.

I can’t see anything changing any time soon, but there is a public comment period on the meetings strategy still open here.

ICANN spending $365,000 a year on coffee and booze

Scrapping coffee breaks and cocktail receptions is among a raft of proposals ICANN has floated in an effort to cut the cost of its public meetings and get its budget under control.

The Org is also thinking about making some meetings shorter or going online-only in order to cut costs, which were estimated to come in at around $14 million in ICANN’s current fiscal year.

But ICANN has shelved the idea of starting to charge community members to attend, after many pointed out that it could disenfranchise less well-funded would-be attendees.

The proposals, which were developed from seeds put forward by Org and refined with a small group of community volunteers and public sessions at recent meetings, have now been put out for formal public comment

One eyebrow-raising stat, new to me, was that the “current estimated cost of networking receptions and coffee breaks is approximately $365,000 annually”. Meetings typically have two coffee breaks per day and two scheduled evening receptions per meeting.

While $365,000 may seem like a lot, consider that it’s spread over three meetings and about 2,000 attendees per meeting. If each attendee on average has a couple of coffees and a couple of glasses of wine at each event, one could easily argue it’s not really that expensive per head.

But the proposals out for comment suggest that any networking event that does not have an external sponsor could be scrapped.

ICANN’s also talking about shortening its Community Forum — the first of the year’s three meetings, typically held in March — by one day by shifting the Public Forum from Thursday to Monday, so the venue’s main ballroom only has to be rented for one day.

Org reckons it could save $460,000 a year by dropping the last day altogether, also eliminating one hotel night for each funded traveller. It turns out the Thursday sessions are lightly attended anyway, with room utilization rates at 20% to 30%, compared to the 60% to 80% earlier in the meeting.

ICANN reckons it could also save money — 10% to 20% per meeting, which works out to many hundreds of thousands of dollars — by switching to an online-only or hybrid model for one meeting a year. Such meetings were the standard during the recent pandemic.

It is also considering whether to reduce the variety of cities it holds its meetings in. It reckons it could cut costs by picking more economical locations and signing multi-year bulk deals with venues.

The proposals come almost a year after ICANN announced it was looking to slash its budget in response to stagnating revenue.

The proposals are now open for comment until May 19.

Regulator going after suicide site that even Epik banned

UK communications regulator Ofcom has opened its first public investigation under the new Online Safety Act, targeting a notorious forum that has been linked to dozens of suicides globally.

The probe demands that the site in question provide evidence that it protects its UK users from illegal or harmful content — in this case “encouraging or assisting suicide”.

Failure to do so could lead to Ofcom fining the site’s owners millions, or seeking court orders to have other companies, such as advertisers or internet service providers, disrupt its business, Ofcom said.

The law is often talked about in the context of large social media companies such as Facebook and TikTok, which are often accused of algorithmically instilling suicide ideation in children, but it applies to any service that allows user-to-user content.

This apparently extends to web forums. Some non-controversial sites have already closed down rather than bear the expense of complying.

The Act doesn’t specifically mention domain registrars and registries as being covered by its provisions, but GoDaddy, for example, certainly seems to think it does. It even reckons its domain search feature might be covered.

Ofcom isn’t naming the suicide site, so I won’t either, but it’s not hard to identify by connecting a few dots.

It uses a domain in Verisign’s .net, currently registered with Cloudflare’s registrar. Both registry and registrar are US companies.

The site in question lost its original .com name in 2021 when Epik — yes, even the controversial, free-speech-loving old Epik under Rob Monster — reportedly thought it was too hot to handle.

The site’s administrators have today called the probe “blatant overreach” and accused Ofcom of a “censorship agenda”. They’re currently begging users for cryptocurrency donations.

Media investigations have linked the site to more than 50 suicide deaths. In some cases, the site’s users reportedly goaded their victims, including some children, to take their own lives.

The admins, knowing the site is a target, have previously said they have back-up domains that they could switch to within minutes if they get shut down.

UK’s Nigel Hickson has died

Long-serving ICANN community member and UK government representative Nigel Hickson has died, according to friends and colleagues.

