Chehade says “no delay” as Verisign drops a security bomb on ICANN

Verisign today said that the new gTLD program presents risks to the security of the internet, but ICANN CEO Fadi Chehade told DI that he’s not expecting any new delays.
The .com behemoth tonight delivered a scathing review of the security and stability risks of launching new gTLDs on ICANN’s current timetable.
The new Verisign report catalogs the myriad ways in which ICANN is not ready to start approving new gTLDs, and the various security problems they could cause if launched without due care.
It strongly suggests that ICANN should delay the program until its concerns are addressed.
But Chehade, in an exclusive interview with DI tonight, rebutted the already-emerging conspiracy theories and said: “There’s nothing new here that would cause me to predict a new delay.”
What does the Verisign report say?
It’s a 21-page document, and it covers a lot of ground.
The gist of it is that ICANN is rushing to launch new gTLDs without paying enough attention to the potential security and stability risks that a vast influx of new gTLDs could cause.
It covers about a dozen main points, but here are the highlights:

• Certificate authorities and browser makers are not ready. CAs have long issued certificates for use on organizations’ internal networks. In many cases, these certs will use TLDs that only exist on that internal network. A company might have a private .mail TLD, for example, and use certs to secure those domains for its users. The CA/Browser Forum, which coordinates CAs and browser makers, has decided (pdf) to deprecate these certs, but not until October 2016. This, Verisign says, creates a “vulnerability window” of three years during which attackers could exploit clashes between certs on internal TLDs and new gTLDs.
• Root server operators are not ready. The organizations that run the 13 DNS root servers do not currently coordinate their performance metrics, Verisign said. This makes it difficult to see what impact new gTLDs will have on root server stability. “The current inability to view the root server system’s performance as a whole presents a risk when combined with the impending delegation of the multitude of new gTLDs,” Verisign said.
• Root zone automation isn’t done yet. ICANN, Verisign and the US Department of Commerce are responsible for adding new gTLDs to the root zone, and work on automating the “TLD add” process is not yet complete. Verisign reckons this could cause “data integrity” problems at the root.
• The Trademark Clearinghouse is not ready. Delays in finalizing the TMCH technical specs mean registries haven’t had sufficient time to build their interfaces and test them, and the TMCH itself is a potential single point of failure with an unknown attack profile.
• Universal acceptance of new TLDs. Verisign points out that new gTLDs won’t be immediately available to users when they go live due to lack of software support. It points specifically to the ill-maintained Public Suffix List, used by browsers to set cookie boundaries, as a potential risk factor.
• A bunch of other stuff. The report highlights issues such as zone file access, data escrow, Whois and pre-delegation testing where Verisign reckons ICANN has not given registries enough time to prepare.

Basically, Verisign has thrown pretty much every risk factor it can think of into the document.
Some of the issues of concern have been well-discussed in the ICANN community at large, others not so much.
Yeah, yeah, but what did Fadi say?
Chehade told DI this evening that he was surprised by the report. He said he’s been briefed on its contents today and that there’s “nothing new” in it. The program is “on track”, he said.
“What is most surprising here is that there is nothing new,” he said. “I’m trying to get my finger on what is new here and I can’t find it.”
“It was very surprising to see this cornucopia of things put together,” he said. “I’m struggling to see how the Trademark Clearinghouse has a security impact, for example.”
He added that some of Verisign’s other concerns, such as the fact that the Emergency Back-End Registry Operator is not yet up and running, are confusing given that existing TLDs don’t have EBEROs.
The report could be divided into two buckets, he said: those things related to ICANN’s operational readiness and those things related to the DNS root.
“Are these operational issues really security and stability risks, and given that we can only launch TLDs when these things are done… what’s the issue there?” he said.
On the DNS root issues, he pointed to a November 2012 report, signed by Verisign, that said the root is ready to take 1,000 new gTLDs a year or 100 a week.
So the Conspiracy Theory is wrong?
When ICANN held a webinar for new gTLD applicants earlier this week, Chehade spent an inordinate amount of time banging home the point that security and stability concerns underpin every stage of the new gTLD program’s timetable.
As this slide from his presentation (click to enlarge) illustrates, security, stability and resiliency or “SSR” is the foundation of every timing assumption.
He said during the webinar:

