Experts say piracy law will break the internet

Five of the world’s leading DNS experts have come together to draft a report slamming America’s proposed PROTECT IP Act, comparing it to the Great Firewall of China.
In a technical analysis of the bill’s provisions, the authors conclude that it threatens to weaken the security and stability of the internet, putting it at risk of fragmentation.
The bill (pdf), proposed by Senator Leahy, would force DNS server operators, such as ISPs, to intercept and redirect traffic destined for domains identified as hosting pirated content.
The new paper (pdf) says this behavior is easily circumvented, incompatible with DNS security, and would cause more problems than it solves.
The paper was written by: Steve Crocker, Shinkuro; David Dagon, Georgia Tech; Dan Kaminsky, DKH; Danny McPherson, Verisign and Paul Vixie of the Internet Systems Consortium.
These are some of the brightest guys in the DNS business. Three sit on ICANN’s Security and Stability Advisory Committee and Crocker is vice-chairman of ICANN’s board of directors.
One of their major concerns is that PROTECT IP’s filtering would be “fundamentally incompatible” with DNSSEC, the new security protocol that has been strongly embraced by the US government.
The authors note that any attempts to redirect domains at the DNS level would be interpreted as precisely the kind of man-in-the-middle attack that DNSSEC was designed to prevent.
They also point out that working around these filters would be easy – changing user DNS server settings to an overseas provider would be a trivial matter.

PROTECT IP’s DNS filtering will be evaded through trivial and often automated changes through easily accessible and installed software plugins. Given this strong potential for evasion, the long-term benefits of using mandated DNS filtering to combat infringement seem modest at best.

If bootleggers start using dodgy DNS servers in order to find file-sharing sites, they put themselves at risk of other types of criminal activity, the paper warns.
If piracy sites start running their own DNS boxes and end users start subscribing to them, what’s to stop them pharming users by capturing their bank or Paypal traffic, for example?
The paper also expresses concern that a US move to legitimize filtering could cause other nations to follow suit, fragmenting the mostly universal internet.

If the Internet moves towards a world in which every country is picking and choosing which domains to resolve and which to filter, the ability of American technology innovators to offer products and services around the world will decrease.

This, incidentally, is pretty much the same argument used to push for the rejection of the .xxx top-level domain (which Crocker voted for).

The 10 dumbest moments from that new TLDs Congressional hearing

The US House of Representatives last week held an oversight hearing into ICANN’s new top-level domains program.
As I may have mentioned, the House Subcommittee on Intellectual Property, Competition and the Internet hearing was set up to be pretty one-sided stuff.
It was clear from the start that ICANN senior vice president Kurt Pritz was going to have his work cut out, given how the panel of five other witnesses was loaded against him.
But as the hearing played out, it quickly became apparent that the real challenge lay not with his fellow witnesses — most of whom were either sympathetic to ICANN from the outset or occasionally forced to leap to its defense — but with the members of the Subcommittee.
While some Congressmen had merely bought into the positions of the trademark lobby, others were so far out of their depth you couldn’t even see the bubbles.
Here, in purely my personal opinion and in no particular order, are the Top 10 Dumbest Moments.
1. Chairman Goodlatte buys the FUD
Subcommittee chairman Bob Goodlatte’s opening statement appeared to have been written with significant input from the intellectual property lobby.
At the very least, he seemed to have accepted some of the more extreme and questionable positions of that lobby as uncontroversial fact.
Two examples:

With every new gTLD that is created, a brand holder will be forced to replicate their internet domain portfolio.
…
The roll-out of these new gTLDs will also complicate copyright enforcement, making it harder and more costly to find and stop online infringers.

