ICANN confirms GoDaddy Whois probe

ICANN is looking into claims that GoDaddy is in breach of its registrar accreditation contract.
The organization last week told IP lawyer Brian Winterfeldt that his complaint about the market-leading registrar throttling and censoring Whois queries over port 43 is being looked at by its compliance department.
The brief note (pdf) says that Compliance is “in receipt of the correspondence and will address it under its process”.
Winterfeldt is annoyed that GoDaddy has starting removing contact information from its port 43 Whois responses, in what the company says is an anti-spam measure.
It’s also started throttling port 43 queries, causing no end of problems at companies such as DomainTools.
Winterfeldt wrote last month “nothing in their contract permits GoDaddy to mask data elements, and evidence of illegality must be obtained before GoDaddy is permitted to throttle or deny port 43 Whois access to any particular IP address”.
It’s worth saying that ICANN is not giving any formal credibility to the complaint merely by looking into it.
But while it’s usual for ICANN to publish its responses to correspondence it has received and published, it’s rather less common for it to disclose the existence of a compliance investigation before it has progressed to a formal breach notice.
It could all turn out to be moot anyway, given the damage GDPR is likely to do to Whois across the industry in a matter of weeks.

10 Comments Tagged: compliance, godaddy, ICANN, port 43, raa, throttling, whois, winterfeldt

Grumpier Aussies call for more blood on the auDA boardroom floor

A group of pissed-off members of the Australian domain name industry are calling for the heads of auDA’s CEO, its new chair, and two other members of its board.
A triumvirate of long-time participants in the auDA community say they have secured enough signatures on a petition to force the organization to call the meeting under Aussie law.
They want a vote of no confidence in the CEO, Cameron Boardman, and the firing of all three “independent” directors: Chris Leptos (also chair), Sandra Hook and Suzanne Ewart.
Their list of beefs is long, but high on it is auDA’s plan to open up .au to direct, second-level registrations for the first time, enabling folk to register example.au instead of example.com.au.
If this all sounds worryingly familiar, it’s because it’s the second year in a row members have called a special meeting in order to oust its top brass.
A campaign orchestrated at Grumpy.com.au last year resulted in chair Stuart Benjamin quitting ahead of a member vote to fire him.
This year’s campaign is being coordinated, with a nod and a wink but none of Grumpy’s original leaders, at Grumpier.com.au.
Entrepreneur Josh Rowe appears to have held the pen on the petition, backed up by former head of auDA public affairs Paul Szyndler and businessman Jim Stewart.
As well as the direct registration issue, which the three men think is merely a cash-grab with no benefits for registrants, the petitioners have some harsh things to say about auDA’s governance and transparency.
The organization has promised to be more open in the wake of last year’s carnage, but Grumpier thinks “things have only got worse”.
The petition also alludes to rumors of “whispering campaigns” against former staff and “possible financial irregularities”.
Rowe recently complained on his blog about a freedom of information request related to his own conduct, filed by the same person pursing form auDA CEO (and current ICANN vice chair) Chris Disspain with FOIA requests.
They also unhappy that auDA is switching .au’s registry service provider from Neustar to Afilias, gaining a rumored 60% discount of which only 10% will be passed on to registrars.
It’s all getting rather nasty, and I’ve not even mentioned some of the rumors of shenanigans that I seem to find in my inbox on an almost daily basis.
To force a special member meeting under Australian law, Grumpier says it had to secure signatures of 5% of the members, which it says it has done.
That’s not much of a threshold, given that auDA only has about 320 members at the moment.
Assuming auDA agrees that it has to hold a meeting, it has a couple of months to do so.