He’s said to have died at the weekend following a battle with cancer.

While the loss will be felt most keenly by his family, Hickson’s absence will also be felt by the ICANN community and wider domain name industry.

Hickson was most recently head of internet governance policy at the UK’s Department for Science, Innovation and Technology, but he might be better known to the domains community as the country’s representative on ICANN’s Governmental Advisory Committee.

He was until a few weeks ago one of the GAC’s vice-chairs and as such often a prominent and vocal presence during governmental discussions of ICANN’s policies at public meetings.

But he also engaged with the domain investor community, showing up to deliver the UK government’s perspectives at conferences such as the London Domains Summit.

Prior to joining the government, Hickson spent eight years working for ICANN as a vice president with a government engagement portfolio.

I only met Nigel on a handful of occasions, but he always came across as a thoroughly pleasant chap with a surprising sense of humor.

Hickson is said to be survived by his wife and daughter, who have our condolences.

Latest ICANN salary porn ruins my terrible pun

I’d always planned, if it turned out ICANN’s former interim CEO Sally Costerton was getting paid an absolutely, ridiculously, eye-popping pay packet, that it might be amusing to try to pin the nickname “Cost-a-tonne” on her.

Thanks. I’m here all week. Try the turbot.

But she wasn’t even ICANN’s highest-compensated employee last year, according to the Org’s latest tax return, which it published yesterday. That privilege went to general counsel John Jeffrey.

While her immediate predecessor Goran Marby made over a million bucks in his final years, Costerton made a more modest $835,585, compared to Jeffrey’s $837,137, the return states.

It’s the first time Costerton’s compensation has been disclosed. Previously, she was paid through her consulting company.

The form 990 (pdf) lists the 20 employees who get paid the most, with total compensation starting at $217,073. The top 10 employees received over half a million dollars in total compensation.

Some former ICANN staffers have recently said publicly that the figures in the 990 might give a misleading impression of how well rank-and-file employees are compensated.

On the corporate side, it was a relatively poor year for Jones Day, ICANN’s incumbent law firm and highest-paid contractor, which billed $3,617,243 compared to the $4,606,859 in the previous year. It was getting closer to $9 million a year not too long ago.

The top five contractors saw a new entrant at five, with HR firm ADO Professional Solutions getting $980,970 for recruitment services.

I get a wrongful kicking as .su registry denies turn-off plan

The registry for the former Soviet Union’s .su ccTLD has denied that ICANN plans to kick it off the internet, giving three reasons why its over 100,000 domains are safe.

RosNIIROS pointed to Russian law, ICANN ccTLD policy, and the lack of any formal retirement notice as reasons why the ccTLD isn’t going anywhere. The registry said in a post on its web site:

In connection with the media reports about the possible closure of the .SU domain zone, we inform you that this information periodically appears in the public domain, but does not correspond to reality. The registry (RosNIIROS) does not plan to liquidate the .SU domain and no formal actions have been taken by ICANN

The registry said that .su has been formally recognised under Russian law, via a ruling of the telecoms regulator Roskomnadzor, alongside .ru and .рф, as part of the “Russian national domain zone”.

It added that ICANN policy does not permit the Org to retire .su:

According to the procedure approved in 2022 by ICANN, a country code top-level domain (ccTLD) can be removed from the DNS root zone only if the corresponding two-letter code is excluded from the ISO 3166 standard. Currently, the code “SU” is included in the ISO 3166 list with the status of “exclusively reserved”

The machine translation may be a bit wonky there, as the term used in English is “exceptionally reserved”. That’s the ISO 3166 status also enjoyed by the UK (.uk), Ascension Islands (.ac) and European Union (.eu).

But the ICANN policy on retiring ccTLDs specifically calls out .uk, .ac and .eu as being “grandfathered” in. It doesn’t mention .su at all, and it’s not at all clear from my reading whether being “exceptionally reserved” offers .su blanket protection.

ICANN’s former chair didn’t seem to think so in 2022 when he said, “the Soviet Union is no longer assigned in the ISO 3166-1 standard and therefore is no longer considered eligible for a ccTLD.”

