French registrar gets Whois data waiver

The French registrar OVH has been told by ICANN that it can opt out of a requirement to retain its customers’ contact data for two years after their domain names expire.
The move potentially means many more registrars based in the European Union will be able to sign the 2013 Registrar Accreditation Agreement and start selling new gTLD domains without breaking the law.
OVH was among the first to request a waiver to the 2013 RAA’s data retention provisions, which EU authorities say are illegal.
ICANN said last night:

ICANN agrees that, following Registrar’s execution of the 2013 RAA, for purposes of assessing Registrar’s compliance with the data retention requirement of Paragraph 1.1 of the Data Retention Specification in the 2013 RAA, the period of “two additional years” in Paragraph 1.1 of the Data Retention Specification will be deemed modified to “one additional year.”

It’s a minor change, maybe, and many EU-based registrars have been signing the 2013 RAA regardless, but many others have resisted the new contract in fear of breaking local laws.
Now that OVH has had its waiver granted, it’s looking promising that ICANN will also start to allow other EU registrars that have requested waivers to opt-out also.
ICANN has been criticized for dragging its feet on this issue, and I gather the OVH is still the only registrar to have been given the ability to opt out.

Disadvantaged kids need your money after terrible Name.com charity drive

Domain name registrar Name.com carried out what can only be described as a completely abysmal charity fund-raising drive during this week’s South by Southwest conference, and disadvantaged kids need your help as a result.
During the conference, Name.com got one of its more photogenic customer support guys to go around the streets of Austin, Texas, asking random passers-by to high-five him.
The high-fives were recorded on a great big electronic device the guy carried on his back. For every high-five he got, Name.com promised to donate a nickel ($0.05) to charity.
)
The campaign was videoed and published on the company’s blog (here, here, here, and here)
The end result of this was 10,000 high-fives, which raised an absolutely pointless $500 for the charity concerned, which is the Austin Children’s Center, a very worthy-sounding cause.
The Austin’s Children’s Center provides services for child victims of abuse in Austin, Texas.
But if you watch all of the Name.com videos linked to above, you’ll learn rather more about Name.com than you will about the charity it’s supposedly raising money for.
And all this effort raised a pathetic $500.
There are people reading this post who have regularly spent more than that on dinner.
During the final video, a representative of the charity, the Austin’s Children’s Center, says “We have to raise 65% of our annual budget, and this year it’s $7 million.”
So Name.com raised a whopping 0.007% of its chosen charity’s annual funding needs, while putting rather a lot of effort into attempting to raise its own corporate profile.
I gather that the highfive-counting electronic gizmo that the CSR carried around on his back in the videos costs around $1,200 to buy, meaning that the stunt actually ran at a loss.
Name.com could have donated an extra $1,200 to this charity if it had not run the stunt at all.
That’s assuming, of course, that it didn’t pay the guy carrying the camera, or the guy who did the editing, or the guy who wrote the blog post, or the guy who sent me the press release today…
This kind of crap makes me sick.
I donated $25 to the Center today in protest at Name.com’s bullshit.
If you want to donate in protest too, which I strongly encourage you to do, do it here.
Not many people have donated yet. This charity really does need your help.
If you’re not convinced yet, watch this video and then donate if you find it funny.

Go Daddy risking Oscars wrath with .buzz premium domains?

The new gTLD registry Dot Strategy included many famous brands on its list of premium .buzz names, including two that could get its partner, Go Daddy-owned Afternic, in hot water.
Until a couple of hours ago, nic.buzz carried what appeared to be thousands of premium listings, organized by category and carrying prices of $1,000 and up, some of which seemed to target brands.
The names of several sports teams, such as 49ers.buzz and blackhawks.buzz, were listed for sale in the sports category (hat tip: Valideus‘ Brian Beckham).
I also spotted listings for domains such as photoshop.buzz (an Adobe software brand) in the technology category and hobbit.buzz (believe it or not, “Hobbit” is a trademark) in an entertainment category.
But the ones that really caught my attention were academyaward.buzz and academyawards.buzz, which carried prices of $1,900 each.