Comment Tagged: .au, auda, direct, grumpier.com.au, grumpy.com.au, second-level

Afilias scraps plan to scrap Whois

Afilias has “temporarily suspended” its plan to migrate its TLDs to an essentially thin Whois model.
In what appears to be an effort to roll back some GDPR-related gun-jumping, the registry said it will instead wait and see how ICANN’s efforts to consult with European data protection authorities play out.
Afilias had told its registrars earlier this week that its public Whois output from May 25 will be devoid of any contact information for the registrant, as reported by DNW.
It had said that it would continue to work with law enforcement on access to Whois records, but said that others (such as trademark owners) would not have access until ICANN comes up with an accreditation program.
It was the first major gTLD registry to announce its GDPR plans, but it evidently received push-back.
The affected TLDs were to be: .info, .mobi, .pro, .poker, .pink, .black, .red, .blue, .kim, .shiksha, .promo, .lgbt, .ski, .bio, .green, .lotto, .pet, .bet, .vote, .voto, .archi, .organic and .llc.
Many more client gTLDs would have been able to opt-in to the same scaled-back system.
But the company told registrars today that it wanted to correct “mis-characterizations” of that message and wanted to “clarify that Afilias is not ‘going it alone'”.
Rather, it’s going to hang back until ICANN gets guidance from the EU’s DPAs.
“Importantly, we expect that ICANN’s request for guidance from the data protection authorities will yield helpful input that, in conjunction with the best thinking of the community, will enable a workable solution to emerge,” the Afilias message said.
The company said in a statement sent to DI tonight:

Afilias today announced that it is temporarily suspending plans to limit the display of WHOIS data to comply with the EU General Data Protection Regulation (GDPR) currently scheduled to take effect on 25MAY2018. Afilias has received a number of questions about its plans, and anticipates that they may be affected by guidance from data protection authorities that has been requested by ICANN. This guidance is expected to be materially helpful in the community’s efforts to resolve the various issues surrounding GDPR requirements.
Afilias is participating in a number of community groups that are considering these issues, including as a principal in ICANN’s pilot implementation of the Registration Data Access Protocol (RDAP), a potential technical solution for enabling differentiated access to registration data depending on the legitimate purpose of the requestor. For example, law enforcement may need access to certain types of Personally Identifiable Information (PII), trademark guardians to other types, etc. RDAP enables the management of this access in an efficient and effective manner.
As the deadline for GDPR implementation approaches, the community is working diligently in a number of areas to find solutions needed to balance a wide range of community interests. Afilias will continue working collaboratively within these groups in the expectation that appropriate solutions will be reached prior to the GDPR implementation date. Absent guidance from the data protection authorities, Afilias will reconsider its plans as appropriate to ensure compliance with GDPR.

It’s still very possible that Afilias, and other gTLD registries and registrars, could end up gutting Whois in much the same way come May 25 anyway, but for now at least it seems Afilias it willing to play wait-and-see.
As a reminder, there’s going to be an ICANN-supported conference call tomorrow on an Intellectual Property Constituency proposal for a post-GDPR Whois accreditation model.

1 Comment Tagged: afilias, gdpr, ICANN, privacy, whois

auDA role “could have killed me” says resigning domainer

Domainer and activist blogger Ned O’Meara has resigned from the auDA board of directors, about four months after being elected.
He said in an apologetic blog post that the “negative stress” caused by being on the .au registry’s board had sent his blood pressure up, making him worry about having a third heart attack.
“[I]f I continued slugging it out at auDA, I believe it could have killed me,” he wrote.
He went on to say that he expected to be sidelined on key votes such as auDA’s decision to sell domains directly at the second level, due to perceived “conflicts of interest”, which he disputed.
O’Meara was elected in November as a “demand-class” member of the board, after using his blog to spearhead a campaign for greater transparency at the organization.
It sounds to me like he’s made the correct decision in stepping aside. No matter how important you believe a domain policy to be, it’s not worth your health. I wish him well.
auDA said it is now looking for two demand-class directors, to fill O’Meara’s vacant seat and another seat that is opening up due to the end of another director’s term.