He also, on more than one occasion, advocated a “trademark block list” – the Globally Protected Marks List, an idea even the ICANN Governmental Advisory Committee has now rejected.
2. Whois privacy services are Bad
A couple of Congressmen and a couple of witnesses stated that Whois accuracy needs to be enforced more stringently by ICANN, and that Whois proxy/privacy services help criminals.
I took the liberty of doing Whois queries on the official campaign web sites of all 25 members of the Subcommittee, and found that 11 of them use privacy services.
That’s 44% of the committee. Studies have estimated that between 15% and 25% of all registrations use proxy/privacy services, so Congressmen appear to be relatively hard users.
Here’s the list:
Rep. Steve Chabot, Rep. Darrell Issa, Rep. Mike Pence, Rep. Jim Jordan, Rep. Ted Poe, Rep. Jason Chaffetz, Rep. Ben Quayle, Rep. Ted Deutch, Rep. Jerry Nadler, Rep. Zoe Lofgren, Rep. Tim Griffin.
It also turns out that dei.com, the domain name Rep. Issa bragged about owning during the hearing, has phoney data in its Whois record.

You can report him to ICANN here, if you’re so inclined.
It’s likely, of course, that these domains were registered by their staff, but I think we’re allowed to hold Congressmen to at least the same high standard they expect of the rest of us.
3. New TLDs will help porn typosquatters
Mei-lan Stark, an IP lawyer from Fox and the International Trademark Association, used the recent UDRP case over myfox2detroit.com as an example of abuse that could happen in new TLDs.
The domain directed visitors to a porn-laden link farm and was rightly deemed by WIPO to be confusingly similar to myfoxdetroit.com, the genuine Fox 2 Detroit site.
But, as Pritz pointed out later in the hearing, myfox2detroit.com is a .com domain. It’s not in a “new” TLD.
Fox, it transpires, has not registered the string “myfoxdetroit” in any other gTLD. Neither have the cybersquatters. It’s clearly not a brand that is, or needs to be, on Fox’s defensive registrations list.
That said, the “typo” myfoxdetroit.co, along with several other Fox .co domains, has been actually cybersquatted, so maybe Stark had a point.
4. Say Watt?
Rep. Mel Watt, the Subcommittee’s ranking member, couldn’t get a handle on why the pesky foreigners aren’t able to use their own non-Latin scripts in existing gTLDs.
I was beating my head against my desk during this exchange:

[After Stark finished explaining that she thinks IDN gTLDs are a good idea]
Watt: So, you think other languages. And that can’t be done in the .com, .net lingo as well?
Stark: Not today. Not the way the system is currently.
Watt: Yeah, well, not the way it’s done today, but what’s the difference? You all keep talking about innovation. Changing somebody’s name is not innovation. Allowing somebody to use a different name is not innovation. That’s not adding anything new to life that I can tell. Mr DelBianco, Mr Metalitz, help me here.
DelBianco: You’re right, just adding a new label to an existing page or content doesn’t really truly create innovation. However, 56% of the planet cannot even type in the domain name…
Watt [interrupting]: That’s not a function of whether you call something “Steve” or whether you call it “net” is it? You can put the Steve in front of the net, or you can put it dot-net, dot-Steve, dot-Watt, Steve, Steven…. you haven’t really created anything new have you?
DelBianco: You haven’t there, but 56% of our planet can’t use our alphabet when they read and write…
Watt [interrupting]: Tell me how this is going to make that better as opposed to what we have right now.
DelBianco: For the first time an Arabic user could type an entire email address in all Arabic, or a web site address in all Arabic.
Watt [interrupting]: Why can’t the current system evolve to do that without new gTLDs?

