Child abuse becoming big problem for new gTLDs

There were 3,791 domain names used to host child sexual abuse imagery in 2017, up 57%, according to the latest annual report from the Internet Watch Foundation.
While .com was the by far the worst TLD for such material in terms of URLs, over a quarter of the domains were registered in new gTLDs.
Abuse imagery was found on 78,589 URLs on 3,791 domains in 152 TLDs, the IWF said in its report.
.com accounted for 39,937 of these URLs, a little over half of the total, with .net, .org, .ru and .co also in the top five TLDs. Together they accounted for 85% of all the abuse URLs found. The 2016 top five TLDs included .se, .io and .cc.
New gTLDs accounted for a small portion of the abuse URLs — just over 5,000, up 221% on 2016 — but a disproportionate number of domains.
The number of new gTLD domains used for abuse content was 1,063, spread over 50 new gTLDs. Equivalent numbers were not available in the 2016 report and IWF does not break down which TLDs were most-abused.
According to Verisign’s Q4 Domain Name Industry Brief (pdf), new gTLDs account for just 6.2% of all existing domain names, and yet they account for over 28% of the domains where IWF found child abuse imagery.
IWF said that the increasing number of domains registered to host abuse imagery can be linked to what it calls “disguised websites”.
These are sites “where the child sexual abuse imagery will only be revealed to someone who has followed a pre-set digital pathway — to anyone else, they will be shown legal content.”
Presumably this means that registries and registrars spot-checking domains they have under management could be unaware of their true intended use.

2 Comments Tagged: .com, child abuse material, iwf, new gTLDs

Government gives auDA reform-or-die ultimatum

auDA has just months to either implement sweeping reforms or risk being dissolved and replaced.
That’s the outcome of a review of the Australian ccTLD administrator by the Department of Communications and Arts, published today, that found the organization as it stands today is “no longer fit-for-purpose”.
Among its 29 recommendations, the government is demanding that auDA refresh its board of directors within a year and scrap its “outdated” membership structure.
Minister Mitch Fifield said in a statement:

The central finding of the review is that auDA’s current management framework is no longer fit-for-purpose and reform is necessary if the company is to perform effectively and meet the needs of Australia’s internet community.

He added in a letter to auDA chair Chris Leptos:

In the event that auDA fails to demonstrate progress in achieving the necessary reforms, I will instruct my Department to undertake a public expression of interest process in the future to identify other entities that could administer .au

A failure to reform could even lead to the government itself taking over .au, the report says.
The review did not look at the claims of lavish spending by staff and directors, reported on earlier this week.
Nor does it express any views on the controversial decision to start selling direct second-level .au domains, or to transition the back-end from Neustar to Afilias.
What it does say is that the board of directors needs to be be replaced within a year, using a new membership structure that gets rid of the current “supply” and “demand” classes of member, which differentiate between those who sell domains and those who buy them.
The current system is open to capture or “stacking”, the review says, with it being too easy for individuals to move seamlessly between classes and a lack of clarity on whether domainers should be supply or demand-class members.
Today, the 12-person board comprises the non-voting CEO, three independent directors and four directors elected by each class.
The review states that the board should not get any bigger, but that the majority of directors should be independent, selected by a new six-person Nomination Committee modeled slightly on ICANN’s Nominating Committee.
Directors should be picked on the basis on their experience and skills, limited to two three-year terms, and subject to background screening, the review states.
The government also says that auDA should either replace its current membership classes with either a single membership class open to all or a “functional constituency model” reflecting groups such as consumers, registrars, government, etc.
Fifield said he expects to see “significant” progress on implementing these reforms in the next three to six months.
In a statement, auDA said it welcomed the report and has already begun work on an implementation plan.
Former CEO Chris Disspain, who was fired by the board in 2016, after running the company for 16 years, a move that arguably catalyzed the last two years of chaos at auDA, told DI:

I am pleased that the review has called out a number of important structural issues especially the matter of membership stacking, something that I had raised with the board on a number of occasions towards the end of my tenure and that may have led, at least in part, to my departure.