2 Comments Tagged: .au, auda

Whois policy group closes down in face of GDPR

An ICANN working group devoted to crafting Whois policy has closed down “until further notice” in light of the EU General Data Protection Regulation.
The Registration Data Service Policy Development Process Working Group will have no more meetings until it receives “guidance from the [ICANN] Board regarding how this WG will be affected by the GDPR compliance efforts”.
That’s according to WG co-chair Chuck Gomes, in an email to the group this morning. The mailing list will remain active to keep members informed of progress, he said.
The group has been tasked with developing “comprehensive Whois reform”.
It’s been working for over two years to attempt to find consensus on changes such as tiered access and data privacy, the latest iteration of fruitless, fractious Whois policy discussions dating back a couple of decades, and had made very little progress.
Recently, it’s also been hit by infighting and, in my opinion, a sense of helplessness in the face of GDPR, the EU privacy law that will take precedence over any policy ICANN comes up with.
Last month, prominent Non-Commercial Stakeholder Group member Stephanie Perrin publicly resigned from the WG, saying it was “fundamentally flawed” and complaining the process was an “antique” that wasn’t sufficiently taking GDPR into account.
As DI has been reporting for the last several months, there’s very little clarity right now about how GDPR will effect ICANN’s Whois policy.
ICANN CEO Goran Marby told us yesterday that he’s “cautiously optimistic” that EU data protection authorities will soon provide some firm guidance on what it means to be GDPR-compliant.
It appears that the RDS group’s fate may also lie in the hands of the DPAs, for now.

1 Comment Tagged: gdpr, ICANN, privacy, rds, whois

Marby ponders emergency powers to avoid fragmented Whois

ICANN could invoke emergency powers in its contracts to prevent Whois becoming “fragmented” after EU privacy laws kick in next month.
That’s a possibility that emerged during a DI interview with ICANN CEO Goran Marby yesterday.
Marby told us that he’s “cautiously optimistic” that European data protection authorities will soon provide clear guidance that will help the domain industry become compliant with the General Data Protection Regulation, which becomes fully effective May 25.
But he said that a lack of such guidance will lead to a situation where different companies provide different levels of public Whois.
“It’s a a high probability that Whois goes fragmented or that Whois will be in a sort of ‘thin’ model in which very little information is collected and very little information is displayed,” he said. “That’s a sort of worst-case scenario.”
I should note that the interview was conducted yesterday before news broke that Afilias has become the first major gTLD registry to announce its Whois output will be essentially thin — eschewing all registrant contact data — from May 25.
Marby has asked European DPAs for two things.
First, guidance on whether its “Cookbook” proposal for a dramatically scaled-back, GDPR-compliant Whois is in fact GDPR-compliant.
Second, an enforcement moratorium while registries and registrars actually go about implementing the Cookbook.
“If we don’t get guidance that’s clear enough, we will see a fragmented Whois. If we get guidance that is clear enough we can work it out,” Marby said.
A moratorium could enable Whois to carry on in its current state, or something close to it, while ICANN goes about creating a new policy that fits with the DPA’s guidance.
If the DPAs refuse a moratorium, we’re looking at a black hole of indeterminate duration during which nobody — not even law enforcement or self-appointed trademark cops — can easily access full Whois records.
“It’s not something I can do anything about, it’s really in the hands of the DPAs,” Marby said. “Remember that it’s the law.”
While ICANN has expended most of its effort to date on creating a model for the public Whois, there’s a parallel effort to create an accreditation program that would enable organizations with “legitimate purposes” to access full, or at least more complete, Whois records.
It’s the IP lawyers that are driving this effort, primarily, terrified that their ability to hunt down cybersquatters and bootleggers will be diminished come May 25.
ICANN has so far resisted calls to endorse the so-called “Cannoli” draft accreditation model, with Marby publicly saying that it needs cross-community support.
But the organization has committed staff support resources to discussion of Cannoli. There’s a new mailing list and there will be a community conference call this coming Friday at 1400 UTC.
Marby said that he shares the worries of the IP community, adding: “If we get the proper guidance from the DPAs, we will know how to sort out the accreditation model.”
He met with the Article 29 Working Party, comprised of DPAs, last week; the group agreed to put Whois on its agenda for its meeting next week, April 10-11.
The fact that it’s up for discussion is what gives Marby his cautious optimism that he will get the guidance he needs.
Assuming the DPAs deliver, ICANN is then in the predicament of having to figure out a way to enforce, via its contracts, a Whois system that is compliant with the DPAs’ interpretation of GDPR.
Usually, this would require a GNSO Policy Development Process leading to a binding Consensus Policy.
But Marby said ICANN’s board of directors has other options, such as what he called an “emergency policy”.
This is a reference, I believe, to the “Temporary Policies” clauses, which can be found in the Registrar Accreditation Agreement and Registry Agreement.
Such policies can be mandated by a super-majority vote of the board, would have to be narrowly tailored to solve the specific problem at hand, and could be in effect no longer than one year.
A temporary policy could be replaced by a compatible, community-created Consensus Policy.
It’s possible that a temporary policy could, for example, force Afilias and others to reverse their plans to switch to thin Whois.
But that’s perhaps getting ahead of ourselves.
Fact is, the advice the DPAs provide following their Article 29 meeting next week is what’s going to define Whois for the foreseeable future.
If the guidance is clear, the ICANN organization and community will have their direction of travel mapped out for them.
If it’s vague, wishy-washy, and non-committal, then it’s likely that only the European Court of Justice will be able to provide clarity. And that would take many years.
And whatever the DPAs say, Marby says it is “highly improbable” that Whois will continue to exist in its current form.
“The GDPR will have an effect on the Whois system. Not everybody will get access to the Whois system. Not everybody will have as easy access as before,” he said.
“That’s not a bug, that’s a feature of the legislation,” he said. “That’s not ICANN’s fault, it’s what the legislator thought when it made this legislation. It is the legislators’ intention to make sure people’s data is handled in a different way going forward, so it will have an effect.”
The community awaits the DPAs’ guidance with baited breath.