To Watt’s credit, he did put the witnesses on the spot by asking if any of them were opposed to new gTLDs (none were), but by the time his five minutes were up he was in serious danger of looking like a stereotypically insular American politician.
5. New TLDs are like T-shirts (or something)
Almost everything the NetChoice Coalition’s Steve DelBianco said, whether you agree with his positions or not, was sensible.
But when he started producing props from under the table, including one of the bright yellow custom “TLD-shirts” that AusRegistry International has been printing at recent ICANN meetings, I was giggling too hard to follow his train of thought.
Apparently the new TLDs program is like a T-shirt printing machine because, well… a T-shirt printing machine is more complicated than a label maker, which was the visual simile DelBianco used last time he appeared before the Subcommittee.
It was fun to see Congressmen treated like five-year-old kids for a minute. God knows some of them deserved it.
6. New TLDs will cost Fox $12 million
Stark stated that Fox has about 300 trademarks that it will need to enforce in new TLDs. Given ICANN has predicted 400 new TLDs, and estimating $100 per defensive registration, she “conservatively” estimated that Fox will have to pay $12 million to protects its marks in the first round.
Really?
The same ICANN study that estimated 400 applications being filed in the first round also estimated that as many as 200 of them are likely to be “.brand” TLDs in which Fox will not qualify to register.
A substantial proportion of applications are also likely to have a “community” designation and a restricted registrant policy that, in many cases, will also exclude Fox.
Does Fox really also need to register 300 brands in every city TLD or linguistic TLD that will be approved? Does Fox News broadcast in Riga? Does it have a Basque language TV station?
Not even World Trademark Review was convinced.
7. China is going to take over the internets
The Subcommittee spent far too much time talking around this meme before deciding that China is a sovereign nation that can do pretty much whatever it wants within its own borders and that there’s nothing much a House committee can do about it.
8. Literally everything that came out of Rep. Issa’s mouth
Former car alarm entrepreneur Darrell Issa talked confidently, as if he was the guy on the committee with the geek credentials, but pretty much everything he said was witless, impenetrable waffle.
He started with the premise that it costs a “fraction of a fraction of a fraction of a fraction of a penny” to route traffic to an IPv6 address (why this is relevant, he didn’t say), then asked:

Why, when I go to Go Daddy, do I have to pay between $10 and $10,000 for a name and not from a tenth of a cent to 10 cents for a name?
…
Why in the world are there so many reserved [ie, registered] names? If I want a good name from Go Daddy… the good names, that I might want, have been already pre-grabbed and marketed in an upward way, higher. Why is it that they’re not driven down? Real competition would imply that those names are driven down to a penny for a user and prohibited from being camped on in order to resell.

Issa is a Republican, so I was quite surprised to hear him apparently advocate against the free market and the rule of supply and demand in this way, and with such a poor grasp of the economics.
Issa’s premise that it costs an imperceptible fraction of a cent to resolve a domain may be true, but only if you’re talking about a single resolution. VeriSign alone handles 57 billion such queries every day.
It adds up. And that’s just resolution, ignoring all the costs carried by the registries and registrars, such as payment processing, security, marketing, Whois (and, in the case of Issa’s domains, Whois privacy and accuracy enforcement), paying staff, rent, facilities, hardware, bandwidth…
Pritz told Issa as much, but he didn’t seem interested in the answer. He instead turned to CADNA’s Josh Bourne, to ask a meandering question that, after listening to it several times, I still don’t understand.
9. Rod Beckstrom gets paid millions
Rep. Maxine Waters was very concerned that ICANN CEO Rod Beckstrom has a salary of over $2 million, “guaranteed”.
She flashed up a copy of what I believe was probably Mike Berkens’ The Domains article about ICANN salaries, from early 2010, but she clearly hadn’t read beyond the headline.
Beckstrom’s salary is $750,000 per annum. He can (and does) get a bonus if he hits his undisclosed performance targets, but it still adds up to less than $1 million a year and pales in comparison to what he’s probably going to earn when he leaves ICANN.
As Berkens accurately reported, Beckstrom has a three-year contract, so he gets a minimum of $2.2 million in total over the period he’s employed as ICANN’s CEO.
People can (and do, continually) question whether he’s earning his money, particularly when he does things like not turning up to Congressional hearings, but his salary is not set at anywhere near the level the Subcommitee heard.
10. This is so important we need more hearings (btw, sorry I’m late)
Several Congressmen called for further hearings on new gTLDs. They’re shocked, shocked, that ICANN is considering doing such a thing.
Some of those calling for further scrutiny weren’t even in the room for much of the hearing, yet saw fit to decree that the subject was so important that they needed more time to investigate.
Whether this turns out to be just more political theater remains to be seen.

