ICANN smacks Cheapies with the ban hammer

ICANN for only the second time has suspended an accredited registrar’s ability to sell domain names.
Cheapies.com, which has roughly 12,000 gTLD domain names under management, will not be able to create new domains or accept inbound transfers until January 2, 2014, according to ICANN.
The 90-day suspension of its accreditation, longer by two months than the 30 days Alantron received last year, comes because it’s the third time this year Cheapies has been sent an ICANN breach notice.
The latest breach concerns the domain ebookvortex.com. Apparently Cheapies did not provide the registrant with the required authorization information when he initiated a transfer request.
In January, the company received breach notices related to its records-keeping and another instance of failing to abide by ICANN’s inter-registrar transfers policy.
It’s also being spanked for consistently ignoring or stonewalling ICANN’s attempts to resolve the situation.
Cheapies has the opportunity to rectify its problems to avoid losing its accreditation entirely. In the meantime, it also has to display the following notice “prominently” on its web site:

No new registrations or inbound transfers will be accepted from 4 October 2013 through 2 January 2014.

There’s a clear takeaway for fly-by-night registrars here: ignore ICANN Compliance at your peril.

Register.com hit by breach notice over 62,232 domains

Register.com, a Web.com business that is one of the top ten registrars by domains under management, has been hit by an ICANN compliance notice covering 62,232 domain names.
It’s a weird one.
ICANN says that the company has failed to provide records documenting the ownership trail of the domains in question, which all currently belong to Register.com itself.
The notice names 000123.net, 0011pp.com, 00h4.com, 010fang.net, 01rabota.com, 02071988.com and 020tong.com, but it seems that these are merely the first in a alphabetical list that is much, much longer.
Judging by DomainTools’ Whois history, these domains all appear to have been originally registered at various times by individuals in China and India, then allowed to expire, then registered by Register.com to itself.
The only common link appears to be that they were kept by Register.com after they expired, for whatever reasons registrars usually hoard their customers’ expired domains.
According to the compliance notice, ICANN wants the registrar to:

Provide a detailed explanation to ICANN how 62,232 domains in which Register.com itself is the registrant are used for the purposes of Registrar Services, as defined by Section 1.11 of the RAA;

The Registrar Accreditation Agreement says registrars have to keep registrant agreement records, except for a limited class of cases where the domain is owned by the registrar itself and used for registrar-related stuff.
Register.com, one of the original five oldest competitive registrars, has been given until October 2 to come up with the requested information for face losing its accreditation.
The registrar has almost three million gTLD domains under management. Combined with its Web.com sister registrars, which include Network Solutions, the number is closer to 10 million.

Domain.com owner files for $400m IPO, to spend $110m buying Directi

Endurance International, owner of Domain.com and HostGator, plans to raise up to $400 million in a Nasdaq IPO, and said it will spend up to $110 million of that buying Directi, India’s largest domain registrar.
As part of the proposed acquisition, Endurance has also agreed to bankroll Directi’s new gTLD auctions to the tune of $62 million.
The acquisition is not final, and appears to depend on a number of targets related to the IPO and Directi’s revenue performance. Endurance’s S-1 filing with the US Securities and Exchange Commission reads:

In August 2013, we entered into a master share purchase agreement to acquire all of the outstanding capital stock of Directi from Directi Holdings, the seller, for an amount we estimate will be between $100 million and $110 million in cash or, at the election of the seller, a combination of cash and shares of our common stock, subject to the satisfaction or waiver of specified customary closing conditions and the achievement of specified financial targets.

The acquisition would close in the fourth quarter this year.
As well as running a top-ten registrar (and a few dozen others), Directi subsdiary Radix Registry has 29 active new gTLD applications, 26 of which are contested.
Endurance proposes to help Radix win these contention sets. On new gTLD auctions, the S-1 says:

in connection with our proposed acquisition of Directi, we entered into agreements with entities affiliated with Directi Holdings related to participation in the auction of new top level domain extensions and domain monetization activities, pursuant to which, among other things, we may be obligated to make aggregate cash payments of up to a maximum of approximately $62 million, subject to specified terms, conditions and operational contingencies.

Endurance is a complicated company. Its most familiar brands include Domain.com, iPage, FatCow, Homestead, Bluehost, HostGator, A Small Orange, iPower and Dotster.
But since December 2011 it has been controlled and majority owned by Warburg Pincus and Goldman Sachs, which paid a reported $975 million.
Its annual revenue for the last three calendar years has been $87.8 million, $190.3 million and $292.2 million. It’s currently not profitable, recording a net loss of $139.2 million in 2012.
It has seven million domains under management and had 3.4 million customers at the end of June 2013.
Judging by the S-1, the company has over a billion dollars of debt. Directi acquisition excluded, most of its IPO proceeds would go towards paying off some of that debt.

