EnCirca partners with PandoraBots to push .bot names to brands

Specialist registrar EnCirca has partnered with bot development framework vendor PandoraBots to market .bot domains at big brands.
The two companies are pushing their wares jointly at this week’s International Trademark Association annual meeting in Seattle.
In a press release, the companies said that PandoraBots is offering bot-creation “starter kits” for brand owners that tie in with .bot registration via EnCirca.
Bots are rudimentary artificial intelligences that can be tailored to answer customer support questions over social media. Because who wants to pay a human to answer the phones?
Amazon Registry’s .bot gTLD is a tightly restricted space with strict preregistration verification rules.
Basically, you have to have a live, functioning bot before you can even request a domain there.
Only bots created using Amazon Lex, Botkit Studio, Dialogflow, Gupshup, Microsoft Bot Framework, and Pandorabots are currently eligible, though Amazon occasionally updates its list of approved frameworks.
The .bot space has been in a limited registration period all year, but on May 31 it will enter a six-month sunrise period.
Despite not hitting general availability until November, it already has about close to 1,800 domains in its zone — most of which were registered via EnCirca — and hundreds of live sites.
EnCirca currently offers a $200 registration service for brand owners, in which the registrar handles eligibility for $125 and the first year reg for $75.

Registrars want six-month stay on new Whois policy

Registrars representing the majority of the gTLD industry want ICANN to withhold the ban hammer for six months on its new temporary Whois policy.
As I reported earlier today, ICANN has formally approved an unprecedented Temporary Policy that seeks to bring the Whois provisions of its contracts into compliance with the EU’s General Data Protection Regulation.
It comes into effect next Friday, May 25, but it contains a fair few items that will likely take longer for registrars to implement.
While ICANN’s top lawyer has indicated that ICANN Compliance will act as reasonably as possible about enforcing the new policy, registrars want a moratorium of at least six months.
In a letter (pdf) dated May 16 (before the policy was voted through, but while its contents were broadly known), Registrar Stakeholder Group chair Graeme Bunton wrote:

Any temporary specification adopted now that significantly deviates from previously held expectations and models will be far too late for us to accommodate for a May 25, 2018 implementation date.
For this reason, we ask that any temporary specification include a formal ICANN compliance moratorium, not shorter than six (6) months, providing us an opportunity to conform, to the extent possible, our GDPR implementation with the GDPR-compliant aspects of any ICANN temporary specification

He added that some registrars may need even more time, so they should have the right ask for an extension if necessary.
The letter is signed by Endurance, GoDaddy, Tucows, Blacknight, 1&1, United Domains, NetEarth One and Cloudflare, which together account for most gTLD domains.

101domain founders suing Afilias over unpaid $1 million after $15.5 million acquisition

The two former owners of 101domain are suing Afilias over an unpaid $1 million portion of their $15.5 million acquisition deal.
And Afilias is suing them right back, claiming it doesn’t have to pay because the deal left it saddled with an undisclosed tax bill in excess of $1 million.
The suit was filed by Anthony Beltran and Wolfgang Reile, who has since died, in February and Afilias counter-sued a couple of weeks ago, but I only recently became aware of the case and I don’t believe it’s been reported elsewhere.
Afilias bought 101domain back in 2015 for a then-undisclosed sum, its first big push into the registrar side of the industry.
Court documents now reveal that the Ireland-registered company gave 90%-owner Reile and 10%-owner Beltran a combined $12.5 million cash, along with a promissory note to pay $3 million more over the next two years.
Afilias paid them the first $2 million owed in September 2016, but when it came to paying the remaining $1 million the company refused, saying it had discovered 101domain had a VAT liability from before the deal closed of around $875,000.
Last month, after the suit was filed, it re-estimated the alleged liability at over $1 million.
Under the terms of the promissory note, Afilias reckons it does not have to pay up. What’s more, it wants the two men to cover the difference between the money it owes them and the amount of the tax bill.
In their initial complaint (pdf), Reile and Beltran disputed whether the liability even exists, saying “Afilias has failed to provide an adequate accounting for the purported pre-closing VAT liability”.
Reile died April 6, but Afilias filed its counter-complaint (pdf) April 19 and the legal wheels still appear to be turning.
Beltran, who declined to comment on the case, is still listed as 101domain’s president on the registrar’s web site.