That’s surprising because if you try to buy these domains you’ll be instructed to contact Afternic, which is handling the premium process. And as of September, Go Daddy owns Afternic.
The Academy of Motion Picture Arts and Sciences, which hands out the Oscars and owns “Academy Award” and “Academy Awards” trademarks, has been locked in litigation with Go Daddy for the last four years.
The Academy claims that Go Daddy is cybersquatting due to its practice of making money parking its customers’ domains, including domains containing Academy trademarks such as academyawardz.com.
Most recently, Go Daddy tried to get the appointed judge in the case kicked out, alleging that she’s in the Academy’s pocket.
While the lawsuit is certainly controversial, attempting to sell $3,800 worth of domain names matching the Academy’s marks probably wouldn’t help Go Daddy look less cybersquatty to its opponent.
It could be argued that many of the premium names that match brands are also generic — Black Hawks could be helicopters and I’m sure there are plenty of academies in the world that hand out awards.
A legitimate registrant could buy many of these trademark-matching listed names and fight off a UDRP, I reckon.
But when somebody lists the name for sale in a category appropriate to the class of trademark, I’d say that makes the name look a lot less generic.
Bieber is a surname presumably shared by many people, but when you list bieber.buzz for sale in a category related to entertainment it can only really refer to one person.
Somebody yanked the premium listings section from the nic.buzz web site after I requested comments from Dot Strategy and Go Daddy a few hours ago. This post will be updated should I receive said comments.
.buzz is currently in its sunrise period and is due to go to general availability in mid-April. As I’ve said before, it’s one of my favorite new gTLD strings and I wouldn’t be surprised if sells quite well.
UPDATE: Go Daddy said: “Afternic is working with dotStrategy, Co. (the .BUZZ registry) to review the list and revise as appropriate.”

SnapNames acquired by Web.com

Web.com has acquired domain name dropcatcher SnapNames for an undisclosed sum, according to press releases from it and former owner KeyDrive, confirming reports from Friday.
Web.com said the deal will be “immaterial” to its 2014 financial results.
The Nasdaq-listed company already owns leading registrars Network Solutions and Register.com. It’s also a new gTLD applicant, one of many companies having applied for .web.
KeyDrive acquired SnapNames, along with the registrar Moniker, from Oversee.net in 2012.
Just last week KeyDrive announced that Moniker, which with SnapNames had been managed by Craig Snyder, was getting a new CEO in the form of Key-Systems exec Bonnie Wittenberg.

Pirate Bay a victim as Go Daddy suspends hundreds of new gTLD domains

New gTLDs may have only been in general availability for a few weeks, but there’s already evidence of substantial abuse.
Go Daddy has suspended at least 305 new gTLD domain names, putting them on its spam-and-abuse.com name servers, standard Go Daddy practice for domains suspected of abuse.
Over 250 of these were put on the naughty step in the last 24 hours.
The suspended names include, notably, thepiratebay.guru, which matches the name of controversial torrent site frequented by people who like downloading copyrighted material for free.
The Pirate Bay has been switching TLDs like crazy recently, as one ccTLD after another shuts down its latest attempt to find a reliable home.
The .guru domain is registered under Go Daddy’s Domains By Proxy privacy service, so it’s not clear if it actually belongs to The Pirate Bay or to an opportunistic third party.
Other suspended names include premium-looking names such as electric.guru, sexualhealth.guru, as well as obvious cybersquatted names such as verizon.guru (not registered to Verizon).
But the majority of the suspended names seem to belong to a single registrant in Washington state, all in .guru and largely “pigeon shit” names such as bestdrinksites.guru and bestfashionsites.guru.
While 305 seems like a large number (albeit only 0.2% of the current new gTLD names sold), it appears that so far a single individual is responsible for most of the “abuse” in new gTLDs.