Nothing will trump the gTLD process, nothing, but the SSR layer. The SSR layer is paramount. It is our number one responsibility to the internet community. Nothing will be done that jeopardizes the security and stability of the internet, period.
At any time if we as a community do not believe that all relevant security and stability matters have been addressed, if we do not believe that’s the case, the program freezes, period.
There is too much riding on the DNS. Hundreds of billions of dollars of commerce. Some may say livelihoods. We will not jeopardize it, not on my watch, not during my administration.

During the webinar, I was lurking on an unofficial chat room of registries, registrars and others, where the mood at that point could be encapsulated by: “Shit, what does Chehade know that he’s not telling us?”
Most people listening to the webinar were immediately suspicious that Chehade was expecting to receive some last-minute security and stability advice and that he was preparing the ground for delay.
The Verisign report was immediately taken as confirmation that their suspicions were correct.
It seemed quite likely that ICANN knew in advance that the report was coming down the pike and was not-so-subtly readying applicants for a serious SSR discussion in Beijing a little over a week from now.
When I asked Chehade a few times whether he knew the Verisign report was coming in advance, he declined to give a straight answer.
My feeling is he probably did, though he may not have known precisely what it was going to say. The question is perhaps less relevant given what he said about its contents.
But what Chehade thinks right now is probably not the biggest concern for new gTLD applicants.
The GAC’s reaction is now critical
The Verisign document could be seen as pure GAC fodder. How the Governmental Advisory Committee reacts to the report, which was CC’d to the US Department of Commerce, is now key.
The GAC has been banging on about root system stability for years and will, in my view, lap up anything that seems to prove that it was right all along.
The GAC will raise the Verisign report with ICANN in Beijing and, if it doesn’t like what it hears, it might advise delay. GAC advice is a lot harder for ICANN’s board to ignore than a self-serving Verisign report.
What’s Verisign playing at?
So why did Verisign issue the report now? I’ve been unable to get the company on the phone at this late hour, but I’ve asked some other industry folk for their responses.
Verisign’s super-lucrative .com contract is the obvious place to start theorizing.
Even though the company has over 200 new gTLD back-end contracts — largely with dot-brand applicants — .com is its cash cow and new gTLDs are a potential threat to that business.
The company has sounded a little more aggressive — talking about enforcing its patents and refusing to comply with ICANN’s audits — since the US Department of Commerce ordered a six-year .com price freeze last November.
But Chehade would not speculate too much about Verisign’s motives.
“I can’t read why this report and why now,” Chehade said. “Especially when there’s nothing new in it. That’s not for me to figure out. It’s for me to look at this report with a critical eye and understand if there’s something we’re not addressing. If there is, and we find it, we’ll address it.”
He pointed to a flurry of phone calls and emails to his desk after the Initial Evaluation results started getting published last week for a possible reason for the report’s timing.
“I think the real change that’s happened in the last few months is that the new gTLD program is now on track and for the first time people are seeing it coming,” he said.
Competitors were more blunt.
“It’s a bloody long report,” said ARI Registry Services CEO Adrian Kinderis. “Had they put the same amount of effort into working with ICANN, we’d be a lot better off on the particular issues.”