ICANN cancels registrar audit as GDPR headaches loom

ICANN has decided to call off a scheduled audit of its registrar base, to enable registrars to focus on sorting out compliance with the General Data Protection Regulation.
The biannual audit, carried out by ICANN Compliance, was due to start in May. As you likely know by now, May 25 is GDPR Day, when the EU’s privacy law comes into full effect.
In a letter (pdf) to registrars, senior VP of compliance Jamie Hedlund said: “The April 2018 registrar audit round is on hold.”
He added: “We are reviewing the schedule, resources and risks associated with holding a single, larger audit round in autumn of 2018, as well as considering alternative approaches.”
His letter came in response to a plea (pdf) from Registrar Stakeholder Group chair Graeme Bunton, who said an audit that clashed with GDPR deadline would be an “enormous undertaking” for affected registrars.
The audits, which have been running for a few years, randomly select a subset of registries and registrars to spot-check compliance with their Registrar Accreditation Agreements and Registry Agreements.
The program looks at 20-odd areas of compliance, one of which is Whois provision.

Drop-catcher drops almost all remaining registrars

Drop-catch specialist Pheenix has terminated almost all of its remaining registrar accreditations, leaving it with just its core registrar.
By my count, 50 shell registrars have terminated their ICANN contracts over the last few days, all of them part of the Pheenix dropnet.
Only Pheenix.com remains accredited.
That’s one registrar, down from a peak of about 500 at the end of 2016.
Almost 450 were terminated in November.
With registrars equating to connection time with the .com registry, it looks like Pheenix’s ability to catch dropping names through its own accreditations has been severely diminished.
By my count, ICANN currently has 2,495 accredited registrars, having terminated 524 and accredited about 40 since last July, when it said it expected to lose a net 750 over the coming 12 months.
Fifty registrars is worth a minimum of $200,000 in fixed annual fees to ICANN.

101domain founder Wolfgang Reile dies at 67

Wolfgang Reile, founder and former CEO of the registrar 101domain, has died, according to his former business partner and other sources.
He died unexpectedly at 67, April 6, according to Anthony Beltran, who took over the management of 101domain from Reile when Afilias acquired it back in 2015.
Born in Munich, Reile migrated to the US in the early 1990s and founded the registrar in 1999, Beltran said. He told DI:

He was a regular fixture in the ICANN scene, was a fun guy to be around, and was a natural storyteller (once you got used to the authentic German accent)
He was a friend and mentor to many, especially the staff at 101domain, and if you knew him and his straight-forward German fashion — was very opinionated, passionate, and yelling at you only meant he considered you a friend. He brought a passionate and dedicated energy that’s rare these days.

His international business background, including a spell at Disney in Asia, inspired 101domain’s strategy of providing access to the broadest possible range of ccTLDs and gTLDs, Beltran said.
The company currently has close to 140,000 gTLD domains under management and says it has tens of thousands of clients.
After the two men sold 101domain to Afilias, Reile stepped away from the industry to focus on family, travel and other businesses, Beltran said.
He is survived by his wife and three daughters. I gather his funeral will be held in San Diego, California, later today.

ICANN confirms GoDaddy Whois probe

ICANN is looking into claims that GoDaddy is in breach of its registrar accreditation contract.
The organization last week told IP lawyer Brian Winterfeldt that his complaint about the market-leading registrar throttling and censoring Whois queries over port 43 is being looked at by its compliance department.
The brief note (pdf) says that Compliance is “in receipt of the correspondence and will address it under its process”.
Winterfeldt is annoyed that GoDaddy has starting removing contact information from its port 43 Whois responses, in what the company says is an anti-spam measure.
It’s also started throttling port 43 queries, causing no end of problems at companies such as DomainTools.
Winterfeldt wrote last month “nothing in their contract permits GoDaddy to mask data elements, and evidence of illegality must be obtained before GoDaddy is permitted to throttle or deny port 43 Whois access to any particular IP address”.
It’s worth saying that ICANN is not giving any formal credibility to the complaint merely by looking into it.
But while it’s usual for ICANN to publish its responses to correspondence it has received and published, it’s rather less common for it to disclose the existence of a compliance investigation before it has progressed to a formal breach notice.
It could all turn out to be moot anyway, given the damage GDPR is likely to do to Whois across the industry in a matter of weeks.

