Irony alert! Data protection agency complains it can’t get access to private Whois data

A European data protection authority has complained to ICANN after a registrar refused to hand over one of its customers’ private Whois records, citing the GDPR data protection regulation, according to ICANN.

Compounding the irony, the DPA wanted the data as part of its probe into an alleged GDPR violation at the domain in question.

This is the frankly hilarious scenario outlined in a letter (pdf) from ICANN boss Göran Marby to Andrea Jelinek, chair of the European Data Protection Board, last week.

Since May 2018, registrars and registries have been obliged under ICANN rules to redact all personally identifiable information from public Whois records, because of the EU’s General Data Protection regulation.

This has irked the likes of law enforcement and intellectual property owners, who have found it increasingly difficult to discover the identities of suspected bad actors such as fraudsters and cybersquatters.

Registrars are still obliged to hand over data upon request in certain circumstances, but the rules are vague, requiring a judgement call:

Registry and Registrar MUST provide reasonable access to Personal Data in Registration Data to third parties on the basis of a legitimate interests pursued by the third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Registered Name Holder or data subject pursuant to Article 6(1)(f) GDPR.

While an ICANN working group has been attempting to come up with a clearer-cut set of guidelines, administered by a central body, this so-called SSAD (System for Standardized Access/Disclosure) has yet to come to fruition.

So when an unidentified European DPA recently asked a similarly unidentified non-EU registrar for the Whois data of somebody they suspected of GDPR violations, the registrar told it to get stuffed.

It told the DPA it would “not act against a domain name without any clear and unambiguous evidence for the fraudulent behavior” and said it would respond to legal requests in its own jurisdiction, according to ICANN.

The DPA complained to ICANN, and now ICANN is using that complaint to shame the EDPB into getting off the fence and providing some much-needed clarity about when registrars can declassify Whois data without breaking the law.

Marby wrote that registrars are having to apply their “subjective judgment and discretion” and will most often come down on the side of registrants in order to reduce their GDPR risk. He wrote:

ICANN org would respectfully suggest to the EDPB that a more explicit recognition of the importance of certain legitimate interests, including the relevance of public interests, combined with clearer guidelines on balancing, could address these problems.

…

ICANN org would respectfully suggest to the EDPB to consider issuing additional specific guidance on this topic to ensure that entities with a legitimate interest in obtaining access to non-public gTLD registration data are able to do so. Guidance would in particular be appreciated on how to balance legitimate interests in access to data with the interests of the data subject concerned

ICANN and the EDPB have been communicating about this issue for a couple of years now, with ICANN looking for some clarity on this largely untested area of law, but the EDPB’s responses to data have been pretty vague and unhelpful, almost as if it doesn’t know what the hell it’s doing either.

Will this latest example of the unintended consequences of GDPR give the Board the kick up the bum it needs to start talking in specifics? We’ll have to wait and see.

1 Comment Tagged: dpas, edpb, epdp, gdpr, ICANN, privacy, security, ssad, trademarks, whois

ICANN dissenter explains why she wanted .org sale approved

ICANN has finally published the dissenting statement made by one of its directors following the vote to deny Ethos Capital the right to acquire Public Interest Registry from the Internet Society.

Avri Doria was one of only two directors to vote against the majority on the April 30 resolution, and the only one to file a written statement for the record, which ICANN has now published (pdf). It reads:

Briefly, I believe that the contractual conditions have been met by PIR and Ethos and that they have gone beyond these required contractual conditions to offer significant public interest commitments currently missing from the current contract.

On balance after intense study of the proposal I have come to conclusion that the Public Interest of registrants and users is better served by the PICs offered by PIR, though they could
be stronger, than by forcing PIR to remain within ISOC without any guarantees on public interest related to data usage and freedom of expression.

In exchange for ICANN approval of the deal, Ethos had promised to cap its price increases at 10% for eight years and to create a largely independent stewardship council to monitor issues related to privacy and free speech in .org.

With ICANN voting to deny the acquisition, PIR is not required to live up to those commitments, but opponents of the deal feel that its not-for-profit status under ISOC control provide stronger protections against bad behavior.