ICE domain seizures enter second phase

The US Immigration & Customs Enforcement agency seems to be consolidating its portfolio of seized domain names by transferring them to its own registrar account.
Many domains ICE recently seized at the registry level under Operation “In Our Sites” have, as of yesterday, started naming the agency as the official registrant in the Whois database.
ICE, part of the Department of Homeland Security, has collected over 100 domains, most of them .coms, as part of the anti-counterfeiting operation it kicked off with gusto last November.
The domains all allegedly either promoted counterfeit physical goods or offered links to bootleg digital content.
At a technical level, ICE originally assumed control of the domains by instructing registries such as VeriSign, the .com operator, to change the authoritative name servers for each domain to seizedservers.com.
All the domains pointed to that server, which is controlled by ICE, resolve to a web server displaying the same image:

(The banner, incidentally, appears to have been updated this month. If clicked, it now sends visitors to this anti-piracy public service announcement hosted at YouTube.)
Until this week, the Whois record associated with each domain continued to list the original registrant – a great many of them apparently Chinese – but ICE now seems to be consolidating its portfolio.
As of yesterday, a sizable chunk — but by no means all — of the seized domains have been transferred to Network Solutions and now name ICE as the registrant in their Whois database records.
Rather than simply commandeering the domains, it appears that ICE now “owns” them too.
But ICE has already allowed one of its seizures to expire. The registration for silkscarf-shop.com expired in March, and it no longer points to seizedservers.com or displays the ICE piracy warning.
The domain is now listed in Redemption Period status, meaning it is starting along the road to ultimately dropping and becoming available for registration again.
Interestingly, most of the newly moved domains appear to have been transferred into NetSol from original registrars based in China, such as HiChina, Xin Net and dns.com.cn.
After consulting with a few people more intimately familiar with the grubby innards of the inter-registrar transfer process than I am, I understand that the names could have been moved without the explicit intervention of either registrar, but that it would not be entirely unprecedented if the transfers had been handled manually under the authority of a court order.
If I find out for sure, I’ll provide an update.

Those April 1 Headlines in Full

Too many ideas, not enough time.
These are some of the stories I would have written if there were more hours in the day…

Joan Rivers dies after head transplant surgery
UK banishes cybercrime sites to .au
Transparency review calls for ICANN reality show
UDRP panelist returns Taiwan to China
Bob Parsons shoots BigJumbo CEO
“Pigeon shit” blamed for Playboy plague
Hank Alvarez named ICANN compliance chief
Constantine Roussos says DNS needs “more cowbell”
NATO apologizes for Bit.ly bombing
Blacknight unveils leprechaun mascot
RIAA says .so domains “haven for piracy”
DomainTools merges with DomainJerks
BBC to apply for .cotton
ICANN successfully delays heat death of universe
Parsons apologizes, resurrects elephant