1 Comment Tagged: .au, auda

Leaked memo alleges lavish travel spending at auDA

A report into .au registry auDA’s historical travel expenses has leaked to the Australian media, the latest apparent salvo in the organization’s increasingly personal civil war.
The Sydney Morning Herald this evening reports on “allegations of lavish spending and misuse of expense accounts by some former directors and employees”.
The primary individual targeted (for want of a better word) by the story is Paul Szyndler, former head of public affairs at auDA and one of the three people behind the Grumpier.com.au campaign to ouster auDA’s current CEO and chair.
It seems the Herald has managed to scoop a leaked copy of an audit compiled by PPB Advisory, which has been looking into spending practices at auDA under its previous management.
The existence of this report has been known for some time, but little about its contents had made it into the public domain beyond a slide deck (pdf) alluding to slack controls on travel expenditure.
The newspaper reports that PPB claims Szyndler racked up several thousand dollars of expenses on a family trip to Disneyland to coincide with ICANN 51 in Los Angeles in 2014.
Shortly before the Herald published (overnight in Australia), Szyndler took to an Aussie domainer forum to admit the truth of the allegation, but explain that it was fully compliant with auDA’s expenses policy at the time.
“auDA had a very clear and well understood policy at the time, whereby staff — after receiving best-available business class airfare and accommodation quotes, could spend up to, but NOT MORE THAN that figure on personal arrangements,” Szyndler wrote.
“My family joined me on a number of international trips. None cost any more than it would have cost to send me alone,” he said.
In other words, if he’d left his family at home and skipped Disneyland, he would have spent the exact same amount on a business-class flight for himself.
The Herald also says that PPB identified thousands of dollars being spent on family member travel to exotic locations, credit card cash withdrawals, expensive restaurants and even a “butler service”.
It does not say which specific staffers or directors are alleged to have spent auDA money on those things.
Indeed, Szyndler is the only person connected to specific spending in the Herald’s report.
There’s no mention of any allegations against former CEO and current ICANN vice-chair Chris Disspain — under whose watch these expenses will have been incurred — though the piece does include his blanket denial of wrongdoing.
auDA’s new chair Chris Leptos — who also sits on the PPB board — revealed last week that “several” former directors have been referred to state police over “a number of practices” upon which he did not elaborate.
Szyndler and his other Grumpier auDA members have managed to rack up enough signatures on their petition to force auDA into a special members meeting, date to be determined, that will vote on whether to get rid of Leptos, CEO Cameron Boardman and two other independent directors.
The Australian government has also been probing the organization’s antics since October, and the Herald reports that its findings could be published as soon as tomorrow (today in Australia).
Could auDA be about to get Nominetted?

6 Comments Tagged: .au, auda, expenses, ppb

dotFM offers $1.1 million stash of emoji domains

BRS Media has started selling emoji domain names in its .fm ccTLD, and some of the more commonly used ones are quite pricey.
While a vanilla emoji will go for the standard .fm price of $95.95 a year when bought from dotFM’s web site, the company has set aside about 500 domains as “premiums”.
These reserved domains start at $995 for the first year, running to $4,995, according to a published price list.
In total, dotFM is sitting on a stash of premiums worth, it reckons, over $1.1 million in the first year.
The current Unicode standard supports 2,789 emojis, so if BRS manages to sell the lot it’s looking at a not-bad $267,000 a year in renewals.
Kicking off the registration process appears to be as simple as copy-pasting an emoji into the dotFM search box, but that may not work at its partner registrars.
It’s worth noting that emoji domains are what you might call an acquired taste, mainly attractive for their novelty value and not the kind of place you’d want to run your primary web site.
They’re also basically banned by ICANN policy in the gTLD space.
.fm is the ccTLD for Micronesia which BRS has been running as an open, if niche, TLD for the radio market for the last 20 years.

7 Comments Tagged: .fm., brs media, dotfm, emojis

Bling-maker kills off fifth dot-brand gTLD

Richemont, the company behind brands such as Cartier jewelry and Mont Blanc pens, has terminated its fifth dot-brand gTLD.
It filed with ICANN to terminate its registry contract for .iwc earlier this month.
IWC is a Swiss brand of expensive watches, but its dot-brand has never been used to any notable extent.
The company had registered the domain watches.iwc, which it apparently planned to use for URL redirection via Rebrandly.
It’s the third gTLD Richemont has voluntarily terminated, after .montblanc and .chloe last year.
The company also withdrew its unopposed applications for .netaporter and .mrporter back in 2014, before it actually signed contracts with ICANN.
Richemont was one of the more prolific dot-brand applicants, applying for 14 gTLDs in total back in 2012.
It also applied for (defensively?) and won the generic .watches and some translations.
While the .watches gTLD has been live in the DNS for two and a half years, Richemont has not yet set a launch date and has not yet said who will even be eligible to buy domains there.

