Digital archery ruled out for next new gTLD round

The oft-mocked “digital archery” system will not be making a return when ICANN finally starts taking more new gTLD applications.
That’s the current thinking of the ICANN community working group looking at subsequent application procedures.
Readers with long memories may recall digital archery as a hack for Californian gambling laws that ICANN org pressed for in 2012 as a way to form its 1,930 applications into an orderly queue for processing.
The idea was that applicants would fire off a bit of data to an ICANN site at a predetermined time and the applicants whose packets arrived closet to the target time, measured by the millisecond, would receive priority in the queue.
It was a bit like drop-catching, and the concept advanced to the stage where companies skilled in such things were offering digital archery services.
But after ICANN changed CEOs later that year, it turned out gambling wasn’t as illegal in California as former management thought it was. The org got itself a license to run a one-off lottery and sold tickets for $100 per application.
That’s now the preferred method for ordering the queue for the next rounds of applications, whenever those may be, according to last week’s Initial Report on the New gTLD Subsequent Procedures Policy Development Process.
Unlike 2012, the WG is proposing that portfolio applicants should be able to swap around their priority numbers according to their commercial interests.
So, if Donuts gets priority #1 for .crappy and #4,000 for .awesome, it would be able to switch priorities to get the better string evaluated earlier.
The WG is also not convinced that internationalized domain names, which received automatic priority in 2012, should get the same preferential treatment this time around.
That’s one of several questions it poses for the community in its public comment period.
While a better place in the evaluation queue had time-to-market advantages in 2012 — Donuts’ .guru sold a tonne of domains largely due to its first-mover status — that’s probably not going to be as big a deal next time around due to domainer skepticism about new gTLDs.

Comment Tagged: ICANN, new gTLDs, prioritization, subsequent procedures, the draw

Could crypto solve the Whois crisis?

Could there be a cryptographic solution to some of the problems caused by GDPR’s impact on public Whois databases? Security experts think so.
The Anti-Phishing Working Group has proposed that hashing personal information and publishing it could help security researchers carry on using Whois to finger abusive domain names.
In a letter to ICANN, APWG recently said that such a system would allow registries and registrars to keep their customers’ data private, but would still enable researchers to identify names registered in bulk by spammers and the like.
“Redacting all registration records which were formerly publicly available has unintended and undesirable consequences to the very citizens and residents that electronic privacy legislation intends to protect,” the letter (pdf) says.
Under the proposed system, each registry or registrar would generate a private key for itself. For each Whois field containing private data, the data would be added to the key and hashed using a standard algorithm such as SHA-512.
For items such as physical addresses, all the address-related fields would be concatenated, with the key, before hashing the combined value.
The resulting hash — a long string of gibberish characters — would then be published in the public Whois instead of the [REDACTED] notice mandated by current ICANN policy.
Security researchers would then be able to identify domains belonging to the same purported registrant by searching for domains containing the same hash values.
It’s not a perfect solution. Because each registry or registrar would have their own key, the same registrant would have different hash values in different TLDs, so it would not be possible to search across TLDs.
But that may not be a huge problem, given that bad guys tend to bulk-register names in TLDs that have special offers on.
The hashing system may also be beneficial to interest groups such as trademark owners and law enforcement, which also look for registration patterns when tracking down abuse registrants.
The proposal would create implementation headaches for registries and registrars — which would actually have to build the crypto into their systems — and compliance challenges for ICANN.
The paper notes that ICANN would have to monitor its contracted parties — not all of which may necessarily be unfriendly to spammers — to make sure they’re hashing the data correctly.