ICANN said it rejected the deal on “public interest” grounds for a variety of reasons including the lack of transparency into Ethos’ ultimate ownership, distrust that Ethos would be able to service its debt, doubt over its management in the long term, and the sheer volume of dissent from the community.

Also playing a strong role was an objection from the California attorney general, who pulled rank and informed ICANN that it should reject the deal, reminding the organization that it was subject to his oversight. This has been described as a dangerous precedent.

1 Comment Tagged: .org, acquisition, california attorney general, ethos, ICANN, isoc, pir

CSC removes reference to “retiring” new gTLD domain after retiring new gTLD domain

The corporate registrar and new gTLD management consultant CSC Global has ditched a new gTLD domain in favor of a .com, but edited its announcement after the poor optics became clear.

In a brief blog post this week, the company wrote:

We’re retiring cscdigitalbrand.services to give you a more user-friendly interface at cscdbs.com.

From the trusted provider of choice for Forbes Global 2000 companies, this more user-friendly site is filled with information you need to secure and protect your brand. You’ll experience a brand new look and feel, at-a-glance facts and figures, learn about the latest digital threats, access our trusted resources, and see what our customers are saying.

Visit the site to learn more about our core solutions: domain management, domain security, and brand and fraud protection.

But the current version of the post expunges the first paragraph, referring to the retirement of its .services domain, entirely.

I’m going to guess this happened after OnlineDomain reported the move.

But the original text is still in the blog’s cached RSS feed at Feedly.

It’s perhaps not surprising that CSC would not want to draw attention to the fact that it’s withdrawn to a .com from a .services, the gTLD managed by Donuts.

After all, CSC manages dozens of new gTLDs for clients including Apple, Yahoo and Home Depot, and releases quarterly reports tracking and encouraging activation of dot-brands.

Interestingly, and I’m veering a little off-topic here, there is a .csc new gTLD but CSC does not own it. It was delegated to a company called Computer Sciences Corporation (ironically through an application managed by CSC rival MarkMonitor) which also owns csc.com.

Computer Sciences Corporation never really got around to using .csc, and in 2017 merged with a unit of HP to form DXC Technology.

If you visit nic.csc today, you’ll be redirected to dxc.technology/nic, which bears a notice that it’s the “registry for the .dxc top-level domain”.

Given that the .dxc top-level domain doesn’t actually exist, I think this might make DXC the first company to openly declare its intent to go after a dot-brand in the next round of new gTLDs.

4 Comments Tagged: .services, csc, csc global, donuts, dot-brands, dxc, ICANN, new gTLDs, trademarks

Google launches .meet gTLD after Meet service goes free during lockdown

Google Registry is to launch its .meet gTLD next week with a sunrise period for trademark owners, but, perhaps controversially, it intends to keep the rest of the domains for itself.

It is expected that the company plans to use .meet domains in its Google Meet conferencing service, which was recently revamped and went free-to-use after Google realized that rival Zoom was eating its lunch during the coronavirus lockdown.

Google bought the .meet gTLD from Afilias back in 2015 but has kept it unused so far, even after the Meet service opened in 2017.

But according to ICANN records, it’s due to go into a one-month sunrise period from May 25, with an open-ended Trademark Claims period from June 25.

In a brief statement on its web site Google says:

Google Registry is launching the .meet TLD. This domain is Spec 9/ROCC exempt, which means we will be the registrant for all domains on the TLD and it will not be made generally available. The RRA for the TLD is available upon request, but registrations on behalf of the registry will be processed through a small number of registrars with whom the relevant product teams at Google work.

Translated from ICANN-speak, this means that Google has an exemption from Specification 9 in its .meet registry contract, releasing it from the Registry Operator Code of Conduct, which obliges registries to treat all registrars equally.

This means Google can’t sell the domains to anyone else, nor can it allow them to be controlled by anyone else, and it can use a limited pool of registrars to register names.

Spec 9 is a bit different to Spec 13, which exempts dot-brands from ICANN trademark-protection rules such as sunrise and Trademark Claims. You could argue that Spec 9 is “dot-brand lite”.

