Moniker gets a new CEO

KeyDrive has appointed Bonnie Wittenburg, Key-System USA executive vice president, as the new CEO of sister registrar Moniker.
She replaces Craig Snyder, who was CEO of Moniker and SnapNames and remains CEO of SnapNames. Wittenburg keeps her EVP roles at Key-Systems.
“Through her expanded role she will drive cooperation and develop a synergistic relationship between the KeyDrive members,” the company said in a statement.
The KeyDrive stable also includes Key-Systems, NameDrive and KS Registry.
Wittenberg is a 15-year veteran of the domain name industry, with previous stints at Network Solutions and Iron Mountain.

MarkMonitor infiltrated by Syrian hackers targeting Facebook

The corporate brand protection registrar MarkMonitor was reportedly hacked yesterday by the group calling itself the Syrian Electronic Army, in an unsuccessful attempt to take out Facebook.
While MarkMonitor refused to confirm or deny the claims, the SEA, which has been conducting a campaign against high-profile western web sites for the last couple of years, tweeted several revealing screenshots.
One was a screen capture of a DomainTools Whois lookup for facebook.com, which does not appear to have been cached by DomainTools.

Happy Birthday Mark! http://t.co/yWBwvXPGRZ owned by #SEA http://t.co/gk8nGxATLt pic.twitter.com/eAeGp1TvBF

— SyrianElectronicArmy (@Official_SEA16) February 5, 2014

Another purported to be a cap of Facebook’s control panel at the registrar.

MarkMonitor Administration Panel. #SEA pic.twitter.com/7zDbUxHbYJ

— SyrianElectronicArmy (@Official_SEA16) February 6, 2014

The SEA tweeted more caps purporting to show it had access to domains belonging to Amazon and Yahoo!.
In response to an inquiry, MarkMonitor rather amusingly told DI “we do not comment on our clients — including neither confirming nor denying whether or not a company is a client.”
This despite the fact that the company publishes a searchable database of its clients on its web site.
The attackers were unable to take down Facebook itself because the company has rather wisely chosen to set its domain to use Verisign’s Registry Lock anti-hijacking service.
Registry Lock prevents domains’ DNS settings being changed automatically via registrar control panels. Instead, registrants need to provide a security pass phrase over the phone.

Directi joins Domain.com family in $100m deal

Endurance International, the holding company behind brands such as Domain.com and HostGator has closed the acquisition of top ten registrar Directi and some related companies.
The acquisition, which was announced last September is worth between $100 million and $110 million — $25.5 million in cash and the rest in shares and a promissory note.
The deal includes Directi properties BigRock (a registrar), ResellerClub (the reseller-focused registrar), LogicBoxes (the registrar management service) and webhosting.info.
It does not include Radix Registry, the company that applied for 31 new gTLDs, 28 of which applications are still active.
Directi CEO Bhavin Turakhia “has agreed to be closely involved in the integration of the two companies”, but it doesn’t sound like he’s taking on a permanent role at Endurance.
Endurance may not be a familiar brand in and of itself, but its businesses include Bluehost, HostGator, Domain.com, FatCow, iPage and Mojo Marketplace.

EU body tells ICANN that 2013 RAA really is illegal

A European Union data protection body has told ICANN for a second time — after being snubbed the first — that parts of the 2013 Registrar Accreditation Agreement are in conflict with EU law.
The Article 29 Data Protection Working Party, which is made up of the data protection commissioners in all 28 EU member states, reiterated its claim in a letter (pdf) sent earlier this month.
In the letter, the Working Party takes issue with the part of the RAA that requires registrars to keep hold of customers’ Whois data for two years after their registrations expire. It says:

The Working Party’s objection to the Data Retention Requirement in the 2013 RAA arises because the requirement is not compatible with Article 6(e) of the European Data Protection Directive 95/46/EC which states that personal data must be:
“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected”
The 2013 RAA fails to specify a legitimate purpose which is compatible with the purpose for which the data was collected, for the retention of personal data of a period of two years after the life of a domain registration or six months from the relevant transaction respectively.