17 Comments Tagged: afilias, article 29 working party, dpas, gdpr, ICANN, privacy, whois

ICANN heads to Mar-a-Lago for budget crisis talks

Cash-strapped ICANN has invited select community members to emergency budget talks at the Mar-a-Lago resort in Florida, DI has learned.
The three-day summit next week will address how best to spend the organization’s $138 million annual budget, along with its $236 million auction proceeds war chest and its $80 million of leftover new gTLD application fees.
“Recent public comments have made it clear than many valued ICANN community members have misunderstood our FY19 budget,” CEO Goran Marby said. “I believe a long weekend of intensive discussions at Mar-a-Lago should persuade the community that we’re actually on the right track.”
To encourage participation from an increasingly weary volunteer pool, attendees will be treated to complimentary spa treatments, golfing, and the most beautiful pieces of chocolate cake, he said.
DI has managed to obtain a preliminary agenda for the summit, which can be read here (pdf).
Business-class flights and three nights’ accommodation at the exclusive members club will be covered by ICANN.
Mar-a-Lago, purchased by Donald Trump in the 1980s, is a “six-star” resort in Palm Beach, Florida. It was originally a five-star hotel, until 2004 when Trump purchased the one-star hotel next door and knocked through.
Marby defended the choice of venue, pointing out that the guest list is to be strictly limited to the ICANN board of directors, industry CEOs, and members of the Intellectual Property Constituency.
DI understands that the IPC will be permitted to invite members of the Non-Commercial Stakeholder Group to attend, should they require golf caddies.
To ensure gender diversity, all attendees will be able to bring along their spouses or partners. ICANN will make up any shortfall by hiring decorative females from a pool of Trump litigants.
A small support team of 50 ICANN staffers will also be available to hand out fresh towels, collect empty glasses, and so on.
Remote participation will be available via AOL Instant Messenger.
Chief financial officer Xavier Calvez declined to disclose the cost of the summit, citing privacy concerns caused by “GDPR or something”, but DI understands it is to be accounted for as a line item in ICANN’s Federal lobbying disclosure.
Calvez said ICANN has managed to negotiate “substantial” bulk discounts on the usual $200,000 Mar-a-Lago membership fees and $2,000-a-night room rates.
The cost will also be offset by sponsorship contributions from ICANNwiki and the National Rifle Association, he said.
Registry and registrar CEOs polled by DI this weekend were split on whether they would attend.
“Of course I’m going,” Blacknight CEO Michele Neylon told us by phone from an airport lounge in Kigali.
But .xyz chief Daniel Negari said he would attend only if he can secure sufficient funding for his bus fare to the airport.
Among the cost-cutting proposals on the menu, DI understands, is a request to consolidate all current and future policy working groups into a single, unified WG.
Sources say this would have the added benefit of reducing the annual policy implementation budget to zero dollars between now and, at the earliest, 2045.