Registrars will miss GDPR deadline by a mile

Registries and registrars won’t be able to implement ICANN’s proposed overhaul of the Whois system in time for the EU’s General Data Protection Regulation coming into effect.
That’s according to an estimated timetable (pdf) sent by ICANN’s contracted parties to the organization this week.
While they feel confident that some elements of ICANN’s GDPR compliance plan could be in place before May 25 this year, when the law kicks in, they feel that other elements could take many months to design and roll out.
Depending on the detail of the finalized plan, we could be looking at the back end of 2019 before all the pieces have been put in place.
Crucially, the contracted parties warn that designing and rolling out a temporary method for granting Whois access to entities with legitimate interests in the data, such as police and trademark owners, could take a year.
And that’s just the stop-gap, Band-Aid hack that individual registries and registrars would put in place while waiting — “quarters (or possibly years), rather than months” — for a fully centralized ICANN accreditation solution to be put in place.
The outlook looks bleak for those hoping for uninterrupted Whois access, in other words.
But the timetable lists many other sources of potential delay too.
Even just replacing the registrant’s email address with a web form or anonymized forwarding address could take up to four months to put online, the contracted parties say.
Generally speaking, the more the post-GDPR Whois differs from the current model the longer the contracted parties believe it will take to roll out.
Likewise, the more granular the controls on the data, the longer the implementation window.
For example, if ICANN forces registrars to differentiate between legal and natural persons, or between European and non-European registrants, that’s going to add six months to the implementation time and cost a bomb, the letter says.
Anything that messes with EPP, the protocol underpinning all registry-registrar interactions, will add some serious time to the roll-out too, due to the implementation time and the contractual requirement for a 90-day notice period.
The heaviest workload highlighted in the letter is the proposed opt-in system for registrants (such as domain investors) who wish to waive their privacy rights in favor of making themselves more contactable.
The contracted parties reckon this would take nine months if it’s implemented only at the registrar, or up to 15 months if coordination between registries and registrars is required (and that timeline assumes no new EPP extensions are going to be needed).
It’s possible that the estimates in the letter could be exaggerated as part of the contracted parties’ efforts to pressure ICANN to adopt the kind of post-GDPR Whois they want to see.
But even if we assume that is the case, and even if ICANN were to finalize its compliance model tomorrow, there appears to be little chance that it will be fully implemented at all registrars and registries in time for May 25.
The letter notes that the timetable is an estimate and does not apply to all contracted parties.
As I blogged earlier today, ICANN CEO Goran Marby has this week reached out to data protection authorities across the EU for guidance, in a letter that also asks the DPAs for an enforcement moratorium while the industry and community gets its act together.
Late last year, ICANN also committed not to enforce the Whois elements of its contracts when technical breaches are actually related to GDPR compliance.