9 Comments Tagged: abuse, apwg, crypto, gdpr, malware, phishing, privacy, spam, whois

Euro-Whois advice still as clear as mud

European privacy chiefs have again weighed in to the ongoing debate about GDPR and Whois, offering another thin batch of vague advice to ICANN.
The European Data Protection Board, in its latest missive (pdf), fails to provide much of the granular “clarity” ICANN has been looking for, in my view.
It does offer a few pieces of specific guidance, but it seems to me that the general gist of the letter from EDPB chair Andrea Jelinek to ICANN CEO Goran Marby is basically: “You’re on your own buddy.”
If the question ICANN asked was “How can we comply with GDPR?” the answer, again, appears to be generally: “By complying with GDPR.”
To make matters worse, Jelinek signs off with a note implying that the EDPB now thinks that it has given ICANN all the advice it needs to run off and create a GDPR-compliant accreditation system for legitimate access to private Whois data.
The EDPB is the body that replaced the Article 29 Working Party after GDPR came into effect in May. It’s made up of the data protection authorities of all the EU member states.
On the accreditation discussion — which aims to give the likes of trademark owners and security researchers access to Whois data — the clearest piece of advice in the letter is arguably:

the personal data processed in the context of WHOIS can be made available to third parties who have a legitimate interest in having access to the data, provided that appropriate safeguards are in place to ensure that the disclosure is proportionate and limited to that which is necessary and the other requirements of GDPR are met, including the provision of clear information to data subjects.

That’s a fairly straightforward statement that ICANN is fine to go ahead with the creation of an accreditation model for third parties, just as long as it’s quite tightly regulated.
But like so much of its advice, it contains an unhelpful nested reference to GDPR compliance.
The letter goes on to say that logging Whois queries should be part of these controls, but that care should be taken not to tip off registrants being investigated by law enforcement.
But it makes no effort to answer Marby’s questions (pdf) about who these legit third-parties might be and how ICANN might go about identifying them, which is probably the most important outstanding issue right now.
Jelinek also addresses ICANN’s lawsuit against Tucows’ German subsidiary EPAG, and I have to disagree with interpretations of its position published elsewhere.
The Register’s Kieren McCarthy, my Chuckle Brother from another Chuckle Mother, reckons the EDPB has torpedoed the lawsuit by “stating clearly that it cannot force people to provide additional ‘admin’ and ‘technical’ contacts for a given domain name”.
Under my reading, what it actually states is that registrants should be able to either use their own contact data, or anonymized contact information identifying a third party, in these records.
The EDPB clearly anticipates that admin and technical contacts can continue to exist, as long as they contain non-personal contact information such as “admin@example.com”, rather than “kevin@example.com”.
That’s considerably more in line with ICANN’s position than that of Tucows, which wants to stop collecting that data altogether.
One area where EDPB does in fact shoot down ICANN’s new Whois policy is when it comes to data retention.
The current ICANN contracts make registrars retain data for two years, but the EDPB notes that ICANN does not explain why or where that number comes from (I hear it was “pulled out of somebody’s ass”).
The EDPB says that ICANN needs to “re-evaluate the proposed data retention period of two years and to explicitly justify and document why it is necessary”.
Finally, the EDPB weighs in on the issue of Whois records for “legal persons” (as opposed to “natural persons”). It turns out their Whois records are not immune to GDPR either.
If a company lists John Smith and john.smith@example.com in its Whois records, that’s personal data on Mr Smith and therefore falls under GDPR, the letter says.
That should provide a strong incentive for registries and registrars to stop publishing potentially personal fields, if they’re still doing so.

5 Comments Tagged: edpb, epag, european data protection board, gdpr, ICANN, privacy, tucows, whois, wp29

New gTLD fees could be kept artificially high

More windfalls for ICANN? It’s possible that application fees for new gTLDs could be artificially propped up in order to discourage gaming.
In the newly published draft policy recommendations for the next new gTLD round, ICANN volunteers expressed support for keeping fees high “to deter speculation, warehousing of
TLDs, and mitigating against the use of TLDs for abusive or malicious purposes”.
It’s one of the ideas posed in the the Initial Report on the New gTLD Subsequent Procedures Policy Development Process, published this week.
It recommends that ICANN continues to price its application fees on a revenue-neutral basis, but with one big exception.
The report notes that there’s support for an “application fee floor” — a minimum fee threshold that would not be crossed no matter how cheap application processing actually becomes:

there might be a case where a revenue neutral approach results in a fee that is “too low,” which could result in an excessive amount of applications (e.g., making warehousing, squatting, or otherwise potentially frivolous applications much easier to submit), reduce the sense of responsibility and value in managing a distinct and unique piece of the Internet, and diminish the seriousness of the commitment to owning a TLD.