Loophole gives trademark owners unlimited Clearinghouse records

Trademark owners will be able to add potentially thousands of strings to the Trademark Clearinghouse due to a recently introduced loophole, it emerged last night.
ICANN recently said that it will allow mark holders to add up to 50 strings related to their trademarks to their TMCH records, if the strings have been abused in the past.
It was one of the controversial “strawman” proposals that ICANN decided to adopt earlier this month.
Companies would be able to get protection for “mark+keyword” strings, for example, if a UDRP decision or court ruling had previously found that the strings had been cybersquatted.
The 50-string cap appeared to have been picked rather arbitrarily, but it turns out it’s more-or-less irrelevant anyway.
ICANN confirmed on its webinar for new gTLD applicants last night that the limit is 50 additional strings per entry in the Clearinghouse, not 50 strings per trademarked string.
What this means is that a company that has registered its trademark in multiple jurisdictions will be able to get 50 extra strings for each of those marks it enters into the Clearinghouse.
If Apple had a registered mark for “Apple” in the US and a registered mark for “Apple” in Bolivia, it would be able to submit both to the Clearinghouse and get an additional 100 “apple+keyword” records.
If it had the mark registered in 100 countries, it could put up to 5,000 more strings in the Clearinghouse.
Each string could be used to generate Trademark Claims notices, but not to secure registrations during Sunrise periods.
The apparent loophole and its implications were raised by Reg Levy of Minds + Machines during last night’s ICANN call.
In practice, the number of additional strings mark holders would qualify for would be capped by the number of trademark jurisdictions in the world and/or the number of UDRP decisions they’d won.
Few companies have secured more than a few hundred domains at UDRP to date, meaning it won’t be too difficult for trademark owners to get Trademark Claims protection for basically any previously cybersquatted string.

ICANN: about 274 new gTLD objections filed

There have been roughly 274 formal objections against new gTLD applications, ICANN said last night.
During a webinar with applicants, new gTLD program manager Christine Willet broke down the numbers. There have been:

• 67 String Confusion Objections — these are of the “your TLD looks like my TLD” variety.
• 71 Legal Rights Objections — “Your TLD looks like my trademark”
• 23 Limited Public Interest Objections — “Your TLD infringes human rights”
• 113 Community Objections — “Your TLD screws over my community”

Willett stressed that the numbers are based on ICANN’s non-comprehensive insight and subject to a couple of caveats.
The number could be higher if ICANN was not copied in on some objections sent to arbitration panels, or lower if the panels throw some out for not passing baseline administrative checks.
Judging by the small number of objections to be revealed by the World Intellectual Property Organization — which is handling trademark disputes for ICANN — most LROs so far are applicant versus applicant.
The International Chamber of Commerce has not yet published any information about Community Objections or Limited Public Interest Objections.
The International Center for Dispute Resolution has only revealed one String Confusion Objection so far, which we reported on a couple weeks ago.

Chehade to play hard-ball over unilateral right to amend?

ICANN CEO Fadi Chehade has reportedly indicated that the unilateral right to amend powers ICANN wants to put in its registry and registrar contracts are non-negotiable.
Speaking at a meeting of the Association of National Advertisers last week, Chehade is reported to have said: “I’m not going to back off this one.”
He is understood to have been referring to the changes ICANN wants to impose on the base new gTLD Registry Agreement and the Registrar Accreditation Agreement.
Amy Bivins of Bloomberg BNA’s Electronic Commerce & Law Report caught the speech live and tweeted the following:

Chehade quotes on RAA: “I cannot live with a perpetual agreement,” and “I’m not going to back off this one.”

— Amy E. Bivins (@AmyEBivins) March 20, 2013

Bivins’ full report is available behind BNA’s paywall.
The unilateral right to amend is just about the most controversial thing ICANN has proposed in a while.
It would give ICANN’s board of directors the power to make changes to both agreements in situations where registrars or registries cannot agree among themselves to a “special amendment” but there’s agreement by other community members that the change is required.
Registries and registrars argue that a contract in which one party has the power to change the agreement without the consent of the other is not really a contract at all.
But ICANN says the powers are needed, partly to redress existing imbalances: the fact that the RAA and RA both last for 10 years and that the RA has a presumptive right of renewal.
Without the right to change the RA over the protests of the registries, it’s possible that in future proposed changes could be vetoed by registries whose interests are not aligned with the “public interest”, ICANN argues.
ICANN says that it’s impossible to know how consolidation, future new gTLD rounds and power shifts in the ICANN community will affect the balance of power, meaning it needs a way to resist a registry choke-hold should the situation arise.
I suspect the fact that it’s taken about three years to get close to adding the recommendations of law enforcement relating to registrar conduct to the RAA may also have something to do with it.

