Exclusive: Tiny island sues to take control of lucrative .nu

The tiny Pacific island of Niue has sued the Swedish ccTLD registry to gain control of its own ccTLD, .nu, DI has learned.
The lawsuit, filed this week in Stockholm, claims that the Internet Foundation In Sweden (IIS) acted illegally when it essentially took control of .nu in 2013, paying its American owner millions of dollars a year for the privilege.
Niue wants the whole ccTLD registry transferred to its control at IIS’s expense, along with all the profits IIS has made from .nu since 2013 — many millions of dollars.
It also plans to file a lawsuit in Niue, and to formally request a redelegation from IANA.
While .nu is the code assigned to Niue, it has always been marketed in northern Europe, particularly Sweden, in countries where the string means “now”.
It currently has just shy of 400,000 domains under management, according to IIS’s web site, having seen a 50,000-name slump just a couple weeks ago.
It was expected to be worth a additional roughly $5 million a year for the registry’s top line, according to IIS documents dated 2012, a time when it only had about 240,000 domains.
For comparison, Niue’s entire GDP has been estimated at a mere $10 million, according to the CIA World Factbook. The island has about 1,800 inhabitants and relies heavily on tourism and handouts from New Zealand.
According to documents detailing its 2013 takeover, IIS agreed to pay a minimum of $14.7 million over 15 years for the right to run the ccTLD, with a potential few million more in performance-related bonuses.
The Niue end of the lawsuit is being handled by Par Brumark, a Swedish national living in Denmark, who has been appointed by the Niuean government to act on its behalf on ICANN’s Governmental Advisory Committee, where he is currently a vice-chair.
Brumark told DI that IIS acted illegally when it took over .nu from previous registry, Massachusetts-based WorldNames, which had been running the ccTLD without the consent of Niue’s government since 1997.
The deal was characterized by WorldNames in 2013 as a back-end deal, with IIS taking over administrative and technical operations.
But IIS documents from 2012 reveal that it is actually more like a licensing deal, with IIS paying WorldNames the aforementioned minimum of $14.7 million over 15 years for the rights to manage, and profit from, the TLD.
The crux of the lawsuit appears to be the question of whether .nu can be considered a “Swedish national domain”.
IIS is a “foundation”, which under Swedish law has to stick to the purpose outlined in its founding charter.
That charter says, per IIS’s own translation, that the IIS “must particularly promote the development of the handling of domain names under the top-level domain .se and other national domains pertaining to Sweden.”
Brumark believes that .nu is not a national domain pertaining to Sweden, because it’s Niue’s national ccTLD.
One of his strongest pieces of evidence is that the Swedish telecoms regulator, PTS, refuses to regulate .nu because it’s not Swedish. PTS is expected to be called as a witness.
But documents show that the Stockholm County Administrative Board, which regulates Foundations, gave permission in 2012 for IIS to run “additional top-level domains”.
Via Google Translate, the Board said: “The County Administrative Board finds that the Foundation’s proposed management measures to administer, managing and running additional top-level domains is acceptable.”
Brumark thinks this opinion was only supposed to apply to geographic gTLDs such as .stockholm, and not to ccTLD strings assigned by ISO to other nations.
The Stockholm Board did not mention .nu or make a distinction between ccTLD and gTLDs in its letter to IIS, but the letter was in response to a statement from an IIS lawyer that .nu, with 70% of its registrations in Sweden, could be considered a Swedish national domain under the IIS charter.
Brumark points to public statements made by IIS CEO Danny Aerts to the effect that IIS is limited to Swedish national domains. Here, for example, he says that IIS could not run .wales.
IIS did not respond to my requests for comment by close of business in Sweden today.
Niue claims that if .nu isn’t Swedish, IIS has no rights under its founding charter to run it, and that it should be transferred to a Niuean entity, the Niue Information Technology Committee.
That’s a governmental entity created by an act of the local parliament 18 years ago, when Niue first started its campaign to get control of .nu.
The history of .nu is a controversial one, previously characterized as “colonialism” by some.
The ccTLD was claimed by Boston-based WorldNames founder Bill Semich and an American resident of the island, in 1997. That’s pre-ICANN, when the IANA database was still being managed by Jon Postel.
At the time, governments had basically no say in how their ccTLDs were delegated. It’s not even clear if Niue was aware its TLD had gone live at the time.
The official sponsor of .nu, according to the IANA record, is the IUSN Foundation, which is controlled by WorldNames.
Under ICANN/IANA policy, the consent of the incumbent sponsor is required in order for a redelegation to occur, and WorldNames has been understandably reluctant to give up its cash cow, despite Niue trying to take control for the better part of two decades.
The 2000 act of parliament declared that NITC was the only true sponsor for .nu, but even Niuean law has so far not proved persuasive.
So the lawsuit against IIS is huge twist in the tale.
If Niue were to win, IIS would presumably be obliged to hand over all of its registry and customer data to Niue’s choice of back-end provider.
Both Afilias and Danish registrar One.com have previously expressed an interest in running .nu, providing a share of the revenue to Niue, according to court documents.
Brumark said that a settlement might also be possible, but that it would be very costly to IIS.
Readers might also be interested in my 2011 article about Niue, which was once widely referred to as the “WiFi Nation”.