Privacy could be a million-dollar business for ICANN

ICANN has set out the fees it plans to charge to officially accredit Whois proxy and privacy services, in the face of resistance from some registrars.
VP of finance Becky Nash told registrars during a session at ICANN 61 last week that they can expect to pay $3,500 for their initial accreditation and $4,000 per year thereafter.
Those are exactly the same fees as ICANN charges under its regular registrar accreditation program.
Registrars that also offer privacy should expect to see their annual ICANN flat fees double, in other words. Per-domain transaction fees would be unaffected.
The up-front application fee would be reduced $2,000 when the privacy service is to be offered by an accredited registrar, but it would stay at $3,500 if the company offering service is merely “affiliated” with the registrar.
Nash said all the fees have been calculated on a per-accreditation basis, independent of the volume of applications ICANN receives.
Director of registrar services Jennifer Gore said that while ICANN has not baked an estimate of the number of accredited providers into its calculations, registrars have previously estimated the number at between 200 and 250 companies.
That would put the upper end of annual accreditation fees at $1 million, with $875,000 up-front for initial applications.
Volker Greimann, general counsel of the registrar Key-Systems, pointed out during the session that many registrars give away privacy services for free or at cost.
“This just adds cost to an already expensive service that does not really make money for a lot of providers,” he said.
He suggested that the prices could lead to unexpected negative consequences.
“Pricing this in this region will just lead to a lot of unaccredited providers that will switch names every couple months, an underground that we don’t really want,” he said. “We want to have as many people on board as possible and the way to do that is to keep costs low.”
“Pricing them out of the market is not the way to attract providers to join this scheme,” he said.
Nash responded that registrars are forbidden under the incoming privacy/proxy policy from accepting registrations from unaccredited services.
She added that the fees have been calculated on a “cost-recovery” basis. Costs include the initial background checks, outreach, contract admin, compliance, billing and so on.
But some registrars expressed skepticism that the proposed fees could be justified, given that ICANN does not plan to staff up to administer the program.
Another big question is whether proxy/privacy services are going to continue to have value after May this year, when the European Union’s General Data Protection Regulation kicks in.
The current ICANN plan for GDPR compliance would see individual registrants have all of their private information removed from the public Whois.
It’s not currently clear how many people and what kinds of people will continue to have access to unmasked Whois, so there are likely still plenty of cases where individuals might feel they need an extra layer of protection — if they live in a dictatorship and are engaged in rebellious political speech, for example.
There could also be cases where companies wish to mask their details ahead of, say, a product launch.
And, let’s face it, bad actors will continue to want to use privacy services on domains they intend to misuse.
The proxy/privacy policy came up through the formal GNSO Policy Development Process and was approved two years ago. It’s currently in the implementation phase.
According to a presentation from the ICANN 61 session, ICANN hopes to put the final implementation plan out for public comment by the end of the month.

Lawyer: GoDaddy Whois changes a “critical” contract breach

GoDaddy is in violation of its ICANN registrar contract by throttling access to its Whois database, according to a leading industry lawyer.
Brian Winterfeldt of the Winterfeldt IP Group has written to ICANN to demand its compliance team enforces what he calls a “very serious contractual breach”.
At issue is GoDaddy’s recent practice, introduced in January, of masking key fields of Whois when accessed in an automated fashion over port 43.
The company no longer shows the name, email address or phone number of its registrants over port 43. Web-based Whois, which has CAPTCHA protection, is unaffected.
It’s been presented as an anti-spam measure. In recent years, GoDaddy has been increasingly accused (wrongly) of selling customer details to spammers pitching web hosting and SEO services, whereas in fact those details have been obtained from public Whois.
But many in the industry are livid about the changes.
Back in January, DomainTools CEO Tim Chen told us that, even as a white-listed known quantity, its port 43 access was about 2% of its former levels.
And last week competing registrar Namecheap publicly complained that Whois throttling was hindering inbound transfers from GoDaddy.
Winterfeldt wrote (pdf) that “nothing in their contract permits GoDaddy to mask data elements, and evidence of illegality must be obtained before GoDaddy is permitted to throttle or deny
port 43 Whois access to any particular IP address”, adding:

The GoDaddy whitelist program has created a dire situation where businesses dependent upon unmasked and robust port 43 Whois access are forced to negotiate wholly subjective terms for access, and are fearful of filing complaints with ICANN because they are reticent to publicize any disruption in service, or because they fear retaliation from GoDaddy…
This is a very serious contractual breach, which threatens to undermine the stability and security of the Internet, as well as embolden other registrars to make similar unilateral changes to their own port 43 Whois services. It has persisted for far too long, having been officially implemented on January 25, 2018. The tools our communities use to do our jobs are broken. Cybersecurity teams are flying blind without port 43 Whois data. And illegal activity will proliferate online, all ostensibly in order to protect GoDaddy customers from spam emails. That is completely disproportionate and unacceptable

He did not disclose which client, if any, he was writing on behalf of, presumably due to fear of reprisals.
He added that his initial outreaches to ICANN Compliance have not proved fruitful.
ICANN said last November that it would not prosecute registrar breaches of the Whois provisions of the Registrar Accreditation Agreements, subject to certain limits, as the industry focuses on becoming compliant with the General Data Protection Regulation.
But GoDaddy has told us that the port 43 throttling is unrelated to GDPR and to the compliance waiver.
Masking Whois data, whether over port 43 or not, is likely to soon become a fact of life anyway. ICANN’s current proposal for GDPR compliance would see public Whois records gutted, with only accredited users (such as law enforcement) getting access to full records.