Now new gTLDs are being scapegoated for child abuse material (rant)

The guy responsible for getting the string “rape” closely restricted for no reason in .uk domain names is now gunning for ICANN and new gTLDs with a very similar playbook.
Campaigner John Carr, secretary of the little-known Children’s Charities’ Coalition on Internet Safety, wants ICANN to bring in strict controls to prevent convicted pedophiles registering domains in child-oriented domains such as .kids.
He’s written to the UK prime minister, the two other ministers with the relevant brief, the US federal government and the California attorney general to make these demands.
That’s despite the fact that he freely acknowledges that he does not have any evidence of a problem in existing kid-oriented TLDs and that he does not expect there to be a problem with .kids, should it be delegated, in future.
Regardless, ICANN comes in for a bit of a battering in the letter (pdf), with Carr insinuating that it and the domain industry are quite happy to throw child safety under the bus in order to make a quick buck. He writes:

ICANN has definitely not been keeping the internet secure for children. On the contrary ICANN shows complete indifference towards children’s safety. This has led to real dangers that ICANN could have prevented or mitigated.
…
ICANN, the Registries and the Registrars have an obvious financial interest in increasing the number of domain names being sold. Their interest in maximising or securing their revenues appears sometimes to blind them to a larger obligation to protect the weak and vulnerable e.g. in this instance children.

Despite this worrying premise, Carr admits in an accompanying paper (pdf) that the Russian version of .kids (.дети), which has been live for three years and only has about 1,000 registrations, does not seem to have experienced a deluge of sex offenders.
Nevertheless, he says ICANN should have forced the .дети registry to do criminal background checks on all registrants to make sure they did not have a record of sexual offences.

While at the time of writing we have no information which suggests anything untoward has happened with any Russian .kids websites, and we understand the volume of sales has been low so far, the matter should never have been left open in that way. When ICANN let the contract it could have included clauses which would have made it a contractual obligation to carry out the sort of checks mentioned. The fact that ICANN did not do this illustrates a degree of carelessness about children’s well-being which is tantamount to gross negligence.

Quite how a domain registry would go about running criminal records checks on all of its customers globally, and what the costs and the benefits would be, Carr does not say.
The letter goes on to state incorrectly that Amazon and Google are in contention for .kids.
In fact, Google applied for the singular .kid. While the two strings are in contention due to an adverse String Confusion Objection, there’s also a second applicant for .kids, the DotKids Foundation, which proposes to keep .kids highly restricted and which Carr is either unaware of or deliberately omits from his letter.
Based on his assumption that .kids is a two-horse race between Amazon and Google, he says:

while I am sure both Google and Amazon will choose to do the right thing, whichever one is the eventual winner of the contract, the point is matters of this kind should never have been left as an option

So not only does Carr not have any evidence that extant “.kids” domains are currently being abused years after delegation, he’s also sure that .kids won’t be in future.
But he wants Draconian background checks implemented on all registrants anyway.
His letter coincides with the release of and heavily cites the 2016 annual report (pdf) of the Internet Watch Foundation — the organization that coordinates the takedown of child abuse material in the UK and elsewhere.
That report found that new gTLD domains are being increasingly used to distribute such material, but that Verisign-run TLDs such as .com are still by far the most abused for this purpose.
The number of takedowns against new gTLD domains in 2016 was 272 (226 of which were “dedicated to distributing child sexual abuse content”) the IWF reported, a 258% increase on 2015.
That’s 272 domains too many, but averages out at about a quarter of a domain per new gTLD.
There were 2,416 domains being used to distribute this material in 2016, IWF said. That means new gTLDs accounted for about 11% of the total child abuse domains — higher than the 7.8% market share that new gTLDs command (according to Verisign’s Q4 industry brief).
But the IWF report states that 80% of the total abuse domains are concentrated in just five TLDs — .com, .net, .se, .io, and .cc. Even child abusers are not fans of new gTLDs, it seems.
Despite the fact that two of these domains are operated under ICANN contract, and the fact that .io is operated by a British company representing a British overseas territory, Carr focuses his calls for action instead on new gTLDs exclusively.
And his calls are receiving attention.
A The Times article this week cries “New internet domain is magnet for paedophiles, charities warn”, while tabloid stable sister The Sun reported on “fears predators are exploiting new website addresses to hide indecent material”.
This is how it started with Carr’s campaign to get “rape” domains banned in the UK.
Back in 2013, he wrote a blog post complaining that it was possible to register “rapeher.co.uk” — not that it had been registered, only that it could be registered — and managed to place a couple of stories in the right-leaning press calling for Nominet to do more to prevent the registration of “depraved and disgusting” domains such as the one he thought up.
This led to a government minister calling for an independent policy review, an actual review, and a subsequent policy that sees some poor bastard at Nominet having to pore over every .uk registration containing rapey strings to see if they’re potentially advocating or promoting actual rape.
Implementation of that policy has so far confirmed that Carr’s worries were, as I said in my 2013 rant, baseless.
In 2016, there were 2,407 registrations of domains containing the string “rape”, but just one of them was found to be using it in the context of sexual assault and was suspended, according to Nominet stats.
In 2015, the number of suspensions was the same. One.
The same story is playing out now — a single Don Quixote with a tenuous grasp of the systems he’s criticizing calling for ludicrous policies to prevent a problem that he freely admits does not exist and probably won’t exist in future.
Still, at least he gets to wave some headlines in front of his employers to pretend he’s actually earning his salary.