7 Comments Tagged: .nu, .se, afilias, cctlds, iana, ICANN, iis, iusn foundation, lawsuit, niue, one.com, postel, redelegation, worldnames

Belgium to crack down on fraud domains

DNS Belgium says it will shortly implement a new policy that will see it take down .be domains associated with fraud within 24 hours of discovering them.
The new scheme, which comes into effect December 1, essentially grants the Belgian government’s ministry of the economy — FPS Economy or Federal Public Service Economy in local parlance — a trusted notifier status when it comes to takedowns.
Previously, requests had to go through public prosecutors and took about two weeks, giving attackers a longer window to milk their victims.
Under the old regime, FPS Economy could only request a suspension in cases where the Whois data was inaccurate.
The registry said it will only suspend domains that are involved in “serious crimes”, including phishing and fraudulent web stores.
Registrants will have two weeks to appeal their suspensions. After six months, the domains will be deleted.
Several hundred .be domains per year are expected to be affected.

Comment Tagged: .be, dns belgium, fps economy, fraud, suspension, takedown

.cloud gets the China blessing

.cloud, run by Italian registry Aruba, has become the latest TLD to get the official nod to sell in China.
The blessing from the Ministry of Industry and Information Technology came at the end of October and the company announced it today.
The accreditation means .cloud domains sold to residents of the Chinese mainland will now be resolvable, and subject to China’s onerous censorship rules.
It’s the first Latin-script TLD to be approved by MIIT since July.
.cloud says it currently has 155,000 domains registered to customers in 180 countries.

Comment Tagged: .cloud, aruba, china, miit, new gTLDs

Donuts backs away from .spa fight

Donuts has finally admitted defeat in its long-running fight to run the .spa gTLD, withdrawing its application and leaving rival Asia Spa and Wellness Promotion Council the victor.
ASWPC, run from Hong Kong by .asia’s Edmon Chung, has now entered into contracting with ICANN.
The company had won a Community Priority Evaluation back in 2015, with a passing score of 14 out of 16, which Donuts has been challenging ever since.
Donuts and ICANN were in a so-called Cooperative Engagement Process, a form of informal arbitration designed to stave off a more expensive Independent Review Process fight, from January 2016 until this month.
This meant ASWPC has been sitting twiddling its thumbs, unable to sign its contract or launch its TLD, for the better part of three years.
It’s not clear why Donuts decided not to go to a full-blown IRP. The company declined to comment for this article.
As a community applicant, the company had the backing of hundreds of spas worldwide.
It also had the backing of the Belgian government, which was important because spas are (little-known fact alert!) named after the tiny Belgian town of Spa.
It is believed that ASWPC promised up to 25% of its profits to Spa in order to gain this backing, but only from domains registered by Belgian, Dutch, Luxembourgish, French or German registrants.