But what both Spec 9 and Spec 13 have in common is that they can’t be used in gTLDs ICANN considers a “generic string”, which is defined as:

a string consisting of a word or term that denominates or describes a general class of goods, services, groups, organizations or things, as opposed to distinguishing a specific brand of goods, services, groups, organizations or things from those of others.

Does .meet qualify there? It’s undoubtedly a dictionary word, but does it also describe a class of things? Maybe.

Google’s search engine itself gives one definition of “meet” as “an organized event at which a number of races or other athletic contests are held”, which one could reasonably argue is a class of services.

When Afilias applied for .meet in 2012, it expected it to be used by dating sites.

Google did not addresses the non-genericness of the string in its Spec 9 application. That judgement appears to have been made by ICANN alone.

Previously, requests for Spec 9 exemptions from the likes of .giving, .star, .analytics, .latino, .mutual, and .channel have been rejected or withdrawn.

It seems that Spec 9 exemption is going to somewhat limit .meet’s utility, given that third-parties will not be able to get “control or use of any registrations”.

Comment Tagged: .meet, google, google registry, ICANN, launch, new gTLDs, rocc, spec 13, spec 9, sunrise, trademark claims

Aussie ccTLD surges under coronavirus lockdown

Australia’s .au ccTLD may have been in decline recently, but it saw a surge in new domain registrations during its coronavirus lockdown, according to registry stats.

auDA said that 48,754 new .au domains were registered in April, a more than 23% increase on its April 2019 number.

The registry called this leap “the biggest month for new domain name creations we’ve seen in a while”. It averages about 40,000 per month, with seasonality.

The overall number of extant registrations was down a bit to 3,168,883, but auDA chalks this up to the expiration of domains registered during registrar promotions a year ago.

Australia was under its lockdown, which was less severe than in other countries, for the whole month of April. The measures were put in place March 21 and relaxed last week.

Numbers for March show a year-over-year decline of 1.4% in new adds.

While auDA does not attribute its April growth to lockdown, I think the numbers show that the movement restrictions imposed certainly didn’t hurt .au’s business.

3 Comments Tagged: .au, auda, cctlds, coronavirus, lockdown

Spring Break redux! ICANN picks Cancun for 2023 meeting

Having had its plans for a public meeting in Cancun, Mexico concurrent with Spring Break nixed by the nasty coronavirus this March, ICANN has decided to try again not once but twice.

Not only is it planning to hold its Community Forum there next year, but its board of directors has just voted to return in 2023 also, in a meeting that will run from March 11 to 16.

It will be ICANN 76. But the location of ICANN 75, scheduled for September 2022, is still a mystery. The board has authorized negotiations with the proposed venue(s) but has redacted any clues as to where it might be.

We don’t even know which of ICANN’s five rotating geographic regions it will be in, though Asia-Pac seems most likely, given that its last physical meeting there was in March 2019.

1 Comment Tagged: ICANN

ICANN’s .org decision was NOT unanimous, and it was made in secret

When ICANN announced its decision to deny Public Interest Registry’s request to be acquired by Ethos Capital at the end of April, I felt a little foolish.

I’d confidently predicted just days earlier that the decision by the board would not be unanimous, but ICANN, in announcing the decision, said “the entire Board stands by this decision”.

But it turns out I was right after all. Three directors voted against the consensus and one abstained.

The dissenting votes were cast by industry policy consultant Avri Doria, Serbian internet pioneer Danko Jevtović, and former Sudanese ccTLD operator Ihab Osman.

Doria and Jevtović voted against the first resolved clause, which rejected PIR’s request. All three voted against the second resolved clause, which would have allowed PIR to file a second request.

Sarah Deutsch, a private practice lawyer, abstained from both votes, presumably because she also sits on the board of the Electronic Frontier Foundation, the civil liberties group that can, via California’s attorney general, probably be credited most with getting the transaction killed.

All three dissenters and Deutsch are Nominating Committee appointees.

According to the preliminary report of the April 30 meeting, “Doria indicated that she would be voting against the resolution and explained her views about how the public interest would be better served by ICANN granting its consent to PIR’s request.”

What her reasons were are not reflected in the record.

It also seems likely that any substantive minuting of ICANN’s decision is likely to be limited, as it appears to have been made at a different, off-the-books session at an unspecified earlier date.