17 Comments Tagged: april 1

Registrars will miss GDPR deadline by a mile

Registries and registrars won’t be able to implement ICANN’s proposed overhaul of the Whois system in time for the EU’s General Data Protection Regulation coming into effect.
That’s according to an estimated timetable (pdf) sent by ICANN’s contracted parties to the organization this week.
While they feel confident that some elements of ICANN’s GDPR compliance plan could be in place before May 25 this year, when the law kicks in, they feel that other elements could take many months to design and roll out.
Depending on the detail of the finalized plan, we could be looking at the back end of 2019 before all the pieces have been put in place.
Crucially, the contracted parties warn that designing and rolling out a temporary method for granting Whois access to entities with legitimate interests in the data, such as police and trademark owners, could take a year.
And that’s just the stop-gap, Band-Aid hack that individual registries and registrars would put in place while waiting — “quarters (or possibly years), rather than months” — for a fully centralized ICANN accreditation solution to be put in place.
The outlook looks bleak for those hoping for uninterrupted Whois access, in other words.
But the timetable lists many other sources of potential delay too.
Even just replacing the registrant’s email address with a web form or anonymized forwarding address could take up to four months to put online, the contracted parties say.
Generally speaking, the more the post-GDPR Whois differs from the current model the longer the contracted parties believe it will take to roll out.
Likewise, the more granular the controls on the data, the longer the implementation window.
For example, if ICANN forces registrars to differentiate between legal and natural persons, or between European and non-European registrants, that’s going to add six months to the implementation time and cost a bomb, the letter says.
Anything that messes with EPP, the protocol underpinning all registry-registrar interactions, will add some serious time to the roll-out too, due to the implementation time and the contractual requirement for a 90-day notice period.
The heaviest workload highlighted in the letter is the proposed opt-in system for registrants (such as domain investors) who wish to waive their privacy rights in favor of making themselves more contactable.
The contracted parties reckon this would take nine months if it’s implemented only at the registrar, or up to 15 months if coordination between registries and registrars is required (and that timeline assumes no new EPP extensions are going to be needed).
It’s possible that the estimates in the letter could be exaggerated as part of the contracted parties’ efforts to pressure ICANN to adopt the kind of post-GDPR Whois they want to see.
But even if we assume that is the case, and even if ICANN were to finalize its compliance model tomorrow, there appears to be little chance that it will be fully implemented at all registrars and registries in time for May 25.
The letter notes that the timetable is an estimate and does not apply to all contracted parties.
As I blogged earlier today, ICANN CEO Goran Marby has this week reached out to data protection authorities across the EU for guidance, in a letter that also asks the DPAs for an enforcement moratorium while the industry and community gets its act together.
Late last year, ICANN also committed not to enforce the Whois elements of its contracts when technical breaches are actually related to GDPR compliance.