Comment Tagged: .kids, amazon, child abuse material, CHIS, google, ICANN, nominet, verisign

Uniregistry to grandfather existing domains before big price increases

Uniregistry has backtracked on its plan to hike renewal fees on thousands of domain name registrations.
CEO Frank Schilling described the U-turn, which followed a ferocious backlash from domain investors, as “the right thing to do”.
The company had announced price increases across 16 of its 27 gTLDs that in one case exceeded 3,000% but in many more cases represented increases in the hundreds of percent.
The increases were to apply to new and renewing registrations, and Schilling had said that they were necessary to keep the affected TLDs afloat.
But domainers were furious, taking to blogs and message boards to announce and decry the death of all new gTLDs.
Leading registrar Go Daddy soon said that it would no longer sell Uniregistry TLDs, at least temporarily.
But yesterday Uniregistry announced a change of heart, providing an unusually detailed account of the thought process leading to the price increases that’s worth quoting at length.

“The registration providers we consulted reported that differentiating prices based on the time of the registration was technically difficult and confusing for customers,” said Bret Fausett, head of the Registry Services Team. “Based on that feedback, and considering the small number of registrants affected, we made the difficult decision to raise prices for all registrants.”
“After the announcement, however, we, and our registration partners, have heard clearly from our end users that the ability to register ten-years at the existing price does not ameliorate the pain of subsequent price increases for registrants facing substantial price increases,” said Mr. Fausett. “So, for the names in our highest-priced tiers, the price changes will affect only new registrations. We are asking our registration partners to do whatever is necessary to enable this approach.”
“Creating a legacy tier of prices for inaugural registrants in our niche, premium top-level domains is technically more difficult,” said Frank Schilling, Managing Director of Uniregistry, “but it’s the right thing to do for those pioneering individuals and companies who have staked their claims in the new Internet real estate.”

In other words, if you register a name in the affected gTLDs before September 8, your renewal fee will be at the current lower level.
Whether this will be enough to mitigate Uniregistry’s reputational damage in the domainer community remains to be seen.
But the company also said it plans to overhaul its premium names pricing by the end of the second quarter, scrapping the multi-tier pricing approach in favor of a one-size-fits-all menu.
Schilling said that price reductions will affect “millions” of reserved names and mean “hundreds of millions” of dollars of hypothetical value have been wiped from the portfolio.

2 Comments Tagged: new gTLDs, pricing, uniregistry

PIR promotes two senior execs

Public Interest Registry has promoted two people in its senior finance team.
Marc Saitta, previously chief financial officer, is now chief operating officer, a position that appears to have been empty for a few years.
Saitta joined PIR as CFO in 2014.
Kathy King, who was senior director of finance and accounting, is now vice president of finance, the company said.
PIR, which runs .org and other non-profit gTLDs, said the promotions “represent our commitment to integrate and unify our operational teams to deliver more effective business and financial strategies on behalf of Public Interest Registry and its stakeholders.”
Both Saitta and King originally came from outside the domain industry, both having stints at the American Association for Motor Vehicle Administrators and Smithsonian Business Ventures.

Comment Tagged: .org, pir

China approves more Donuts, Afilias gTLDs

Donuts and Afilias have had two batches of new gTLDs approved for use in China.
The Ministry of Industry and Information Technology approved five Afilias TLDs and six Donuts TLDs last month. This means customers of Chinese registrars will now be able to legally use those names in China.
Afilias was approved for .info, .mobi and .pro, which were delegated following the 2000 and 2003 new gTLD application rounds and .kim and .red from the 2012 round.
Donuts simultaneously was cleared for .ltd, .group, .游戏 (“game”), .企业 (“business”), .娱乐 (“entertainment) and .商店 (“store”).
The approvals more than double the number of new gTLDs in Latin script to get the nod from MIIT, in what now appears to be a monthly occurrence.
In February, .ink and four Chinese-script TLDs passed the regulatory process, following .site and .shop in January and .vip, .club and .xyz in December.
MIIT approval means the chance of usage by Chinese registrants should go up, but it also ties these Western registries to relatively Draconian government policies when it comes to Chinese registrations.