Too many ideas, not enough time.
These are some of the stories I would have covered today, if only there were more hours in the day.
Joan Rivers dies after head transplant surgery
UK government banishes cybercrime sites to .au
Transparency review calls for ICANN reality show
UDRP panelist returns Taiwan to China
Bob Parsons shoots BigJumbo CEO
“Pigeon shit” blamed for Playboy plague
Hank Alvarez named ICANN compliance chief
Constantine Roussos says DNS needs “more cowbell”
NATO apologizes for Bit.ly bombing
Blacknight unveils leprechaun mascot
RIAA says .so domains “haven for piracy”
DomainTools merges with DomainJerks
BBC to apply for .cotton
ICANN successfully delays heat death of universe
Parsons apologizes, resurrects elephant
There’s at least 15 stupidly obscure in-jokes there. Probably more. How many did you “get” without Googling?
15 – Congratulations! You’re me. Or a potential future spouse. Call me!
10-14 – You truly are a domain name industry nerd, the depth and breadth of your knowledge covering both domaining and ICANN politicking. You’ve probably been to ICANN meetings and DomainFest. You should be both immensely proud and profoundly ashamed of yourself.
6-10 – I’m proud to have you as a reader. You’re exactly the type of well-balanced individual I’m hoping to attract to this site. Why not try visiting one of my advertisers and purchasing something?
1-5 – Must try harder! Your insight into the industry is sadly lacking. Perhaps consider subscribing to my RSS and Twitter feeds, which can be found at at the top of the left-hand sidebar, in order to bulk up your knowledge base.
0 — You appear to have visited this blog by mistake. Were you searching for “group porn”? I get a lot of hits for that. Nothing to see here, please move along.

VeriSign’s upcoming battle for the Chinese .com

Could VeriSign be about to face off against China for control of the Chinese version of .com? That’s an intriguing possibility that was raised during the .nxt conference last week.
Almost as an aside, auDA chief Chris Disspain mentioned during a session that he believes there are moves afoot in China to apply to ICANN for “company”, “network” and “organization” in Chinese characters. In other words, .com, .net and .org.
I’ve been unable to find an official announcement of any such Chinese application, but I’m reliably informed that Noises Have Been Made.
VeriSign has for several quarters been open about its plans to apply for IDN equivalents of its two flagship TLDs, and PIR’s new CEO Brian Cute recently told me he wants to do the same for .org.
While neither company has specified which scripts they’re looking at, Chinese is a no-brainer. As of this week, the nation is the world’s second-largest economy, and easily its most populous.
Since we’re already speculating, let’s speculate some more: who would win the Chinese .com under ICANN’s application rules, VeriSign or China?
If the two strings were close enough to wind up in a contention set, could VeriSign claim intellectual property rights, on the basis of its .com business? It seems like a stretch.
Could China leapfrog to the end of the process with a community application and a demand for a Community Priority Evaluation?
That also seems like a stretch. It’s not impossible – there’s arguably a “community” of companies registered with the Chinese government – but such a move would likely stink of gaming.
Is there a technical stability argument to be made? Is 公司. (which Google tells me means “company” in Chinese) confusingly similar to .com?
If these TLDs went to auction, one thing is certain: there are few potential applicants with deeper pockets than VeriSign, but China is one of them.
UPDATE: VeriSign’s Pat Kane was good enough to post a lengthy explanation of the company’s IDN strategy in the comments.

Olympics tells ICANN to abandon new TLD launch or get sued

The International Olympic Committee has threatened to sue ICANN unless it gives IOC trademarks special protection in its new top-level domains program.
The IOC’s critique of ICANN’s new Applicant Guidebook is the first to be filed by a major organization in the current public comment period.
The organization has accused ICANN of ignoring it, preferring instead to take its policy cues from the domain name industry, and said it should “abandon its current timeline” for the launch.
ICANN currently plans to start accepting TLD applications May 30, 2011.
Calling the guidebook “inherently flawed”, the IOC’s director general Urs Lacotte wrote:

If these critical issues are not fully resolved and ICANN chooses not to place the Olympic trademarks on the reserved names list, then the IOC and its National Olympic Committees are prepared to employ all available legislative, regulatory, administrative and judicial mechanisms to hold ICANN accountable for damage caused to the Olympic movement.