The subgroup looking at fees was “generally supportive” of the notion of a floor, the report says.
If the fee floor were used, excess funds would have to be pumped into efforts such as “universal acceptance”, the ongoing outreach project that hopes to persuade developers to ensure their software supports all TLDs.
It could also be used to support applications from the poorer regions of the world.
I wonder how much of a deterrent to warehousing an artificially high application fee would be; deep-pocketed Google and Amazon appear to have warehoused dozens of TLDs they applied for in the 2012 round.
The application fee in 2012 was $185,000 per string, priced on a “cost recovery” basis. The idea was that ICANN shouldn’t use the fees to subsidize its regular operations and vice versa.
But with roughly one third of that amount earmarked for unexpected contingencies — basically a legal defense fund — ICANN currently has close to $100 million in unspent fees sitting idle in a dedicated bank account.
The Initial Report also discusses whether application fees should be varied based on application type, as well as posing dozens of other questions for the community on the rules for the next round of new gTLDs.
Comment here.

1 Comment Tagged: fees, ICANN, new gTLDs

First-come, first-served for new gTLDs? Have your say

Should new gTLDs be allocated on a first-come, first-served basis? That’s a possibility that has not yet been ruled out by the ICANN community.
The ICANN working group currently writing policy for the next round of gTLD applications has published its first draft for public comment, and FCFS is one option still on the table.
The Initial Report on the New gTLD Subsequent Procedures Policy Development Process outlines six possible paths for the new gTLD program, and the group wants to hear your feedback.
The six options presented range from a 2012-style one-off application round, followed again by a potentially interminable series of reviews, to full-on FCFS from day one.
With neither of those extremes particularly appealing, the working group seems to be erring towards one of the four other choices.
ICANN could, for example, announce two or three more rounds, with firm dates for each perhaps separated by a year or two, followed by a long breather period.
Or it could kick of an endless series of application periods, perhaps happening at the same time every year.
Or it could conduct one or more rounds before implementing full FCFS.
The report lists many of the pros and cons of these various options.
For example, FCFS could lead to scrappy applications, gTLD warehousing, capture by ICANN insiders, and disadvantages to community applicants, but it could also reduce the cost of acquiring a gTLD by eliminating expensive auction-based contention resolution.
Conversely, the round-based structure could cause scaling problems for ICANN, could face unanticipated delays, and may not be responsive to applicants’ business needs, the report says.
The working group could not reach consensus on which model should be used, but it noted that there was no appetite for either immediate FCFS or another 2012-style effort. Its report states:

The Working Group recommends that the next introduction of new gTLDs shall be in the form of a “round.” With respect to subsequent introductions of the new gTLDs, although the Working Group does not have any consensus on a specific proposal, it does generally believe that it should be known prior to the launch of the next round either (a) the date in which the next introduction of new gTLDs will take place or (b) the specific set of criteria and/or events that must occur prior to the opening up of the subsequent process. For the purposes of providing an example, prior to the launch of the next round of new gTLDs, ICANN could state something like, “The subsequent introduction of new gTLDs after this round will occur on January 1, 2023 or nine months following the date in which 50% of the applications from the last round have completed Initial Evaluation.”

The question of how to balance rounds and, potentially, FCFS, is one of many, many questions posed in the 310-page initial report. You can comment here.
Expect more coverage of this monster from DI shortly.

Comment Tagged: fcfs, ICANN, new gTLDs

Fight breaks out as Afilias eats Neustar’s Aussie baby

The transition of .au to Afilias’ registry platform over the weekend seems to have gone quite smoothly, but that hasn’t stopped Neustar and a former key executive from lashing back at what it says are the gaining company’s “misinformed” statements.
The war of words, which has got quite nasty, came as Afilias transferred all 3.1 million .au domains to its control, after 16 years with the former incumbent.
Neustar, which hadn’t said much about losing one of its most-lucrative TLD contracts, on Friday published a lengthy blog post in which it said it wanted to “set the record straight” about Afilias’ statements leading up to the switch.
Afilias, in a series of blog posts and press releases since it won the .au contract, has been bigging up its technical capabilities.
While it’s not directly criticized Neustar and predecessor AusRegistry (which Neustar acquired for $87 million), the implication of many of these statements is that Neustar was, by comparison, a bit shit.
In Neustar’s latest post, Aussie VP George Pongas takes issue with several of these claims.
Any implications that the company did not offer 24/7 registrar support were incorrect, he wrote. Likewise, the idea that it did not have a DNS node in Western Australia was not true, he wrote.
He also took issue with claims that Afilias would offer improved security and a broader feature set for registrars, writing:

We’ve raised a number of concerns directly with auDA about what we considered to be inaccurate remarks comparing Neustar’s systems with the new Registry and implying that the new Registry will include “all previous functionality plus enhanced security and authentication measures”, as stated in recent auDA Member communications. We questioned auDA about this and were informed that the statement is comparing the various testing phases of Afilias’ Registry – so the latest version has “all previous functionality” of the earlier versions. It doesn’t mean the Registry will have “all previous functionality” of Neustar’s platform – which we believe the statement implies. It is a fact that a number of the proprietary features and services that Neustar currently provides to Registrars will no longer be available under the new Registry system, and thus Registrars will likely notice a difference.

“We stand by our statements,” an Afilias spokesperson told DI today.
While Neustar’s corporate stance was fairly reserved, former AusRegistry boss Adrian Kinderis, never a shrinking violet, has been reacting in an almost presidential fashion, using Twitter to describe auDA CEO Cameron Boardman as “incompetent”, criticizing a reporter, and using the hashtag #crookedcameron.

#crookedcameron actually asked me to come work for @auda so I would be silent on all the bullshit he is peddling thinking I could be #paidoff. Happy to tell you all I gave him a polite #gofuckyourself does the @auda Board know he offered me the gig?

— Adrian Kinderis (@AdrianKinderis) July 1, 2018

Kinderis, who headed up AusRegistry for the whole of its 16-year run with .au, left Neustar in April, three years after the acquisition. He’s now running something called MadBarry Enterprises and is still associated with the new gTLD .film.
He reckons Neustar lost the .au contract purely for financial reasons.
While Neustar is believed to have lowered its registry fee expectations when pitching to continue as the back end, auDA will save itself about AUD 9 million a year ($7 million) under Afilias, compared to the old regime.
auDA is not expected to hand this saving on to registrars and registrants, though I hear registrars have been offered marketing rebates recently.
auDA has previously told us that Afilias scored highest on the technical evaluation of the nine bidders, and that it was not the bidder with the lowest fee.
Kinderis is also of the opinion that Afilias is among those helping auDA stack its membership with compliant stooges.
Last month, auDA announced a dramatic four-fold increase in its membership — getting 955 new membership applications in just a month.
auDA thanked Afilias for this growth in membership, alongside three of the largest .au registrars: Ventra IP, Arq Group (formerly Melbourne IT), and CrazyDomains owner Dreamscape Networks.
An Afilias spokesperson said that the company had offered its staff the option to become auDA members and about half — I estimate at roughly 150 people based on Afilias’ previously published headcounts — had taken it up on the offer.
It sounds rather like Afilias footed the AUD 22 per-person “Demand-class” membership application fees.
The rapid increase in membership at auDA has raised eyebrows in the .au community, with some accusing the registry of “branch stacking”.
That’s an Australian term used to describe the practice of signing up large numbers of members of a local branch of a political party in order to swing important votes.
The 955-plus new members will not be approved in time to influence the outcome of the vote to oust the auDA chair and others later this month.
But they will have voting rights by the time auDA’s annual general meeting comes around later this year. The AGM is when auDA will attempt to reform itself in light of a harsh government review of its practices.
As for the migration to Afilias itself, it seems to have gone relatively smoothly. I’m not aware of any reports of any serious technical issues, despite the fact that it was the largest TLD migration ever.
Some members have pointed out that most of .au’s ops are now off-shore, and old auDA Whois service is now hosted on a .ltd domain (hey, somebody’s got to use it) which is itself protected by Whois privacy.
I also noticed that the auDA web site, which used to have a hook into the registry that published an updated domain count every day, is no longer working.