4 Comments Tagged: gdpr, ICANN, privacy, whois

ICANN chief begs privacy watchdogs for Whois advice

ICANN CEO Goran Marby has written to the data protection authorities of all 28 European Union states, along with the European Data Protection Supervisor, to ask for guidance on how to implement new privacy laws.
Marby also asked the DPAs about the possibility of an enforcement moratorium, to give the domain industry and ICANN more time to formulate their collective response to the General Data Protection Regulation.
GDPR, which aims to give EU citizens more control over their personal data, comes into full effect May 25. Companies that break the rules face fines that could amount to millions of euros.
But ICANN does not yet have a firm plan for bringing the distributed Whois system into compliance with GDPR, and has repeatedly indicated that it needs guidance from European DPAs.
“ICANN and more than a thousand of the domain names registries and registrars are at a critical juncture,” Marby wrote (pdf).
“We need specific guidance from European data protection authorities in order to meet the needs of the global internet stakeholder community, including governments, privacy authorities, law enforcement agencies, intellectual property holders, cybersecurity experts, domain name registries, registrars, registrants and ordinary internet users,” he wrote.
ICANN has already written a proposal — known as the “Cookbook” and sent to DPAs three weeks ago — for how gTLD registrars and registries could comply with GDPR by removing most fields from public Whois records.
But Marby’s letter points out that many ICANN community members think the Cookbook either goes too far or not far enough.
As we reported a week ago, the Governmental Advisory Committee and Intellectual Property Constituency are not convinced ICANN needs to chop quite as much info from the public Whois as it’s currently planning.
But on the flipside, there are privacy advocates who think far less data should be collected on registrants and fundamentally question ICANN’s power to mandate public Whois access in its registry and registrar contracts.
Both sides of the debate are referenced in the letter.
“Guidance from DPAs on ICANN’s plan of action as presented in the Cookbook, and in particular, the areas where there are competing views, is critical as soon as possible, but particularly during the next few weeks,” Marby wrote.
Whether ICANN will get the answers it needs on the timetable it needs them is open to debate.
Many community members expressed skepticism about whether the DPAs’ commitment to the urgency of the issue matches ICANN’s own, during ICANN 61 earlier this month.
There seemed to be little confidence that the DPAs’ responses, should ICANN receive any, will provide the clarity the industry needs.
It may also be bad timing given the unrelated Cambridge Analytica/Facebook scandal, which appears to be consuming the attention of some European DPAs.

2 Comments Tagged: cookbook, dpas, gdpr, ICANN, privacy, whois

Stéphane Van Gelder dies after motorcycle accident

I’m very sad to report that domain name industry veteran and ICANN community leader Stéphane Van Gelder has died. He was 51.
Friends tell me he died today of injuries sustained in a vehicle crash in Switzerland near the Italian border.
According to a local report, he and his wife were hit by a car March 23, while stopped on their motorcycles at a traffic light.
His wife, Julie, was also injured but survived.
Stéphane was a long-time member of the industry, in 1999 co-founding the French registrar Indom, which he sold to Group NBT in 2010.
After Indom, he became an independent consultant, first under the brand Stéphane Van Gelder Consulting, later as Milathan.
He joined new gTLD registry StartingDot in 2014 and saw the company through to its acquisition by Afilias in 2016.
He told us at the time of his rebranding that the name “Milathan” was a “derivative of words in Hindi that mean ‘union’ or ‘meeting’ in the sense of bringing people together”.
It was perhaps an appropriate name, given Stéphane’s record of successful senior leadership positions in the ICANN volunteer community.
Notably, he chaired the GNSO Council for two years from 2010, and was chair of the Nominating Committee from 2015.
His most recent social media posts show that he was on a motorcycle tour of Italy with his wife before his accident near Lake Como.
Stéphane and I were not close, but in our interactions I always found him knowledgeable, witty, and charming. A thoroughly nice guy.
He was also one of the very few people in the industry I’ve trusted enough to write guest posts for DI over the years. Here he is fighting the GNSO’s corner in 2012.
Stéphane is survived by his wife and, friends tell me, two children. They have our condolences, and we wish his wife a speedy recovery.
He will be missed.

40 Comments Tagged: ICANN, obituary, stephane van gelder