ICANN to adopt most of the new gTLD “strawman”

ICANN has given a boost to trademark owners by saying it will implement most of the controversial “strawman” solution to extend protections under the new gTLD program.
In a video just posted to ICANN’s web site, CEO Fadi Chehade said that Claims 2 and the Limited Preventative Registrations proposals have been thrown out for the moment as matters requiring policy work.
But many more aspects of the strawman have been classed as “implementation” and will go ahead.
This means:

• A mandatory 30-day notice period before sunrises begin.
• Trademark Claims extended from 60 to 90 days.
• Tradermark owners will be able to add up to 50 confusingly similar strings to each of their Trademark Clearinghouse records, provided the string had been part of a successful UDRP complaint.

Chehade said:

We are going to implement a 30 day notice period before each sunrise. We’re also going to extend the Trademark Claims period from 60 to 90 days. The Claims 2 period which was discussed frankly did not receive a lot of support from many of you so we’re going to let that go for now.
And then finally there was a lot of discussion about extending the Trademark Claims protection to abuse names and after much debate on whether this is a new program or an extension of what we’re doing we came to the conclusion it is an implementation extension and we will move forward with that.

In the video, Chehade also says that ICANN is on track to start publishing the first results of new gTLD initial evaluations this Friday, as expected.
But he warned that if applicants and registrars do not agree on the proposed Registry Agreement and Registrar Accreditation Agreement, ICANN might miss its April 23 deadline for approving the first gTLDs.
He said:

Let me be clear: if we do not come together towards an agreement on these things we might experience a delay in the program, which I have committed to you that we will be ready for on April 23rd. So from an ICANN staff standpoint and operations standpoint we remain ready to request new gTLDs for delegation on April 23rd. But without these agreements we might experience a delay.

He directly referenced the massive sticking point in these discussions: the fact that ICANN wants to introduce a unilateral right of amendment into both contracts.
Here’s the full video:

Tempted by the Caesar solution [Guest Post]

The ICANN leadership is in a hurry, so to get things done, it is cutting corners.
One such attempt at going straight around a bend, the proposed changes to the new gTLD registry contract giving the ICANN Board unilateral right of amendment, has raised the registries’ ire.
ICANN’s other group of contracted parties (i.e. entities that must contract directly with ICANN to operate), the registrars, are also up in arms following ICANN’s inclusion of the same proposal at the eleventh hour of ongoing negotiations on their contract.
ICANN’s new leadership team, headed by newly appointed CEO Fadi Chehadé, has been rightly praised since he took office in the second half of 2012. This team has a business background, and it is attempting to apply business logic and business solutions to a number of obvious problems with ICANN.
The main one is predictability. ICANN is just not good at setting timelines, or keeping to those timelines it does manage to set.
In the past, that used to be annoying to stakeholders. But since the Board approved the new gTLD program in 2008, this trait has become excruciating.
This program has spawned a new industry, bought new interests into the ICANN environment, generated large-scale investments on the premise of future TLDs, and shone the spotlight on ICANN’s weaknesses to such business ventures.
Having a constantly slipping timeline as the new gTLD program did through much of its implementation phase, from that 2008 Board green light to the June 2011 Board resolution finally turning it into an operational reality, is a nightmare for any business.
So trying to fix this is a worthy goal. But the ICANN model is not only about business. It is first and foremost about community-driven policy-development and oversight. The new gTLD program is the result of such a process. One that the new ICANN leadership is finding cumbersome enough to want to cut through.
There have been a few mistakes made in this area in the last few months, but they seemed like honest missteps from a motivated team of result-getters. A team that apologized for those mistakes when they became apparent. A welcome change at ICANN.
But now, almost six months into the new leadership’s reign the veil is starting to lift and the leadership’s real visage to appear.
Last week, ICANN’s policymaking body for gTLDs, the GNSO, was unanimous in its denunciation of the leadership’s attempts at making the ICANN train go faster than it was engineered to.
During the GNSO Council’s monthly teleconference, the various groups that make up the GNSO’s diverse community all seemed to speak with one voice.
In a blog post written after the call and entitled “Clearing Up the Logjam: Time for ICANN to Drop Request for a Unilateral Right to Amend the Agreements”, GNSO Councillor Jeff Neuman, a representative of the Registry Stakeholder Group and a past Vice Chair of the Council, said the following:

A very rare thing happened in the GNSO Council meeting this week—the ICANN community spoke with one voice. Registries, registrars, non-commercial interests, new TLD applicants, IP owners and businesses unanimously and unambiguously agreed that giving ICANN a “unilateral right to amend” the registry and registrar agreements is not compatible with ICANN’s bottom-up processes and poses a fundamental threat to the multi-stakeholder model. There is true consensus that this change should be rejected.

ICANN COO Akram Attalah participated in the GNSO Council meeting and explained that this was not a done deal and that the leadership was in listening mode.
Except it all seems to be going in one ear and out the other.
A couple of days later, on March 15, ICANN Staff gave the Council an unofficial response by publishing a paper in which it explains its rationale for the unilateral change suggestion. It says:

The Board-approved amendment process is drafted to address a key concern of ICANN in this changing marketplace. What if the gTLD registration market develops in a way that is anticonsumer, yet very favorable to the existing registries or registrars. In this situation, it would be against the business interests of the incumbent registries or registrars to adopt a change – even when the broader community supports the change. Particularly in light of the “perpetual” renewal terms that are already in place within the proposed agreements, this limited power of the Board is the only way to introduce this type of change over the life of the agreements.

The real message is clear. The current leadership does not trust the ICANN multi-stakeholder bottom-up policy development process. Period.
So in cases of extreme necessity, the Board must have absolute power to enact the changes it sees fit. Experienced ICANN community member and former GNSO Council Chair Avri Doria calls this leadership’s tenure ICANN 3.0, and charts ICANN’s progress thus: “ICANN 1.0 – Democracy, ICANN 2.0 – Oligarchy, ICANN 3.0 – Imperium.”
Is a term which describes the absolute power given to the rulers of ancient Rome suited to ICANN? Of course not. But if a little caricature can help turn the ICANN leadership away from this temptation to get things done at all costs, then maybe it is needed.
This is a guest post by domain name industry consultant Stephane Van Gelder of Stephane Van Gelder Consulting. He has served as chair of the GNSO Council and is currently a member of ICANN’s Nominating Committee.

At-Large votes to object to .health gTLD bids, but Afilias gets a pass

ICANN’s At-Large Advisory Committee has voted to object to three of the four applications for the .health gTLD.

Afilias, which is one of the applicants, will not receive an ALAC objection. By a single vote, ALAC decided not to go after its application.
Fourteen of the 15-member ALAC panel voted on Tuesday. For DotHealth LLC’s bid, the yes/no/abstain vote was 8/3/3; dot Health Ltd’s was 10/3/1, and Donuts’ was 10/3/1.
Afilias managed to get one extra “no” vote (its result was 7/4/3). so with only 50% of the voters voting “yes”, the motion to object failed.
The ALAC did not vote on .健康, which means “healthy” or “wellness” in Chinese, despite earlier indications that it would.
The identities of the voters and the way they voted does not appear to have been revealed.
The objections will be of the Community or Limited Public Interest variety, and paid for by ICANN.
Healthcare-related gTLDs are already the most controversial of those being applied for.
Each .health bid received four Governmental Advisory Committee Early Warnings late last year, and earlier this week the Independent Objector’s list of 24 objections was dominated by medically oriented strings.