Euro registrars miffed about ICANN privacy delays

Registrars based in the European Union are becoming increasingly disgruntled by what they see as ICANN dragging its feet over registrant privacy rules.
Some are even refusing to sign the 2013 Registrar Accreditation Agreement until they receive formal assurances that ICANN won’t force them to break their local privacy laws.
The 2013 RAA, which is required if a registrar wants to sell new gTLD domains, requires registrars to keep hold of registrant data for two years after their registrations expire.
Several European authorities have said that this would be illegal under EU privacy directives, and ICANN has agreed to allow registrars in the EU to opt out of the relevant provisions.
Today, Luxembourgish registrar EuroDNS said it asked for a waiver of the data retention clauses on December 2, but has not heard back from ICANN over two months later.
The company had provided ICANN with the written legal opinion of Luxembourg’s Data Protection Agency
In a snippy letter (pdf) to ICANN, EuroDNS CEO Lutz Berneke wrote:

Although we understand that your legal department is solely composed of lawyers educated in US laws, a mere translation of the written guidance supporting our request should confirm our claim and allow ICANN to make its preliminary determination.

EuroDNS has actually signed the 2013 RAA, but says it will not abide by the provisions it has been told would be illegal locally.
Elsewhere in Europe, Ireland’s Blacknight Solutions, said two weeks ago that it had requested its waiver September 17 and had not yet received a pass from ICANN.
“Why is it my problem that ICANN doesn’t understand EU law? Why should our business be impacted negatively due to ICANN’s inability to listen?” CEO Michele Neylon blogged. “[W]hile this entire farce plays out we are unable to offer new top level domains to our clients.”
But while Blacknight is still on the old 2009 RAA, other European registrars seem to have signed the 2013 version some time ago, and are already selling quite a lot of new gTLD domains.
Germany’s United-Domains, for example, appears to be the third-largest new gTLD registrar, if name server records are anything to go by, with the UK’s 123-Reg also in the top ten.
ICANN is currently operating a public comment period on the waiver request of OVH, a French registrar, which ICANN says it is “prepared to grant”.
That comment period is not scheduled to end until February 27, however, so it seems registrars agitated about foot-dragging have a while to wait yet before they get what they want.

Moniker gets a new CEO

KeyDrive has appointed Bonnie Wittenburg, Key-System USA executive vice president, as the new CEO of sister registrar Moniker.
She replaces Craig Snyder, who was CEO of Moniker and SnapNames and remains CEO of SnapNames. Wittenburg keeps her EVP roles at Key-Systems.
“Through her expanded role she will drive cooperation and develop a synergistic relationship between the KeyDrive members,” the company said in a statement.
The KeyDrive stable also includes Key-Systems, NameDrive and KS Registry.
Wittenberg is a 15-year veteran of the domain name industry, with previous stints at Network Solutions and Iron Mountain.

MarkMonitor infiltrated by Syrian hackers targeting Facebook

The corporate brand protection registrar MarkMonitor was reportedly hacked yesterday by the group calling itself the Syrian Electronic Army, in an unsuccessful attempt to take out Facebook.
While MarkMonitor refused to confirm or deny the claims, the SEA, which has been conducting a campaign against high-profile western web sites for the last couple of years, tweeted several revealing screenshots.
One was a screen capture of a DomainTools Whois lookup for facebook.com, which does not appear to have been cached by DomainTools.

Happy Birthday Mark! http://t.co/yWBwvXPGRZ owned by #SEA http://t.co/gk8nGxATLt pic.twitter.com/eAeGp1TvBF

— SyrianElectronicArmy (@Official_SEA16) February 5, 2014

Another purported to be a cap of Facebook’s control panel at the registrar.