Comment Tagged: .iwc, .watches, dot-brands, ICANN, richemont, termination

Now GNSO mulls emergency response to GDPR deadline

ICANN’s GNSO Council is thinking about deploying a never-before-used emergency mechanism to develop a Whois privacy policy in response to GDPR.
With the May 25 deadline for compliance with the EU’s General Data Protection Regulation fast approaching, the community is scrambling to figure out how it can bring ICANN’s policies and therefore its contracts into line with the Draconian privacy provisions of the new law.
Currently, ICANN contracts with registries and registrars demand the publication of full Whois records, something GDPR will not permit, so each company in the industry is busily figuring out how its own Whois database will comply.
Fearful of a “fragmented” Whois, ICANN’s board of directors is considering deploying its own top-down emergency measure — called a Temporary Policy in its contracts — to ensure uniformity across its contracts.
CEO Goran Marby revealed to DI earlier this month that a Temporary Policy was being considered, and he and other members of the board confirmed as much to GNSO leadership during a telephone briefing last week.
(It should be noted that the call took place prior to the receipt last week of guidance from the EU Article 29 Working Party, which prompted ICANN to start mulling legal options as one way to buy the industry some time to comply post-May.)
The call (recorded here with password Eur3wiEK and summarized in this letter (pdf)), focused almost exclusively on how the Council could respond to a board-mandated Temporary Policy, with the board suggesting a GNSO Expedited Policy Development Process might be the best way to proceed.
A Temporary Policy would expire within a year, so the GNSO would have to come up with a formal Consensus Policy within that time-frame if ICANN were to have any hope of having a uniform view of Whois across its contracts.
The Temporary Policy is a “strong option” for the board, and a “highly likely or likely” outcome, but nothing has been formally decided, the GNSO leaders heard from ICANN vice-chair Chris Disspain. He was briefly challenged by Marby, who appeared somewhat more committed to the move.
While the GNSO Council has not yet formally decided to deploy the EPDP, it appears to be the most-feasible option to meet the deadline a Temporary Policy would impose.
It is estimated that an EPDP could take as little as 360 days, compared to the estimated 849 days of a regular PDP.
The EPDP cuts out several of the initial steps of a regular PDP — mainly the need for an Initial Report and associated public comment period — which by my reading would shorten the process by at least 100 days.
It also seems to give the GNSO some wriggle room in how the actual policy creation takes place. It appears that the regular “working group” structure could be replaced, for example, with a “drafting team”.
If the EPDP has the Temporary Policy and WP29 guidance as its baseline for discussions, that could also help cut out some of the circular argument that usually characterizes Whois discussions.
Aware that the EPDP is a strong possibility, the Council is currently planning to give itself a crash course in the process, which has never been used before by any iteration of the Council.
It’s uncharted territory for both the GNSO and the ICANN board, and the only people who seem to have a firm grasp on how the two emergency mechanisms slot together are the ICANN staffers who are paid to know such things.
UPDATE: A couple of hours after this article was published, ICANN posted this three-page flow-chart (pdf) comparing EPDP to PDP. Lots of luck.

Comment Tagged: epdp, gdpr, gnso, ICANN, privacy, temporary policies, whois, wp29

auDA refers former directors to police

Imploding Australian ccTLD registry auDA has ratted out “several” of its former directors to the local cops, it was revealed this week.
In a message to its community to mark Chris Leptos’ 150th day as chair of the organization, he wrote:

I am disappointed to advise you that in my first week as Independent Chair I was briefed on a number of practices of several former auDA directors. Your Board concluded that those practices warranted referral to the Victoria Police. As you would appreciate, it is not appropriate at this stage to provide further details regarding this matter.

I’m told there are 48 former auDA directors, and auDA has not said which of them have been referred to the police.
Josh Rowe, a former director who’s orchestrating a campaign to oust Leptos, auDA CEO Cameron Boardman, and two other directors, called the move a “heinous act of bullying against all 48 ex auDA directors”.
Another former director, the Aussie domain industry blogger David Goldstein, has suggested that the timing of the revelation was designed to “silence” critics including Rowe.
The Grumpier.com.au petition organized by Rowe and others has forced auDA to hold a members meeting at which the four directors’ future employment will be voted on.
auDA lawyers contacted Grumpier earlier this week to warn that any defamatory or confidential information posted on the site could lead to litigation.
But Leptos has now seemingly confirmed that the special members meeting will in fact go ahead.
Goldstein also suggested that the police referrals are related to insinuations contained within a pair of Freedom of Information Act requests filed late last year by domain consultant Ron Andruff.
In one of Andruff’s FOIA requests, he suggests that auDA may have paid legal fees of up to AUD 120,000 incurred by Rowe when he was sued almost a decade ago by a alleged domain slammer he had regularly criticized.
Rowe has called these inferences “grossly inaccurate” and “defamatory”.
In the other, which we have reported on previously, Andruff has asked for records of expenses incurred by former auDA CEO Chris Disspain, current vice-chair of ICANN.
Both FOIA requests have been denied by the Aussie government and subsequently appealed by Andruff.
Andruff is known to have beef with Disspain after he was passed over for a prominent ICANN volunteer role.
I should note for the record that, for all of the allegations swirling around, I have not seen any evidence directly connecting any individual to any wrongdoing.