Comment Tagged: afiias, china, donuts, miit, new gTLDs

ICANN reveals $500 million gTLD buyback program

ICANN is to spend its half-billion dollar auction war chest on a buyback program for failing new gTLDs, DI can reveal.
Inspired by the “Cash for Clunkers” program that provided stimulus during the economic downturn in the US a decade ago, the new program will see ICANN offer $1 million per gTLD to any registry whose heart simply isn’t in it any more.
The scheme will work rather like a stock buyback, ICANN explained in a 489-page document (PDF).
Registries opting to sell back their gTLDs will see their strings abruptly removed from the DNS root and their contracts torn up and burned on a great big bonfire.
Any domains registered in these gTLDs will stop resolving to parking pages immediately.
“We believe this program offers the most equitable distribution of auction funds and the fairest way to ensure new gTLD program participants see a return on their investment,” ICANN chair Steve Crocker said in a statement.
Portfolio registries including Donuts, Uniregistry, MMX, Radix and XYZ.com are already believed to have expressed an interest in the scheme, and were already forming a disorderly queue outside ICANN’s Los Angeles headquarters last night.
While Verisign also qualifies for the program, much of the funding will be provided by the $130 million it spent at the .web auction.
The company said it welcomed the deal and plans to sell .web back to ICANN as soon as possible. It added that it will cover the $129 million loss by fueling its data center generators with ten-dollar bills, rather than twenties, for the first three weeks of April.
But registrant groups were outraged by the proposal, which will see millions of domain names erased from the internet.
Dr General President Colonel Lucky Mfwamba (Esq), chair of the New gTLD Registrants Association, said he expects the bottom to fall out of the penis enlargement market overnight.
And in China, thousands of domain investors flocked to forums to complain that the randomly generated domains they bought at $0.20 each and hoped to sell to other investors for $0.30 each are suddenly worthless.

15 Comments

New gTLD registries want a $17 million ICANN rebate

Many gTLDs are performing more poorly than expected and their registries want some money back from ICANN to compensate.
The Registries Stakeholder Group this week asked ICANN for a 75% credit on their quarterly fees, which they estimate would cost $16.875 million per year.
The money would come from leftover new gTLD application fee money, currently stashed in an ICANN war chest valued at nearly $100 million.
The RySG, in a letter to ICANN (pdf), also asked for $3 million from the fund to be used to pay for advertising the availability of new gTLDs.
“These measures combined would support ICANN’s mission to promote competition for the public interest and operational interoperability of the internet,” the proposal states.
Currently, all gTLDs on the 2012-round contract have to pay ICANN $25,000 per year, split into quarterly payments, in fixed fees.
Transaction volume over 50,000 transactions per year is taxed at $0.25 per add, renewal or transfer.
The RySG wants the $6,250 quarterly fee reduced by $4,687.50 for a year, with the possibility of the discount being renewed in subsequent years.
In its letter, it cites an example of 900 delegated gTLDs being affected, which would cost $16.875 million per year.
However, that’s only three quarters of the total number of new gTLDs in the root. That currently stands at over 1,200 string, so the actual cost would presumably be closer to £23 million.
Because the new gTLD program, with its $185,000 application fees, was never meant to turn a profit, the RySG thinks it’s fair that the excess money comes back to the companies that originally paid it.
The rationale for the discount is that many new gTLDs (not all, as the RySG is quick to point out) are struggling under poor sales volumes, meaning a 5,000-name TLD, of which there are many, is in effect costing the registry $5 per name per year in fixed ICANN fees.
But that rationale does not of course apply to all new gTLDs. There are currently almost 470 dot-brand gTLDs in the root, which have business models oriented on harder-to-quantify ROI rather than sales volumes and profits.
It’s not clear from the RySG letter whether the discount would apply to all gTLDs or only those with a straightforward old-school profit motive.