RosNIIROS also referred its customers to the recent comments of ICANN director Becky Burr, who on March 12 had denied that ICANN had kicked off formal retirement proceedings.

I hadn’t listened to this session live, but I caught up with the recording today and have to say it’s a bit of an eye-opener. Burr said:

Let me just take the elephant in the room. We all saw the Domain Incite report on .su. I just want to say to everybody, there has been no formal letter kicking off any process on there, that’s clear. We are looking at the ccNSO policy, and I don’t want to say anything more about that other than to say whatever was in the Domain Incite article, there has been no formal initiation of a retirement process

I’m not sure whether to be irritated or flattered.

On the one hand, I seem to have received a public dressing down with the clear implication that there was some inaccuracy in my reporting, which is never nice. On the other hand, I didn’t write the damned article she’s referring to.

Burr seems to have read Domain Name Wire’s wonderful scoop on “plans to retire the [.su] domain” and just assumed it was my work. I’ll have to take it as a compliment, I guess. Cheers Becky!

The DNW article reported from the outset that a planned notice of retirement had not yet been sent, but that informal outreach had occurred, so I don’t even think there’s a clear allegation of inaccuracy here. For what it’s worth, I trust the reporting.

The day after Burr’s comment, ICANN CEO Kurt Lindqvist also said publicly that there had not yet been a “formal” notice of retirement.

“No timeline” to retire Soviet Union from the DNS

There is currently “no timeline” to remove the Soviet Union’s ccTLD from the internet, according to ICANN’s new CEO.

Asked by yours truly during the Public Forum at ICANN 82 whether retirement proceedings had been initiated against .su, Kurt Lindqvist responded, according to the real-time transcript:

ICANN has been in discussions with the managers of .su regarding retirement of the ccTLD for many, many years. There has not been sent a formal notice of removal to the ccTLD manager and no timeline for sending one, discussions will be keep on going and following the ccNSO retirement policy.

The words “formal notice of removal” might be doing a lot of heavy lifting there.

Domain Name Wire scooped earlier this week that on February 8 ICANN had privately told Russian Institute for Development of Public Networks (ROSNIIROS), the .su registry, that it planned to retire the ccTLD by 2030.

DNW noted that a formal notice of removal had been due to be sent and published February 13, but had not.

With Lindqvist today saying that there is “no timeline for sending one”, it seems the matter might have been put to bed for now.

It would have been an incredibly ballsy move to start the process of taking down .su — beloved by Russians and groups in Russian-occupied Ukraine — at this particular point in history.

At the time DNW reported ICANN’s letter to ROSNIIROS was sent, US president Donald Trump had yet to publicly begin peace talks with Russia and Ukraine, but his openly pro-Russian statements on the conflict since his February 12 phone call with Vladimir Putin have alarmed many.

Trump probably isn’t an FSB asset, but he certainly plays one on TV.

Would ICANN want to risk pissing off the unpredictable leader of the country whose jurisdiction it lies within? Or Russia, which might try to make its life difficult in other internet governance fora?

Three years ago, at ICANN 73, ICANN’s then-chair said that the Soviet Union, which disbanded over 30 years ago, is “no longer considered eligible for a ccTLD”.

I first floated the idea of ICANN taking down .su the day after the 2022 Ukraine invasion.

ICANN to kill off 60-day domain transfer lock

ICANN is set to kill off its unpopular 60-day transfer lock policy, following a vote at ICANN 82 in Seattle this week.

The GNSO Council yesterday voted to accept the final report of its Transfer Policy working group, a mammoth 163-page document that contains 47 recommendations affecting all areas of domain transfers.

The removal of the transfer lock is perhaps the biggest change to the 20-year-old policy for domain registrants.

Under the current policy, when you buy a domain name from another registrant or change your name, organization or email address, you trigger a lock that prevents you transferring your domain to another registrar for 60 days.

It was designed as an anti-fraud measure, stopping domain thieves bouncing their stolen names to sleazy registrars to avoid them being recovered by their victims.

But is has proved unpopular over the years with registrants that want to consolidate their portfolios under their preferred registrar and the new policy would remove the lock entirely.