Comment Tagged: .spa, asia spa and wellness promotion council, aswpc, belgium, cep, community, cpe, ICANN, irp, new gTLDs

First chance to have your say on the future of Whois

RIP: the Whois Admin.
Standard Whois output is set to get slimmed down further under newly published policy proposals.
The community working group looking at post-GDPR Whois has decided that the Admin Contact is no longer necessary, so it’s likely to get scrapped next year.
This is among several recommendations of the Expedited Policy Development Process working group on Whois, which published its initial report for public comment late Wednesday.
As expected, the report stops short of addressing the key question of how third-parties such as intellectual property interests, domain investors, security researchers and the media could get streamlined access to private Whois data.
Indeed, despite over 5,000 person-hours of teleconferences and face-to-face meetings and about 1,000 mailing list messages since work began in early August, the EPDP’s 50 members have yet to reach consensus on many areas of debate.
What they have reached is “tentative agreement” on 22 recommendations on how to bring current ICANN Whois policy into line with EU privacy law, the General Data Protection Regulation.
The work is designed to replace the current Temporary Specification, a Band-Aid imposed by the ICANN board of directors, which is due to expire next May.
The EPDP initial report proposes a few significant changes to what data is collected and publicly displayed by the Whois system.
The most notable change is the complete elimination of the Admin Contact fields.
Currently, Whois contains contact information for the registrant, admin contact and technical contact. It’s often the same data replicated across all three records, and under the Temp Spec the large majority of the data is redacted.
Under the EPDP’s proposal, the Admin Contact is superfluous and should be abandoned altogether. Not only would it not be displayed, but registrars would not even collect the data.
The Tech Contact is also getting a haircut. Registrars would now only be able to collect name, phone and email address, and it would be optional for the registrant whether to provide this data at all. In any event, all three fields would be redacted from public Whois output.
For the registrant, all contact information except state/province and country would be redacted.
There’s no agreement yet on whether the optional “organization” field would be redacted, but the group has agreed that registrars should provide better guidance to registrants about whether they need to provide that data.
While data on legal persons such as companies is not protected by GDPR, some fear that natural person registrants may just naively type their own name into that box when registering a name, inadvertently revealing their identities to the public.
Those providing Whois output would be obliged, as they are under the Temp Spec, to publish an anonymized email address or web-based contact form to allow users to contact registrants without personal information being disclosed.
That German lawsuit
The recommendation to slash what data is collected could have an impact on ICANN’s lawsuit against Tucows’ German subsidiary, EPAG.
ICANN is suing EPAG after the registrar decided that collecting admin and tech contact info was not compliant with GPDR. It’s been looking, unsuccessfully, for a ruling forcing the company to carry on collecting this data.
Tucows is of the view that if the admin and tech contacts are third parties to the registration agreement, it has no right to collect data about them under the GDPR.
If ICANN’s own community policy development process is siding with Tucows, this could guide ICANN’s future legal strategy, but not, it appears, until it becomes firm consensus policy.
I asked ICANN general counsel John Jeffrey about whether the EPDP’s work could affect the lawsuit during an interview October 5, shortly after it became clear that the admin/tech contact days might be numbered.
“Maybe,” he said. “If it becomes part of the policy we’ll have to assess that. Until there’s a new policy though, what we’re working with is the Temp Spec. The Temp Spec we believe is enforceable, we believe have the legal support for that, and we’ll continue down that path.”
(It might be worth noting that Thomas Rickert, whose law firm represents EPAG in this case, is on the EPDP working group in his capacity of head of domains for German trade group eco. He is, of course, just one of the 31 EPDP members developing these recommendations at any given time.)
IP wheel-spinning
The main reason it’s taken the EPDP so long to reach the initial report stage — the report was originally due during the ICANN 63 Barcelona meeting a month ago — has been the incessant bickering between those advocating for, and opposing, the rights of intellectual property interests to access private Whois data.
EPDP members from the IP Constituency and Business Constituency have been attempting to future-proof the work by getting as many references to IP issues inserted into the recommendations as they can, before the group has turned its attention to addressing them specifically.
But they’ve been opposed every step of the way by the Non-Commercial Stakeholders Group, which is concerned the IP lobby is trying to policy its way around GDPR as it relates to Whois.
Many hours have been consumed by these often-heated debates.
My feeling is that the NCSG has been generally winning, but probably mainly because the working group’s charter forbade discussion about access until other issues had been addressed.
As it stands today, the initial report contains this language in Recommendation #2:

Per the EPDP Team Charter, the EPDP Team is committed to considering a system for Standardized Access to non-public Registration Data once the gating questions in the charter have been answered. This will include addressing questions such as:
• What are the legitimate purposes for third parties to access registration data?
• What are the eligibility criteria for access to non-public Registration data?
• Do those parties/groups consist of different types of third-party requestors?
• What data elements should each user/party have access to?
In this context, amongst others, disclosure in the course of intellectual property infringement and DNS abuse cases will be considered

This is basically a placeholder to assure the IP crowd that their wishes are still on the table for future debate — which I don’t think was ever in any doubt — but even this basic recommendation took hours to agree to.
The EPDP’s final report is due February 1, so it has just 70 days to discuss this hypothetical “Standardized Access” model. That’s assuming it started talks today, which it hasn’t.
It’s just nine weeks if we assume not a lot is going to happen over the Christmas/New Year week (most of the working group come from countries that celebrate these holidays).
For context, it’s taken the working group about 115 days just to get to the position it is in today.
Even if Standardized Access was the only issue being discussed — and it’s not, the group is also simultaneously going to be considering the public comment on its initial report, for starters — this is an absurdly aggressive deadline.
I feel fairly confident in predicting that, come February 1, there will be no agreement on a Standardized Access framework, at least not one that would be close to implementable.
Have your say
All 22 recommendations, along with a long list of questions, have now been put out for public comment.
The working group is keen to point out that all comments should provide rationales, and consider whether what they’re asking for would be GDPR-compliant, so comments along the lines of “Waaah! Whois should be open!” will likely be rapidly filed to the recycle bin.
It’s a big ask, considering that most people have just a slim grasp of what GDPR compliance actually means.
Complicating matters, ICANN is testing out a new way to process public comments this time around.
Instead of sending comments in by email, which has been the norm for two decades, a nine-page Google form has been created. This is intended to make it easier to link comments to specific recommendations. There’s also a Word version of the form that can be emailed.
Given the time constraints, it seems like an odd moment to be testing out new processes, but perhaps it will streamline things as hoped. We’ll see.

7 Comments Tagged: epag, epdp, gdpr, ICANN, privacy, temp spec, tucows, whois

Uniregistry working on bulk trademark blocking service

Uniregistry is planning to launch a bulk trademark block service, along the same lines as Donuts’ Domain Protected Marks List.
But it’s going to be roughly 50% more expensive than DPML, on a per-TLD basis.
The company has applied to ICANN to run what it calls “Uni EP” across its whole portfolio of 26 gTLDs.
Uni EP would be “largely identical” to DPML, according to Uniregistry’s Registry Service Evaluation Requests.
This means that anyone who has their trademark registered in the Trademark Clearinghouse will be able to block the matching string in all of Uniregistry’s TLDs.
Nobody else would be able to register that mark unless they also had a TMCH-validated trademark for the same string.
The pricing would be lower than if the brand owner individually defensively registered in each of the 26 TLDs.
With Donuts, which manages a portfolio almost 10 times as large, DPML tends to be priced around the $6,000 mark retail for a five-year block. That works to about $5 per TLD per year.
Uniregistry CEO Frank Schilling said Uni EP could be priced as low as $200 per year. That would work out to about $7.70 per TLD.
The relatively higher pricing might make sense when you consider the larger variation in regular pricing for Uniregistry TLDs, compared to Donuts.
It has several that retail for around $100 a year, and three — .cars, .car and .auto — that sell for close to $3,000 a year.
Still, the Uni EP price is obviously going to be a lot cheaper than regular defensive registrations.
Companies that have already purchased defensively would get to add their domains to the block service after the current registration expires, the RSEP states.
Like DPML, Uni EP would also have a “Plus” version, in which confusingly similar strings in eight scripts would also be blocked.
Uniregistry says it consulted with three brand protection registrars — CSC, MarkMonitor and Safenames — about the service and that their reactions were “favorable”.
Uniregistry’s current portfolio comprises .country, .audio, .car, .blackFriday, .auto, .cars, .christmas, .click, .diet, .flowers, .game, .gift, .guitars, .help, .hiphop, .hiv, .hosting, .juegos, .link, .lol, .mom, .photo, .pics, .property, .sexy, and .tattoo.