7 Comments Tagged: fees, ICANN, new gTLDs, rysg

Hacker hostage crisis at ICANN secret key ceremony! (on TV)

One of ICANN’s Seven Secret Key-Holders To The Internet got taken out as part of an elaborate heist or something on American TV this week.
In tense scenes, a couple of secret agents or something with guns were forced to break into one of ICANN’s quarterly root zone key signing ceremonies to prevent a hacker or terrorist or something from something something, something something.
The stand-off came after the secret agents or whatever discovered that a hacker called Mayhew had poisoned a guy named Adler, causing a heart attack, in order to secure his position as a replacement ICANN key-holder and hijack the ceremony.
This all happened on a TV show called Blacklist: Redemption that aired in the US March 16.
I’d be lying if I said I fully understood what was supposed to be going on in the episode, not being a regular viewer of the series, but here’s the exposition from the beginning of the second act.

Botox Boss Lady: Seven keys control the internet? That can’t be possible.
Neck Beard Exposition Guy: They don’t control what’s on it, just how to secure it. All domain names have an assigned number. But who assigns the numbers?
Soap Opera Secret Agent: Key holders?
Neck Beard Exposition Guy: Seven security experts randomly selected by ICANN, the Internet Corporation for Assigned Names and Numbers.
Bored Secret Agent: Max Adler’s wife mentioned a key ceremony.
Neck Beard Exposition Guy: Yeah, four times a year the key holders meet to generate a master key and to assign new numbers, to make life difficult for hackers who want to direct folks to malicious sites or steal their credit card information.
Botox Boss Lady: But by being at the ceremony, Mayhew gets around those precautions?
Neck Beard Exposition Guy: Oh, he does more than that. He can route any domain name to him.

That’s the genuine dialogue. ICANN, jarringly, isn’t fictionalized in the way one might usually expect from US TV drama.
The scene carries on to explain the elaborate security precautions ICANN has put in place around its key-signing ceremonies, including biometrics, smart cards and the like.
The fast-moving show then cuts to the aforementioned heist situation, in which our villain of the week takes an ICANN staffer hostage before using the root’s DNSSEC keys to somehow compromise a government data drop and download a McGuffin.
Earlier this week I begged Matt Larson, ICANN’s VP of research and a regular participant in the ceremonies (which are real) to watch the show and explain to me what bits reflect reality and what was plainly bogus.
“There are some points about it that are quite close to how the how the root KSK administration works,” he said, describing the depiction as “kind of surreal”.
“But then they take it not one but two steps further. The way the ceremony happens is not accurate, the consequences of what happens at the ceremony are not accurate,” he added.
“They talk about how at the ceremony we generate a key, well that’s not true. It’s used for signing a new key. And then they talk about how as a result of the ceremony anyone can intercept any domain name anywhere and of course that’s not true.”
The ceremonies are used to sign the keys that make end-to-end DNSSEC possible. By signing the root, DNSSEC resolvers have a “chain of trust” that goes all the way to the top of the DNS hierarchy.
The root keys just secure the bit between the root at the TLDs. Compromising them would not enable a hacker to immediately start downloading data from the site of his choosing, as depicted in the show. He’d then have to go on to compromise the rest of the chain.
“You’d have to create an entire path of spoofed zones to who you wanted to impersonate,” Larson said. “Your fake root zone would have to delegate to a fake TLD zone to a fake SLD zone and so on so you could finally convince someone they were going to the address that you wanted.”
“If you could somehow compromise the processes at the root, that alone doesn’t give you anything,” he said.
But the show did present a somewhat realistic description of how the ceremony rooms (located in Virginia and California, not Manhattan as seen on TV) are secured.
Among other precautions, the facilities are secured with smart cards and PINs, retina scans for ICANN staff, and have reinforced walls to prevent somebody coming in with a sledgehammer, Larson said.
Blacklist: Redemption airs on Thursday nights on NBC in the US, but I wouldn’t bother if I were you.

2 Comments Tagged: blacklist: redemption, ceremony, DNSSEC, hacking, ICANN, ksk, root, security

DENIC approved as ICANN escrow agent

German ccTLD registry DENIC has been given ICANN approval to provide data escrow services to registrars.
It becomes the seventh company to receive this accreditation, the second in Europe after the UK’s NCC Group.
The company said it signed its ICANN contract and first registrar, Global Village, at the ICANN meeting in Copenhagen last week.
DENIC said the ICANN contract is unique in that it is governed by German or Swiss law, rather than Californian.
It also said that it is in compliance with European Union data protection legislation, which is much stricter than the US equivalent, for the first time.
The deal with ICANN does not extend to data escrow services for gTLD registries, but DENIC said it is working on such a deal.
All registrars are required by their ICANN accreditation to escrow registrant data, to protect customers from catastrophic business failures or de-accreditation.