Under ICANN practice, any registrar may request an opt out of the RAA data retention clauses if they can present a legal opinion to the effect that to comply would be in violation of local laws.
The Working Party told ICANN the same thing in July last year, clearly under the impression that its statement would create a blanket opinion covering all EU-based registrars.
But a week later ICANN VP Cyrus Namazi told ICANN’s Governmental Advisory Committee that the Working Party was “not a legal authority” as far as ICANN is concerned.
The Working Party is clearly a bit miffed at the snub, telling ICANN this month:

The Working Party regrets that ICANN does not acknowledge our correspondence as written guidance to support the Waiver application of a Registrar operating in Europe.
…
the Working Party would request that ICANN accepts the Working Party’s position as appropriate written guidance which can accompany a Registrar’s Data Retention Waiver Request.

It points out that the data protection commissioners of all 28 member states have confirmed that the letter “reflects the legal position in their member state”.
ICANN has so far processed one waiver request, made by the French registrar OVH, as we reported earlier this week.
Weirdly, the written legal opinion used to support the OVH request is a three-page missive by Blandine Poidevin of the French law firm Jurisexpert, which cites the original Working Party letter heavily.
It also cites letters from CNIL, the French data protection authority, which seem to merely confirm the opinion of the Working Party (of which it is of course a member).
EU registrars seem to be in a position here where in order to have the Working Party’s letter taken seriously by ICANN, they have to pay a high street lawyer to endorse it.

First European registrar to get Whois data opt-out

ICANN plans to give a French registrar the ability to opt out of parts of the 2013 Registrar Accreditation Agreement due to data privacy concerns.
OVH, the 14th-largest registrar of gTLD domains, asked ICANN to waive parts of the RAA that would require it to keep hold of registrant Whois data for two years after it stops having a relationship with the customer.
The company asked for the requirement to be reduced to one year, based on a French law and a European Union Directive.
ICANN told registrars last April that they would be able to opt-out of these rules if they provided a written opinion from a local jurist opining that to comply would be illegal.
OVH has provided such an opinion and now ICANN, having decided on a preliminary basis to grant the request, is asking for comments before making a final decision.
If granted, it would apply to “would apply to similar waivers requested by other registrars located in the same jurisdiction”, ICANN said.
It’s not clear if that means France or the whole EU — my guess is France, given that EU Directives can be implemented in different ways in different member states.
Throughout the 2013 RAA negotiation process, data privacy was a recurring concern for EU registrars. It’s not just a French issue.
ICANN has more details, including OVH’s request and links for commenting, here.

Go Daddy turns to man boobs for 2014 Super Bowl ad

For some reason people like watching Go Daddy’s Super Bowl commercials.
Here’s its 2014 commercial, which the company posted to YouTube today.
Rather than attempting to grab the viewer’s attention with fleeting glimpses of female décolletage, which has become the tradition over the 10 years Go Daddy has been running these expensive annual ads, this time around it’s the male form that’s being exploited.
Man boobs, in other words. Dozens and dozens of pairs of man boobs.
Danica Patrick’s in there somewhere too, but she appears to have been CGI’d to look like one of the fellers.

You’ll notice the lack of any TLDs — new or old — getting a mention, not even in Go Daddy’s logo, which dropped the “.com” about a year ago.
You may also scratch your head at the denouement. Why were a bunch of black guys among those racing to the tanning salon? Baffling.

NameCheap: a top ten registrar?

eNom reseller NameCheap is actually in the top 10 largest registrars in terms of domains under management, judging by data in regulatory documents filed by eNom parent Rightside.
According to a Rightside SEC filing related to its spin-off from Demand Media, NameCheap accounted for 23% of the company’s total domains under management as of September 30.
With the same document declaring Rightside has over 12 million names under management as of the same date, NameCheap apparently looks after just under 2.8 million domains.
By my reckoning, this means NameCheap is very probably the ninth-largest registrar by DUM out there, sandwiched between GMO Internet and FastDomain.
My comparison is not completely apples-to-apples — NameCheap’s number may include ccTLD registrations and I’m levering the company into a gTLDs-only league table — so may not be fully reliable.
But it’s the first solid indication of the size of NameCheap’s business I’ve seen in a while.
While NameCheap is accredited by ICANN in its own right, it has never registered more than a handful of domains under its own name, leaving it in the sub-900 range in the DUM league table.
According to Rightside, NameCheap is under contract to exclusively use eNom’s wholesale services until December 2014, but the deal does have one-year renewals built in.