1 Comment Tagged: blocking, defensive, donuts, dpml, ICANN, rsep, trademarks, uni ep, unregistry

ICANN urged to reject .com price increases

The Internet Commerce Association has asked ICANN to refuse to allow Verisign to raise its wholesale prices for .com domain names.
The domainer trade group wrote to ICANN last week to point out that just because the Trump administration has dropped the US government objection to controlled price increases, that doesn’t necessarily mean ICANN has to agree.
Verisign’s deal with the National Telecommunications and Information Administration “does not of course, compel ICANN to agree to any such increases. Any such decision regarding .com pricing
remains with ICANN” ICA general counsel Zak Muscovitch wrote.
The deal allows Verisign to increase the price of .com registrations, renewals and transfers by 7% per year in four of the next six years, leading to a compound 30% increase by the time it concludes.
The arguments put forth Muscovitch’s letter are pretty much the same as the arguments ICA made when it was lobbying NTIA to maintain the price freeze.
Namely: Verisign already makes a tonne of money from .com, it has a captive audience, it cannot claim credit for .com’s success, and .com is not constrained by competition.
“As NTIA makes clear, it is up to Verisign to request a fee increase and ICANN that may agree or disagree. ICANN should not agree. Indeed, it would be a dereliction of ICANN’s responsibilities to the ICANN community if Verisign were permitted to raise its fees when it is already very well paid for the services which it provides,” Muscovitch’s letter (pdf) concludes.
For many years ICANN has been reluctant to get involved in price regulation. It remains to be seen whether it will make an exception for .com.

5 Comments Tagged: .com, ica, ICANN, ntia, pricing, verisign

Nominet takes down 32,000 domains for IP infringement

The number of .uk domains suspended by Nominet has doubled over the last year, almost entirely due to takedown requests concerning intellectual property.
The .uk registry said this week that it suspended 32,813 domains in the 12 months to October 31, up from 16,632 in the year-ago period.
It’s the fourth year in a row that the number of suspensions has more than doubled. In 2014, it was a paltry 948.
While Nominet has trusted notifier relationships with 10 law enforcement agencies, it’s the Police Intellectual Property Crimes Unit that is responsible for almost all of the takedown requests, 32,669 this year.
No court order or judicial review is required. Nominet simply carries out unspecified “administrative checks” then suspends the domain.
Only 114 domains did not make the cut this year, Nominet said, but that’s up considerably from 32 last year.
There’s an appeals mechanism that can be used by registrants to restore their domains, for example if they’ve removed the infringing content. It was used successfully 16 times in the year, up by one on last year.
The registry also reported that no domains were suspended due to its ban on incitement-to-rape domains, down from two last year, but that staff had to manually review 2,717 new registrations containing suspect strings.