MarkMonitor Administration Panel. #SEA pic.twitter.com/7zDbUxHbYJ

— SyrianElectronicArmy (@Official_SEA16) February 6, 2014

The SEA tweeted more caps purporting to show it had access to domains belonging to Amazon and Yahoo!.
In response to an inquiry, MarkMonitor rather amusingly told DI “we do not comment on our clients — including neither confirming nor denying whether or not a company is a client.”
This despite the fact that the company publishes a searchable database of its clients on its web site.
The attackers were unable to take down Facebook itself because the company has rather wisely chosen to set its domain to use Verisign’s Registry Lock anti-hijacking service.
Registry Lock prevents domains’ DNS settings being changed automatically via registrar control panels. Instead, registrants need to provide a security pass phrase over the phone.

Directi joins Domain.com family in $100m deal

Endurance International, the holding company behind brands such as Domain.com and HostGator has closed the acquisition of top ten registrar Directi and some related companies.
The acquisition, which was announced last September is worth between $100 million and $110 million — $25.5 million in cash and the rest in shares and a promissory note.
The deal includes Directi properties BigRock (a registrar), ResellerClub (the reseller-focused registrar), LogicBoxes (the registrar management service) and webhosting.info.
It does not include Radix Registry, the company that applied for 31 new gTLDs, 28 of which applications are still active.
Directi CEO Bhavin Turakhia “has agreed to be closely involved in the integration of the two companies”, but it doesn’t sound like he’s taking on a permanent role at Endurance.
Endurance may not be a familiar brand in and of itself, but its businesses include Bluehost, HostGator, Domain.com, FatCow, iPage and Mojo Marketplace.

EU body tells ICANN that 2013 RAA really is illegal

A European Union data protection body has told ICANN for a second time — after being snubbed the first — that parts of the 2013 Registrar Accreditation Agreement are in conflict with EU law.
The Article 29 Data Protection Working Party, which is made up of the data protection commissioners in all 28 EU member states, reiterated its claim in a letter (pdf) sent earlier this month.
In the letter, the Working Party takes issue with the part of the RAA that requires registrars to keep hold of customers’ Whois data for two years after their registrations expire. It says:

The Working Party’s objection to the Data Retention Requirement in the 2013 RAA arises because the requirement is not compatible with Article 6(e) of the European Data Protection Directive 95/46/EC which states that personal data must be:
“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected”
The 2013 RAA fails to specify a legitimate purpose which is compatible with the purpose for which the data was collected, for the retention of personal data of a period of two years after the life of a domain registration or six months from the relevant transaction respectively.

Under ICANN practice, any registrar may request an opt out of the RAA data retention clauses if they can present a legal opinion to the effect that to comply would be in violation of local laws.
The Working Party told ICANN the same thing in July last year, clearly under the impression that its statement would create a blanket opinion covering all EU-based registrars.
But a week later ICANN VP Cyrus Namazi told ICANN’s Governmental Advisory Committee that the Working Party was “not a legal authority” as far as ICANN is concerned.
The Working Party is clearly a bit miffed at the snub, telling ICANN this month:

The Working Party regrets that ICANN does not acknowledge our correspondence as written guidance to support the Waiver application of a Registrar operating in Europe.
…
the Working Party would request that ICANN accepts the Working Party’s position as appropriate written guidance which can accompany a Registrar’s Data Retention Waiver Request.

It points out that the data protection commissioners of all 28 member states have confirmed that the letter “reflects the legal position in their member state”.
ICANN has so far processed one waiver request, made by the French registrar OVH, as we reported earlier this week.
Weirdly, the written legal opinion used to support the OVH request is a three-page missive by Blandine Poidevin of the French law firm Jurisexpert, which cites the original Working Party letter heavily.
It also cites letters from CNIL, the French data protection authority, which seem to merely confirm the opinion of the Working Party (of which it is of course a member).
EU registrars seem to be in a position here where in order to have the Working Party’s letter taken seriously by ICANN, they have to pay a high street lawyer to endorse it.