Go Daddy hires former Microsoft exec as CIO

Go Daddy has appointed a new chief information/infrastructure officer, former Microsoft and ServiceNow executive Arne Josefsberg.
Josefsberg was most recently CTO of ServiceNow, a service automation software company, but he previously worked with Go Daddy CTO Elissa Murphy when she was at Microsoft.
He’s the latest in a series of high-level appointments to come over the year since Blake Irving took over as CEO and started plundering the ranks of alma maters Yahoo and Microsoft for executive talent.

LogicBoxes customers get registry pre-pay “wallet”

LogicBoxes has launched a new “wallet” service for its registrar clients, designed to make it easier for them to manage payments to the rapidly growing number of TLD registries.
The new Registry Wallet product — bundled in at no extra charge for existing customers — is a way for registrars to consolidate the process of managing pre-paid registry accounts.
Instead of managing accounts with dozens of registries for potentially hundreds of new gTLDs, LogicBoxes customers will be able to use the Wallet as a buffer and single management interface.
Many existing registries require registrars to fund an account in advance that gradually gets chipped away as more domains are sold to registrants. During quiet periods, the money sits dormant.
While some new gTLD registries are planning to allow credit card or post-payment options, others are sticking to the old ways and the legacy TLDs show no sign of changing, according to LogicBoxes senior marketing associate Vivek Desai.
“This service also aims at simplifying the invoicing and reconciliation process,” he said. “Imagine registrars having to reconcile statements and invoices with 30 or 40 or even more providers. Having one place to manage everything, will make things simpler.”
The company said it uses “pattern recognition algorithms” to predict usage, with manual oversight. It also features “threshold reminders, emergency credits and deactivation protection”, LogicBoxes said.

Cops can’t block domain transfers without court order, NAF rules

Law enforcement and IP owners were dealt a setback last week when the National Arbitration Forum ruled that they cannot block domain transfers unless they have a court order.
The ruling could make it more difficult for registrars to acquiesce to requests from police trying to shut down piracy sites, as they might technically be in breach of their ICANN contracts.
NAF panelist Bruce Meyerson made the call in a Transfer Dispute Resolution Policy ruling after a complaint filed by EasyDNS against Directi (PublicDomainRegistry.com).
You’re probably asking right about now: “The what policy?”
I had to look it up, too.
TDRP, it turns out, has been part of the ICANN rulebook since the Inter-Registrar Transfer Policy was adopted in 2004.
It’s designed for disputes where one registrar refuses to transfer a domain to another. As part of the IRTP, it’s a binding part of the Registrar Accreditation Agreement.
It seems to have been rarely used in full over the last decade, possibly because the first point of complaint is the registry for the TLD in question, with only appeals going to a professional arbitrator.
Only NAF and the Asian Domain Name Dispute Resolution Centre are approved to handle such cases, and their respective records show that only one TDRP appeal has previously filed, and that was in 2013.
In the latest case, Directi had refused to allow the transfer of three domains to EasyDNS after receiving a suspension request from the Intellectual Property Crime Unit of the City of London Police.
The IPCU had sent suspension requests, targeting music download sites “suspected” of criminal activity, to several registrars.
The three sites — maxalbums.com, emp3world.com, and full-albums.net — are all primarily concerned with hosting links to pirated music while trying to install as much adware as possible on visitors’ PCs.
The registrants of the names had tried to move from India-based Directi to Canada-based EasyDNS, but found the transfers denied by Directi.
EasyDNS, which I think it’s fair to say is becoming something of an activist when it come to this kind of thing, filed the TDRP first with Verisign then appealed its “No Decision” ruling to NAF.
NAF’s Meyerson delivered a blunt, if reluctant-sounding, win to EasyDNS:

Although there are compelling reasons why the request from a recognized law enforcement agency such as the City of London Police should be honored, the Transfer Policy is unambiguous in requiring a court order before a Registrar of Record may deny a request to transfer a domain name… The term “court order” is unambiguous and cannot be interpreted to be the equivalent of suspicion of wrong doing by a policy agency.
To permit a registrar of record to withhold the transfer of a domain based on the suspicion of a law enforcement agency, without the intervention of a judicial body, opens the possibility for abuse by agencies far less reputable than the City of London Police.

That’s a pretty unambiguous statement, as far as ICANN policy is concerned: no court order, no transfer block.
It’s probably not going to stop British cops trying to have domains suspended based on suspicion alone — the Metropolitan Police has a track record of getting Nominet to suspend thousands of .uk domains in this way — but it will give registrars an excuse to decline such requests when they receive them, if they want the hassle.