Comment Tagged: .uk, censorship, copyright, nominet, piracy, suspensions

Hebrew .com off to a slow start

The Hebrew transliteration of .com has only sold a couple hundred domains since it went into general availability.
Verisign took the new gTLD קום. (Hebrew is a right-to-left script, so the dot comes after the string) to market November 5, when it had about 3,200 domains in its zone file. It now stands around the 3,400 mark.
The pre-GA domains are a combination of a few hundred sunrise regs and a few thousand exact-match .coms that were grandfathered in during a special registration period.
It’s not a stellar performance out of the gates, but Hebrew is not a widely-spoken language and most of its speakers are also very familiar with the Latin script.
There are between seven and nine million Hebrew speakers in the world, according to Wikipedia. It doesn’t make the top 100 languages in the world.
The ccTLD for Israel, where most of these speakers live, reports that it currently has 246,795 .il domains under management. That’s a middling amount when compared to similarly sized countries such as Serbia (about 100,000 names) and Switzerland (over 2 million).
Verisign’s original application for this transliteration had to be corrected, from קום. to קוֹם. If you can tell the difference, you have better eyesight than me.
In the root, the gTLD is Punycoded as .xn--9dbq2a.

6 Comments Tagged: .com, cctlds, hebrew, new gTLDs, transliteration, verisign, קום.

Incel hate site jumps to Iceland after doMEn suspends .me domain

Incels.me, a web forum that hosts misogynist rants by “involuntarily celibate” men, has found a new home after .me registry doMEn suspended its domain.
The web site has reappeared, apparently unscathed, under Iceland’s .is domain, at incels.is.
doMEn said in a blog post yesterday that it had suspended incels.me at the registry level due to the owner “allowing part of its members to continuously promote violence and hate speech”.
The suspension happened October 15, and the site reappeared in .is not long after. It’s not entirely clear why doMEn chose to explain its decision over a month later. It said:

The decision to suspend the domain was made after the .ME Registry exhausted all other possibilities that could assure us that the registrant of incels.me domain and the owner of i
incels.me forum was able to remove the subject content and prevent the same or similar content from appearing on the forum again.

An “incel” is a man who has decided that he is too ugly, charmless, short, stupid or otherwise unattractive, and is therefore permanently unfuckable.
While that may provoke sympathetic thoughts, a great many of the incels frequenting sites like incels.me choose to channel their frustration into cartoonish misogyny ranging from the laughable to the extremely disturbing.
While the registry didn’t mention it, the site also has many threads that appear to encourage suicide.
doMEn seems to have turned off the domain because certain threads crossed the line from misogyny to incitement to violence against women.
The Montenegro-based company said it had been monitoring the site since May, after being told that “certain members” of the forum “might have been involved in or associated with” an attack in Toronto that killed 10 people in April, a charge the incels.is admin denies.
The second reason given — preventing content appearing in future — may be the crux here.
The site’s administrator said in a post on the new site that he had personally removed all of the threads highlighted by doMEN as being in violation of its registry policies.
He also posted a partial email thread between himself and his former registrar, China-based NiceNIC.net, in which he explains how difficult it is to monitor all the content posted by his users. He wrote on the forum:

They obviously weren’t going to give us a fair shake either way, and we’re not going to search through 1.6 MILLION posts nor do we have the technological capabilities to check to see if any of them are against their vague anti-abuse policy.
…
Domain registries have no place in enforcing arbitrary rules against domains that go against their ideology.

It seems from the thread that Afilias, 37%-owner of doMEn and .me back-end provider, had a hands-on role in the suspension.
Incels certainly isn’t the first controversial site to have to resort to TLD-hopping to stay alive.
The most notable example is piracy site KickAssTorrents, which bounced from ccTLD to ccTLD for years before finally being shut down by the US Feds.
The incels.is admin said he had confidence in Iceland’s registry due to “their stance as pro free-speech enforcers”.
But ISNIC is not above suspending domains when the associated sites break Icelandic law. Four years ago it took down some domains associated with ISIS.
The takedown comes not long after GoDaddy attracted attention for suspending the domain of far-right Twitter clone Gab.com, again due to claims of incitement to violence related to an act of domestic terrorism.

2 Comments Tagged: afilias, cctlds, censorship, domen, hate speech, incels.me