Demand Media hit with first new gTLD objection

With the deadline for filing objections against new gTLD applications fast approaching, the first such objection has been revealed.
Starting Dot, which has applied for .immo and other strings, has filed a String Confusion Objection against Demand Media’s .immobilien bid, according to the International Center for Dispute Resolution.
“Immobilien” is German for “homes” in the real estate context, while “immo” is a shorthand for the same term in a number of European languages.
The objection itself does not appear to have been published, but one can only assume that it’s based on the similarity of meaning between the two strings, rather than visual or audible confusion.
While it’s the first objection to be published, based on conversations with many interested parties I’m expecting a LOT more.
The deadline for filing objections using any of the four available mechanisms, is Wednesday.

Told you so? Four new gTLDs given geographic surprise, others given a pass

Four new gTLD applications have been told by ICANN the strings they wanted are geographic and will require government backing if they want to be approved.
One of the affected applicants is Tata, the $100bn Indian conglomerate.
During a webinar this week, ICANN reported the results of its new gTLD program’s Geographic Names Panel, which decides whether applicants need the support of governments or not.
Six applicants that had designated their applied-for string as geographic were ruled to be actually non-geographic. Three applicants that said they weren’t geographic were ruled to be, in fact, geographic.
And four strings DI had previously said were likely to be ruled geographic, actually received a pass.
These are the applications that have been told they’re geographic:

• .bar — This was applied for by two applicants (one of which was a Demand Media subsidiary) as a TLD for drinking establishments. But “Bar” is also a commune of Montenegro, so it’s been deemed a geographic string by ICANN.
• .tata — This is a dot-brand applied for by Tata Group, the 150-year-old, $100bn-a-year Indian conglomerate. But “Tata” is also a province of Morocco.
• .tui — Applied for by TUI AG as a dot-brand, the string is also a province of Burkina Faso.

Geographic gTLDs can only be approved with the formal support or non-objection of the relevant governments.
All three of these strings were highlighted in the DI PRO database as potentially problematic geographic gTLDs over a year ago, well before the new gTLD application window closed.
I even reported for The Register in January 2012 that .tata was going to have problems.
According to ICANN’s Application Guidebook, any string that matches something on the various International Standards Organization’s lists of geographic names will be deemed geographic for new gTLD approval purposes.
But we got it wrong on some counts.
For example, we wondered whether the seven applications for .store were going to be ruled geographic, on the basis that Štore (note the accent) is a municipality of Slovenia.
Also, .delta, .est and .capital match regions of Nigeria, Burkina Faso and Denmark and all appear on the same protected ISO 3166 list as .tata, .tui and .bar, but do not appear to have been ruled geographic.
ICANN has not published the rationale behind its panel’s decisions yet.
A further six applied-for gTLD strings that had been designated geographic by their applicants were ruled to be not, in fact, geographic.
These all appear to be abbreviations of place names, or place names that do not appear on protected lists: .frl, .ist, .ryukyu, .scot, .vegas and .zulu.
There’s no real harm to applicants that find themselves in this position.

Chehade to take charm offensive to ANA show

ICANN CEO Fadi Chehade has agreed to speak at an upcoming conference of the Association of National Advertisers, we’ve just been told.
Chehade, currently on a whirlwind global outreach tour, will deliver a lunch keynote on day two of the 2013 ANA Advertising Law & Public Policy Conference, held in Washington DC, March 19 and 20.
The speech is currently untitled, according to the agenda, but I’d hazard a guess that Chehade will be turning on his trademarked charm to attempt to bring more ANA members into the multistakeholder fold.
The ANA, of course, was ICANN’s primary antagonist in late 2011 and much of 2012, after it came out in strong opposition to the new gTLD program, lobbying the US Congress to have it delayed or killed off.
The relationship between the two organizations has mellowed, I sense, more recently, as the ANA has become more accustomed to working within the ICANN environment.
The ANA conference, which comes with the prescient subtitle “Change Ahead: Confrontation, Compromise or Chaos?” will also feature a panel discussion on new gTLDs featuring executives from Verizon and PayPal.