It would also remove the requirement for both gaining and losing registrants (ie buyer and seller) to be notified when a change of registrant occurs, on the basis that notifications don’t provide much protection when the losing registrant’s email has already been compromised.

The whole process governing changes to registrant data is going to be spun out into a separate Change of Registrant Data Policy, because maybe it didn’t belong in the Transfer Policy in the first place.

The newly approved changes will also introduce two new locks that registrars currently may, but are not required to, impose — there’s going to be mandatory 720-hour (30-day) locks on domains that have just been created or just transferred in.

Any registrars that currently impose a longer lock will have to reduce it to 720 hours and any registrar that does not have such a lock will be required to implement one.

The GNSO says these month-long locks will help reduce credit card fraud and help comply with trademark complaints such as UDRP.

There are dozens of other changes coming that do not relate to locks.

For example, the list of reasons a registrar may deny a transfer has been updated to include a reference to DNS abuse, as currently defined in the ICANN registry and registrar contracts.

There are numerous changes of terminology, required notifications, and instructions for handling Transfer Authorization Codes, all of which registrars and registrars will have to implement if they want to stay compliant with their ICANN contracts.

There are also changes to bulk portfolio transfers, limiting registries to a charge of $50,000 for portfolios over 50,000 domains.

The changes would also incorporate an updated Bulk Transfer After Partial Portfolio Acquisition (BTAPPA) directly into the Transfer Policy, meaning registries no longer have to request it from ICANN via the Registry Services Evaluation Process.

The recommendations, unanimously approved by the GNSO Council yesterday, will now go to ICANN’s board of directors for final approval. The final updated Transfer Policy will then be written by an ICANN/GNSO team.

Registries and registrars will then presumably be given time to implement the policy before it becomes law and Compliance comes sniffing around for infractions. We’re talking about at least 18 months before the changes go live, I reckon.

If you have a high tolerance for boredom, the full list of recommendations can be read in this PDF.

NomCom confirms Americans rejected from ICANN board

North American candidates for ICANN’s board of directors are having their applications politely rejected, the Nominating Committee has confirmed.

Speaking to the GNSO Council at ICANN 82 in Seattle yesterday, NomCom chair-elect Tom Barrett said ICANN’s rules forbid the committee from now considering candidates from the region.

“When we opened the application window, January 15, there were no geographic restrictions for these three positions,” he said. “As you know, that has now changed…. We’ll be maxed out terms of the geographic limitation for North America.”

The specific changes of circumstance are the recent elections of Canadian Byron Holland by the ccNSO and American Greg DiBiase by the GNSO.

ICANN’s bylaws state that no more than five voting members of the board, excluding the CEO, may be from the same region. The board already has three other North Americans.

Candidates from North America who had already applied for the three open board seats will be emailed to inform them they are no longer eligible, Barrett said.

Candidates that had identified as North American but have dual citizenship with a country in a different region are eligible to reapply under their other affiliation, he said.

ICANN turns to AI and crowdsourcing for new gTLD program

ICANN says it will use a combination of AI and crowdsourcing to translate new gTLD program materials on the cheap.

Org said in a blog post that when a community member trying to drum up interest in new gTLDs in their local community needs some official ICANN documents in an unsupported language, ICANN will prepare a translation on demand.

The first run will be done with AI machine translation, and the draft will be posted on a community wiki for review by volunteers who can read the relevant language before ICANN finalizes and publishes a final PDF.

ICANN seems ready to post drafts of documents such as FAQs and info sheets in languages such as Hindi, Italian and Portuguese after next week’s ICANN 82 public meeting.

Program documents are usually only available in the six official UN languages — Arabic, Chinese, English, French, Spanish, and Russian — so this project should bring the new gTLD program to a much wider audience.

Using AI and volunteers should mean it costs almost nothing beyond the work hours ICANN staff put in to administer it.

ChatGPT tells me that there are 195 to 200 official national languages in the world and 3,500 to 4,000 written languages altogether, but I didn’t check whether those numbers are correct.

If the AI is wrong, let me know in the comments.