Go Daddy selling domains door-to-door in India

Door-to-door sales have helped Go Daddy grow its Indian business by 86%, according to a company press release.
The market-leading registrar said today that the remarkable growth has come since it launched a customer support center in Hyderabad a year ago.
It’s taken 250,000 calls since then, Go Daddy said.
The company also pointed to some unconventional sales techniques:

Since launching on the ground in India, GoDaddy has connected with customers in a very personal way. A prime example is the recent “Cup of Coffee” campaign that demystified the process of leveraging the Internet by providing actual door-to-door demonstrations to show small businesses exactly how to get online. Professionally trained GoDaddy experts and GoDaddy Resellers engaged with prospective clients to demonstrate how beautiful websites can be built quickly. These personalized initiatives have helped fuel GoDaddy’s unprecedented growth.

Go Daddy’s reseller network in India has grown 88% since last year, the company added.

Registrar rapped for failing to transfer UDRP domain

The domain name registrar Gal Comm has been warned by ICANN that it risks losing its accreditation for failing to transfer a cybersquatted name to Home Depot.
The compliance notice (pdf) concerns the domain name homedpeot.com, which was lost in a UDRP filed in early March and decided on April 21.
According to ICANN, Gal Comm, which has about 30,000 gTLD domains under management, failed to transfer the domain within 10 days of finding out about the decision, as required under the policy.
Whois records compiled by DomainTools show that the domain was instead deleted at in early April, and subsequently re-registered with a different registrar, where it’s currently under dubious-looking privacy.
According to the ICANN compliance notice, Gal Comm says that it deleted the domain because it received a Whois inaccuracy complaint about it.
Assuming that’s correct (and the Whois back in March was blatantly false) we have an interesting tension between policies that seems to have caused a slip-up at the registrar.
But registrars are supposed to lock domains they manage after they become aware of UDRP actions, so allowing the domain to delete seems to be a breach of the policy.
ICANN has given Gal Comm until September 10 to produce its records relating to the domain — and pay past-due accreditation fees — or face possible de-accreditation.
It’s very rare for ICANN to send compliance notices to registrars related to UDRP implementation.

Former Go Daddy lawyer to run for Arizona governor

Former Go Daddy general counsel Christine Jones wants to run for Governor of Arizona, it emerged last week.
Jones is planning to stand for the Republican nomination, filing her paperwork on Friday. She announced the move on Twitter:

Filed papers for Gov campaign today. Time to work for AZ since AZ has been so good to me. Formal announcement in Sep. #humbled #azgop

— Christine Jones (@JonesForGov) August 9, 2013

Her campaign site plays on her record of testifying before the US Congress on internet-related issues such as fake pharmacies and child abuse materials, saying:

She also helped drive federal Internet-related legislation, including laws to keep the Web safe from child predators and rogue online pharmacies. For example, she helped push through bills such as the Ryan Haight Online Pharmacy Consumer Protection Act, the Protect Our Children Act, and the Keeping the Internet Devoid of Sexual Predators Act.

“Helped drive” appears to be a reference to Congressional testimony such as her statements about Go Daddy’s anti-CAM practices in 2006.
As well as children, her site also ticks the usual Republican politician boxes of religion (she’s a church singer, apparently) and the military (her husband is a retired US Air Force officer).
Jones was with Go Daddy for 10 years, leaving in May 2012.
One of her final projects at the company was her vocal support for the Stop Online Piracy Act in late 2011, which ultimately proved a vote-loser among Go Daddy’s customers, forcing a company U-turn.
Most of Arizona’s governors have been Democrats. The incumbent, Jan Brewer, is a Republican. The last three have been female.
Go Daddy employs thousands of people in the state, when it would be much cheaper to ship those jobs overseas, something that could score Jones brownie points if she can figure out a way to take credit for it.
For Go Daddy, if Jones were to win, having a friend in high places would no doubt prove a boon. The election is next year.

ICANN to crack down on UDRP “cyberflight”

ICANN has moved closer to cracking down on cybersquatters who try to flip their domains when they discover they’ve been hit with a UDRP complaint.
Under recommendations approved by the GNSO Council yesterday, registrars would be bound by a much stricter set of UDRP-related domain locking rules in future.
So-called “cyberflight” — where squatters transfer their domains to a new registrar or registrants — appears to be a relatively infrequent problem, but when it does happen it causes big headaches for UDRP providers and trademark owners.
A survey of UDRP providers carried out as part of the GNSO’s policy development process discovered that the vast majority of registrars already lock domains hit by UDRP.
The problem is, they said, that locking practices are not uniform. Some registrars take well over a week to lock domains, and what the “lock” entails differs by registrar.
The recommendations of the GNSO’s Final Report on the Locking of a Domain Name Subject to UDRP Proceedings Policy Development Process, adopted by the Council yesterday, seek to standardize the process.
After being told about a complaint against one of its domains, the registrar in future would have a maximum of two business days to put a lock — preventing any changes in registrant or registrar — in place.
The lock would remain until the UDRP was resolved, but there would be various safeguards in place to enable complainants and respondents to settle their differences outside of the UDRP.
The lock would not prevent registrars or proxy/privacy services revealing the true identity of the registrant — that wouldn’t count as a change of registrant.
To prevent registrants abusing the two-day window to sell their domains or switch registrars, they would not be told about the existence of the UDRP until the domain had been locked.
The UDRP rules currently require the complainant to send a copy of their complaint to the domain owner at the same time it is filed with the UDRP provider.
But the GNSO has now recommended getting rid of this rule, stating: “as a best practice, complainants need not inform respondents that a complaint has been filed to avoid cyberflight.”
The registrant would be informed later by the UDRP provider instead.
Registrars would be prohibited from tipping off the registrant until the lock was in place.
The July 2013 recommendations (pdf) came out of a working group that was formed in April 2012, in response to policy ideas floated in 2011.
The GNSO’s resolution calls for ICANN staff to work with members of the working group on an implementation plan, which would eventually be put to the ICANN board for approval.
Once through the board, the new policy would become binding on all ICANN-accredited registrars.