The preliminary report notes the “the Board discussed and considered alternative draft resolutions for potential Board action as part of an earlier briefing”.

No such earlier meeting is listed on ICANN’s web site. The board’s previous formal meeting, two weeks earlier, had PIR’s request removed from the agenda at the last minute.

So it appears that ICANN’s board decided to reject the deal basically in secret at some point between April 17 and April 29, during a meeting of which ICANN has no obligation to publicly release the minutes.

Nice transparency loophole!

There’s always the Documentary Information Disclosure Policy, I suppose.

8 Comments Tagged: .org, acquisition, board, ethos, ICANN, isoc, pir, transparency

Donuts kicks down .place fences after attempt at innovation

Donuts has made its temporarily restricted gTLD .place unrestricted once again, two years after announcing it would be taking a stab at some technological innovation.

.place has been under lockdown for two years as Donuts planned to use it in “geofencing” applications developed by a startup it had invested in.

Geofencing is the practice of dividing the world up into three dimensional GPS-based chunks, placing those chunks into a registry, then selling them to businesses and others.

The idea was that each .place domain would be linked to a specific geofenced area. Mick could register mickscafe.place and assign the coordinates of his cafe to that domain.

In 2018, Donuts started telling registrars not to sell .place domains until its partner, Geo.Network, had launched its applications. It had invested an undisclosed sum in Geo.Network in 2016, when it was known as GeoFrenzy.

But these applications do not appear to have yet surfaced, and Donuts is now letting anyone register .place names for $10 a pop.

Since the 2018 freeze, the number of registered .place domains has tumbled from about 7,500 to about 3,800. Donuts says it has a 63% renewal rate and that 26% of its names are in active use.

2 Comments Tagged: .place, donuts, geo.network, geofencing, geofrenzy, geonetwork

.org sale officially dead

Public Interest Registry has formally announced that its proposed $1.13 billion acquisition by Ethos Capital is dead.

The company told ICANN yesterday that it is withdrawing its request for a change of control under its .org contract and that it “will not be pursuing an ICANN Request for Reconsideration or taking any other action to try to revive the Transaction”.

In a statement, CEO Jon Nevett said that PIR is no longer for sale to any other party. It will remain under the Internet Society’s control.

He also pointed out that it’s not within ICANN’s power to arbitrarily transfer .org to another registry, as some critics have called for.

“Such a transfer by ICANN is a contractual impossibility under our registry agreement,” he wrote.

ICANN rejected the change of control request after deciding it was not in the public interest for .org to pass into for-profit hands.

Following the decision, ISOC had indicated that PIR was no longer for sale.

3 Comments Tagged: .org, acquisition, ethos, ICANN, isoc, pir, public interest registry

Afilias promotes .vote domains amid US vote-by-mail controversy

Afilias-owned Monolith Registry, which runs .vote and .voto, has launched a site designed to help US citizens figure out how — or if — they’re able to vote by mail during the coronavirus outbreak.

The site, at mailyourballot.vote, comes as controversy rages in the US about whether voters should be forced to show up in person to ballot boxes in the midst of a deadly-virulent pandemic.

Reports suggest that Republicans are generally against mail-in votes, hiding behind bogus fears of voter fraud, because a lower turnout generally favors their candidates.

While I suppose one could argue that by attempting to make the information accessible it’s implicitly picking a side, Afilias doesn’t have a lot to say about the partisan debate. It said in a press release:

In the age of COVID-19, many voters are interested in voting by mail to avoid potential exposure to the virus. Unfortunately, learning HOW to vote by mail is difficult, as every state has different rules and puts this critical information in a different place. For example, 7 states (IN, LA, MI, SC, TX, YN and KY) restrict voting by mail to elderly voters only and 29 states (plus Washington, D.C.) only allow it in federal elections. Recently, governors of two states (NY and KY) ordered absentee ballot applications to be sent to all of their states’ voters.

The new site itself is little more than a directory: a clickable map of the US that bounces you to the official state government policy/instructions on voting by mail.

.vote isn’t an especially populous gTLD, having roughly 3,500 regs at the last count.

The US presidential election is this November.

1 Comment Tagged: .vote, .voto, afilias, monolith