Comment Tagged: .au, auda, foia, grumpier.com.au, ICANN

CoCCA to charge trademark owners for Whois access

CoCCA has become the first domain registry to publicly announce that it will charge trademark owners for access to Whois records.
The company said it plans to release an updated version of its software and registry service, containing a range of features for ensuring General Data Protection Regulation compliance, on April 20.
The public Whois records of affected TLDs will have the name, email, phone and physical address of the registrant omitted, but only if the registrant is an EU resident or uses an EU-based registrar or reseller.
There will be ways to opt-out of this, for registrants who want their information public.
The changes will come into effect first at .af, .cx, .gs, .gy, .ht, .hn, .ki, .kn, .sb, .tl, .kn, .ms and .nf, CoCCA said.
But the registry runs almost 40 gTLDs on its shared infrastructure and has almost 20 more running its software. They’re all pretty small zones, mostly ccTLDs.
CoCCA said that it will give access to private data to law enforcement and members of the Secure Domain Foundation, a DNS reputation service provider.
But trademark owners will get hit in the wallet if they want the same privileges. CoCCA said:

intellectual property owners or other entities who have a legitimate interest in redacted data will be able to order historical abstracts online for a nominal fee (provided they sign an attestation).

While the affected TLDs are probably small enough that the IP lobby won’t be overly concerned today, if CoCCA’s policy becomes more widespread in the industry — which it well could — expect an outcry.

4 Comments Tagged: cocca, gdpr, ICANN, privacy, trademarks, whois

Panic stations as Europe plays hardball on Whois privacy

Hopes that Whois records will continue to be available to broad sections of the internet community appeared dashed this week as European data protection heads ripped holes in ICANN’s plan for the industry to comply with the General Data Protection Regulation.
ICANN CEO Goran Marby warned that Whois faces imminent fragmentation and expressed disappointment that authorities have basically ignored his repeated requests for a moratorium on GDPR enforcement.
The Article 29 Working Party, made up of the heads of data protection authorities of EU member states, told ICANN this week that its so-called “Cookbook” compliance plan is nowhere near detailed enough.
In a letter (pdf), it also strongly hinted that intellectual property interests have little hope of retaining access to Whois contact information after GDPR comes into effect next month.
Any notion that WP29 might tell ICANN that the Cookbook was an over-reaction to GDPR, eschewing too many data elements from public records, was firmly put to bed.
Instead, the group explicitly supported ICANN’s plan to replace email addresses in the public Whois with anonymized addresses or a web-based registrant contact form.
It said it “welcomes the proposal to significantly reduce the types of personal data that shall be made publically [sic] available, as well as its proposal [to] introduce alternative methods to contact registrants”.
It also approved of the plan for a “layered” access plan, under which some entities — law enforcement in particular — would be able to access private contact information under an accreditation program.
But WP29 pooh-poohed the idea, put forward by some in the trademark community, that access to Whois could be restricted merely with the use of an IP address white-list.
It warned that the purposes for such access should be explicitly defined and said that what can be accessed should be tightly controlled.
WP29 does not appear to be a fan of anyone, even accredited users, getting bulk access to private Whois data.
While the group endorsed the idea that law enforcement agencies should be able to access Whois, it failed to provide similar comfort to IP interests, security researchers and other groups with self-declared “legitimate interests” in the data.
In what I’m reading as a veiled attack on the IP lobby, the WP29 letter says:

ICANN should take care in defining purposes in a manner which corresponds to its own organisational mission and mandate, which is to coordinate the stable operation of the Internet’s unique identifier systems. Purposes pursued by other interested third parties should not determine the purposes pursued by ICANN. The WP29 cautions ICANN not to conflate its own purposes with the interests of third parties, nor with the lawful grounds of processing which may be applicable in a particular case.