11 Comments Tagged: .au, afilias, auda, ausregistry, migration, neustar, transition

.kids gTLD auction probably back on

Amazon, Google and a small non-profit appear to be headed to auction to fight for ownership of child-friendly new gTLDs.
ICANN last week defrosted the contention set for .kids/.kid; DotKids Foundation’s bid for .kids is no longer classified as “On-Hold”.
This means an ICANN-managed “last resort” auction is probably back on, having been cancelled last December in response to a DotKids request for reconsideration.
The RfR was thrown out by the ICANN board of directors, on the recommendation of its Board Accountability Mechanisms Committee, in May.
.kids and .kid are in the same contention set because DotKids fought and won a String Confusion Objection against Google’s .kid application.
It’s also directly competing with Amazon for .kids.
A last-resort auction would mean that proceeds would be deposited in a special ICANN bank account currently swollen with something like a quarter-billion dollars.

2 Comments Tagged: .kid, .kids, amazon, auction, google, ICANN, new gTLDs

Archaeologists protest “televangelist” .bible gTLD

The head of the Biblical Archaeology Society has harshly criticized .bible and ICANN for the gTLD’s restrictive registration policies.
Writing in the latest issue of its Biblical Archaeology Review, Robert Cargill said .bible is on its way to becoming “the internet’s equivalent of televangelism.”
The gTLD is operated by the American Bible Society, best known for its “Good News” translation of the book.
Under its rules, registrants can’t use a .bible domain to “encourage or contribute to disrespect for the Bible or the Bible community”, with ABS determining what constitutes disrespect.
Cargill writes that his own publication could be at risk of losing its hypothetical .bible domain for publishing fact-based articles about Biblical history.
Cargill writes:

No one “owns” the Bible, and no one should have to submit to the American Bible Society’s ill-conceived holiness code in order to register a .BIBLE domain name. ABS should not be able to deny a .BIBLE domain name because it feels a website does not revere the name of God enough—or because it dares not endorse “orthodox Christianity.” How ICANN ever allowed this is beyond belief!

He’s also pissed that archaeology.bible is a premium domain with a retail price of close to six grand for the first year.
He’s not the first scholarly, secular voice to air concerns about .bible policy.
In March, the head of the Society of Biblical Literature was also critical of what he described as ABS’s “bait and switch” gTLD application.
The registry earlier this year revised its original policy to permit Jewish people to register names, after complaints from the Anti-Defamation League, among others.

3 Comments Tagged: .bible, abs, american bible society, biblical archaeology society, ICANN, new gTLDs

.co first ccTLD to get China approval

Repurposed Colombian ccTLD .co has obtained official government approval to operate in China, according to a consultant whose client worked on the project.
Pinky Brand blogged this week that .co is the “first” foreign ccTLD to get the nod, among the raft of gTLDs that have gone down the same route over the last couple of years.
China’s own .cn and Chinese-script equivalents are of course already approved.
Under China’s policy regime, administered by the Ministry of Industry and Information Technology, TLD registries have to set up a local presence and agree to Draconian takedown policies.
Non-approved TLDs are not permitted to have resolving domains, under the rules.
Most companies seeking Chinese approval tend to use a local proxy provider such as ZDNS, which seems to be the route taken by .co here.
.co is managed by Neustar via its Colombian subsidiary .CO Internet.

5 Comments Tagged: .co, china, miit, neustar, zdns

All Cyrillic .eu domains to be deleted

Eurid has announced that Cyrillic domain names in .eu will be deleted a year from now.
The registry said that it’s doing so to comply with the “no script mixing” recommendations for internationalized domain names, which are designed to limit the risk of homograph phishing attacks.
The deletions will kick in May 31, 2019, and only apply to names that have Cyrillic before the dot and Latin .eu after.
Cyrillic names in Eurid’s Cyrillic ccTLD .ею will not be affected.
The plan has been in place since Eurid adopted the IDNA2008 standard three years ago, but evidently not all registrants have dropped their affected names yet.
Bulgaria is the only EU member state to use Cyrillic in its national language.

Comment Tagged: .eu, .ею, cctlds, cyrillic, eurid, idns