(That language looks like it could have been cut-n-paste from a separate letter from the financial services industry, which I reported on last week).
The IOC said that it has opposed the new TLD program 11 times – asking for its trademarks to be placed on the AGB’s reserved strings lists, but received no response.
Special pleading? Perhaps, but the IOC’s trademarks are already specifically protected by legislation in numerous countries, including the US, UK, Canada and China.
The IOC also wants stronger trademark protection mechanisms, such as mandatory typosquatting protections in sunrise periods and extending dispute proceedings to registrars.
Expect many more such missives to start showing up on the ICANN web site over the next 11 days before the ICANN board of directors meets to approve the AGB in Cartagena.
This may be the last chance many organizations get to ask for the changes they want in the AGB before the first round of new TLD applications opens, and I expect them to seize it with both hands.

Register.com settles Baidu domain hijacking lawsuit

Register.com has apologised to Chinese portal company Baidu for allowing its domain, baidu.com, to be hijacked by the Iranian Cyber Army hacker group.
The two companies have announced that the lawsuit, which alleged gross negligence among other things, has now been settled. Terms were not disclosed.
If Baidu’s complaint was to be believed, the hackers took over baidu.com with a trivial social engineering attack that relied upon a Register.com tech support employee being asleep at the wheel.
The company is one of China’s largest internet firms, employing over 6,000 people and turning over well over $600 million a year. But for the period of the hijack, visitors to baidu.com instead just saw the hackers’ defacement message instead.
The registrar had argued in court that its terms and conditions released it from liability, but the judge didn’t buy it.
Register.com, which was acquired by Web.com for $135 million in June, said yesterday:

After an internal investigation, we found that the breach occurred because Register’s security protocols had been compromised. We have worked with United States law enforcement officials and Baidu to address the issue. We sincerely apologize to Baidu for the disruption that occurred to its services as a result of this incident.

Baidu said it accepted the apology. And the check, I imagine.

Internet closes in on 200 million domain names

The internet will almost certainly break through the 200 million domain names milestone before the end of the year, judging from VeriSign’s latest Domain Name Industry Brief.
There were about 196.3 million registered domains at the end of June, according to the report, up by 3 million on the first quarter and 12.3 million on the second quarter 2009. That’s 2% and 7% growth, respectively.
The drag factor on the overall market caused by the mass expiry of millions of Chinese .cn domains seems to have levelled off, making the growth a little more encouraging than in the first quarter.
Regardless, VeriSign said that 76.3 million domains were registered in the ccTLDs, basically flat when compared to the March numbers and a 2.5% increase year-on-year.
The ccTLDs may see a growth spurt in the third-quarter DNIB, due to the influence of .co’s launch, assuming another .cn situation does not arise in another TLD.
VeriSign doesn’t say as much, but if the ccTLDs only grew by a net 63,000 names, that means the bulk of the 3 million new domains were in the gTLDs, but it doesn’t break the number down by gTLD.
It doesn’t even say precisely how many .com/.net domains it manages, or what its growth rates were, just that the two TLDs’ combined total now exceeds 100 million.

US seeks powers to shut down domains

COICA is the new acronym we’ll all soon be talking about — it’s the law that could give the US its very own Great Firewall of China.
A bipartisan group of US senators today introduced the Combating Online Infringement and Counterfeits Act, legislation that would enable the government to quickly turn off domain names involved in piracy.
The bill would enable the Department of Justice to seek a court order against a domain name it believes is involved in piracy or selling counterfeit goods.
If the sponsoring registrar or registry is located in the US, the order would force it to stop the domain from resolving and lock it down.
The likely effect of this would be to force piracy sites out of .com and into offshore registrars. But the bill has thought about that too.
If it’s a non-US registrar and registry, injunctions could be sought to block the domain at the ISP level.
That’s right folks – if this bill passes, the US would get its very own Chinese-style national firewall.
The bill would allow the domain registrant to petition the court to lift the order.
“By cracking down on online piracy of television shows and movies, we hope this bill will encourage copyright owners to develop innovative and competitive new choices for consumers to watch video over the internet,” said Sen. Herb Kohl.
Which is about as disingenuous a statement as it gets, when you think about it, given that it essentially eliminates a major incentive for business model innovation.