While it would be fairly easy to argue that giving access to security researchers contributes to “stable operation of the Internet’s unique identifier systems”, I think it would be considerably harder to argue that giving trademark owners an easy way to pursue suspected cybersquatters does the same.
In short, the letter clarifies that, rather than complying too much, ICANN has not gone far enough.
WP29 also roundly ignored ICANN’s request for an enforcement moratorium to give the community enough time to come up with a compliance policy and the industry enough time to implement it, irking ICANN into threatening legal action.
Marby said in a blog post yesterday:

Without a moratorium on enforcement, WHOIS will become fragmented and we must take steps to mitigate this issue. As such, we are studying all available remedies, including legal action in Europe to clarify our ability to continue to properly coordinate this important global information resource. We will provide more information in the coming days.

He said that the WP29 statement puts ICANN at odds with the consensus advice of its Governmental Advisory Committee — which, it should be noted, includes the European Commission and most of the EU member states.
The GAC has told ICANN to “Ensure that the proposed interim model maintains current WHOIS requirements to the fullest extent possible” and to reconsider its plan to remove registrant email addresses from public records.
That’s how stupid the situation has become — the same governments telling ICANN to retain email addresses is also telling it to remove them.
Outside of Europe, the United States government has been explicit that it wants Whois access to remain available.
Marby said that an ICANN delegation will attend a meeting of the WP29 Technology Subgroup in Brussels on April 23 to further discuss the outstanding issues.
In a quick response (pdf) to the WP29 letter, he warned that a fragmented Whois and the absence of a moratorium could spell doom for the smooth functioning of the internet.

We strongly believe that if WHOIS is fragmented, it will have a detrimental impact on the entire Internet. A key function of WHOIS allows those participating in the domain name system and in other aspects of work on the Internet to know who else is working within that system. Those working on the Internet require the information contained within WHOIS to be able to communicate with others working within that system.

Reaction from elsewhere in the community has so far comprised variations of “told you so” and hand-wringing about the impact after May 25.
Michele Neylon, head of the registrar Blacknight, blogged that the letter signaled “game over” for the public Whois.
“Come the end of May, public whois as we know it will be dead,” he wrote.
Academic Farzaneh Badii, executive director of the Internet Governance Project and a leading figure in ICANN’s non-commercial users community, blamed several factors for the current 11th-hour predicament, but mainly the fact that her constituency’s lobbying was ignored for so long.
“The Noncommercial Stakeholders Group was the broken record that everyone perceived as not worth paying attention to. But GDPR got real and ICANN has to deal with it,” she wrote.
Matt Serlin of the IP-centric registrar Brandsight, wrote that the letter was “predictable” and said:

The WHOIS system, as it has been known for two decades, will cease to exist. Unfettered access to registration information for gTLDs is simply not going to be possible going forward after May 25th. Yes, there are still questions as to what the final model ICANN puts forth will be, but it will certainly drastically change how WHOIS will function.

Serlin held out some hope that the unspecified legal action Marby has floated may go some way to extend the May 25 GDPR enforcement date.
The community awaits Marby’s next update with bated breath.

6 Comments Tagged: .eu, article 29 working party, gdpr, ICANN, privacy, whois, wp29

101domain founder Wolfgang Reile dies at 67

Wolfgang Reile, founder and former CEO of the registrar 101domain, has died, according to his former business partner and other sources.
He died unexpectedly at 67, April 6, according to Anthony Beltran, who took over the management of 101domain from Reile when Afilias acquired it back in 2015.
Born in Munich, Reile migrated to the US in the early 1990s and founded the registrar in 1999, Beltran said. He told DI:

He was a regular fixture in the ICANN scene, was a fun guy to be around, and was a natural storyteller (once you got used to the authentic German accent)
He was a friend and mentor to many, especially the staff at 101domain, and if you knew him and his straight-forward German fashion — was very opinionated, passionate, and yelling at you only meant he considered you a friend. He brought a passionate and dedicated energy that’s rare these days.

His international business background, including a spell at Disney in Asia, inspired 101domain’s strategy of providing access to the broadest possible range of ccTLDs and gTLDs, Beltran said.
The company currently has close to 140,000 gTLD domains under management and says it has tens of thousands of clients.
After the two men sold 101domain to Afilias, Reile stepped away from the industry to focus on family, travel and other businesses, Beltran said.
He is survived by his wife and three daughters. I gather his funeral will be held in San Diego, California, later today.

5 Comments Tagged: 101domain, afilias, wolfgang reile