Go Daddy joins the new gTLD pre-reg game, kinda

Go Daddy has become the latest domain name registrar to start accepting expressions of interest from prospective new gTLD registrants.
A “watch list” service launched yesterday allows customers to indicate gTLDs that they are interested in using in future and receive alerts when they launch.
Unlike other registrars, Go Daddy does not appear to be offering users the ability to name the second-level string they’re interested in.
The goal seems to be to help the company select which of the 700 new gTLDs available on the watch list will ultimately be carried in its market-leading store, making it very interesting to applicants.
In a blog post, the company said:

Keep in mind, we might not sell all of the gTLDs listed on the landing page. The “watch” feature gives us a sense of what you’re interested in and what we should sell. We’re taking your needs and market appeal into consideration before we make any final decisions.

There’s no cost for the service, but you do need to be logged in as a Go Daddy customer in order to create a watch list, which should help prevent new gTLD applicants gaming the system.

Key-Systems to take a loss on .hiv domains

Key-Systems said yesterday that it plans to make .hiv domain names available at “below net cost price”, in solidarity with would-be new gTLD registry dotHIV.
The registrar said it will also offer free .hiv names at launch to organizations involving in fighting the virus via its Moniker and domaindiscount24.com retail registrars.
dotHIV, also a German company, plans to donate all of its profits to HIV/AIDs charities.
Its application is uncontested and has already passed Initial Evaluation, but is the target of Governmental Advisory Committee advice, which has put its bid on hold.
Despite this uncertainty, Key-Systems said it expects the Sunrise phase for .hiv to start in December.

2013 RAA is illegal, says EU privacy watchdog

European privacy regulators have slammed the new 2013 Registrar Accreditation Agreement, saying it would be illegal for registrars based in the EU to comply with it.
The Article 29 Working Party, which comprises privacy regulators from the 27 European Union nations, had harsh words for the part of the contract that requires registrars to store data about registrants for two years after their domains expire.
In a letter (pdf) to ICANN last month, Article 29 states plainly that such provisions would be illegal in the EU:

The fact that these personal data can be useful for law enforcement does not legitimise the retention of these personal data after termination of the contract. Because there is no legal ground for the data processing, the proposed data retention requirement violates data protection law in Europe.

The 2013 RAA allows any registrar to opt out of the data retention provisions if it can prove that to comply would be illegal its own jurisdiction.
The Article 29 letter has been sent to act as blanket proof of this for all EU-based registrars, but it’s not yet clear if ICANN will treat it as such.
The letter goes on to sharply criticize ICANN for allowing itself to be used by governments (and big copyright interests) to circumvent their own legislative processes. It says:

The fact that these data may be useful for law enforcement (including copyright enforcement by private parties) does not equal a necessity to retain these data after termination of the contract.
…
the Working Party reiterates its strong objection to the introduction of data retention by means of a contract issued by a private corporation in order to facilitate (public) law enforcement.
If there is a pressing social need for specific collections of personal data to be available for law enforcement, and the proposed data retention is proportionate to the legitimate aim pursued, it is up to national governments to introduce legislation

So why is ICANN trying to get many of its registrars to break the law?
While it’s tempting to follow the Article 29 WP’s reasoning and blame law enforcement agencies and the Governmental Advisory Committee, which pushed for the new RAA to be created in the first place, the illegal data retention provisions appear to be entirely ICANN’s handiwork.
The original law enforcement demands (pdf) say registrars should “securely collect and store” data about registrants, but there’s no mention of the period for which it should be stored.
And while the GAC has expressly supported the LEA recommendations since 2010, it has always said that ICANN should comply with privacy laws in their implementation.
The GAC does not appear to have added any of its own recommendations relating to data retention.
ICANN can’t claim it was unaware that the new RAA might be illegal for some registrars either. The Article 29 WP told it so last September, causing ICANN to introduce the idea of exemptions.
However, the European Commission’s GAC representative then seemed to dismiss the WP’s concerns during ICANN’s public meeting in Toronto last October.
Perhaps ICANN was justifiably confused by these mixed messages.
According to Michele Neylon, chair of the Registrars Stakeholder Group, it has yet to respond to European registrars’ inquiries about the Article 29 letter, which was sent June 6.
“We hope that ICANN staff will take the letter into consideration, as it is clear that the data protection authorities do not want create extra work either for themselves or for registrars,” Neylon said.
“For European registrars, and non-European registrars with a customer base in the EU, we look forward to ICANN staff providing us with clarity on how we can deal with this matter and respect EU and national law,” he said.