2 Comments Tagged: denic, escrow, global village, ICANN

.feedback gTLD in breach of contract after big brand “fraud” claims

ICANN has slapped .feedback operator Top Level Spectrum with a contract breach notice after a huge complaint about alleged fraud filed by a gang of big brands.
The company becomes the third new gTLD to be hit by a breach notice, and the first to receive one as a result of losing a Public Interest Commitments Dispute Resolution Process case.
While TLS dodged the “fraud” charges on a technicality, the breach is arguably the most serious found by ICANN in a new gTLD registry to date.
The three-person PICDRP panel found TLS was in violation of the following commitment from its registry agreement:

Registry Operator will operate the TLD in a transparent manner consistent with general principles of openness and non-discrimination by establishing, publishing and adhering to clear registration policies.

But TLS dodged the more serious charges of “fraudulent” behavior, which it denied, largely on the technicality that its PICs only require it to bar its registrants from such behavior.
There’s nothing in the PICs preventing the registry from behaving fraudulently, so the PICDRP panel declined to rule on those allegations, saying only that they “may be actionable in another forum”.
The complainants, which filed their 1,800-page complaint in October, were MarkMonitor and a bunch of its clients, including Adobe, American Apparel, Best Buy, Facebook, Levi and Verizon.
They’d claimed among other things that 70% of .feedback domains were trademarked names actually registered by the registry, and that TLS had stuffed each site with reviews either paid for or scraped from services such as Yelp!.
They claimed that Free.Feedback, a free domains service hosted by an affiliated entity, had been set up to auto-populate Whois records with the names of brand owners (or whoever owned the matching .com domain) even when the registrant was not the brand owner.
This resulted in brand owners receiving “phishing” emails related to domains they’d never registered, the complainants stated.
TLS denied all all the allegations of fraud, but the PICDRP panel wound up not ruling on many of them anyway, stating:

the Panel finds that Respondent’s Registry Operator Agreement contains no covenant by the Respondent to not engage in fraudulent and deceptive practices.

The only violations it found related to the transparency of .feedback’s launch policies.
The panel found that TLS had not given 90 days notice of policy changes and had not made its unusual pricing model (which included an extra fee for domains that did not resolve to live sites) transparent.
The registry had a number of unusual launch programs, which I outlined in December 2015 but which were apparently not adequately communicated to registrars and registrants.
The panel also found that Free.Feedback had failed to verify the email addresses of registrants and had failed to make it easy for trademark owners to cancel domains registered in their names without their consent.
Finally, it also found that TLS had registered a bunch of trademark-match domain names to itself during the .feedback sunrise period:

self-allocating or reserving domains that correspond to the trademark owners’ marks during the Sunrise period constitutes a failure by the Respondent to adhere to Clause 6 of its Registration and Launch policies, versions 1 and 2. According to the policies, Sunrise period is exclusively reserved for trademark owners

TLS, in its defense, denied that it had self-allocated these names and told the panel it had “accidentally” released them into the zone file temporarily.
As a result of the PIC breaches found by the panel, ICANN Compliance has issued a breach notice (pdf) against the company.
To cure the breach, and avoid having its Registry Agreement taken away, TLD has to, by April 15:

Provide ICANN with corrective and preventative action(s), including implementation dates and milestones, to ensure that Top Level Spectrum will operate the TLD feedback in a transparent manner consistent with general principles of openness and nondiscrimination by establishing, publishing and adhering to clear registration policies;

That seems to me like it’s probably vague enough to go either way, but I’d be surprised if TLS doesn’t manage to comply.

1 Comment Tagged: .feedback, breach, compliance, free.feedback, ICANN, markmonitor, new gTLDs, tls, top level spectrum

Government anger over two-letter domains

ICANN’s Governmental Advisory Committee has clashed with its board of directors over the lack of protections for two-letter domain names that match country codes.
The board has now formally been urged to reconsider its policy to allow registries to sell these names, after angry comments and threats from some GAC members.
Governments from Brazil, Iran, China and the European Union are among at least 10 angered that the names are either not adequately protected or only available for exorbitant prices,
The debate got very heated at ICANN 58 here in Copenhagen on Wednesday morning, during a public session between the GAC and the board, with Iran’s outspoken GAC rep, Kavous Arasteh, almost yelling at Chris Disspain, the board’s point man on the topic.
Arasteh even threatened to take his concerns, if not addressed, to the International Telecommunications Union when it convenes for a plenipotentiary next year.
“Your position is not acceptable. Rejected categorically,” he said.
“The multistakeholder process was not easily accepted by many countries. Still people have difficulty with that,” he said. “We have a plenipotentiary coming in 2018, and we will raise the issue if the matter is not resolved… It is not always commercial, government also has some powers, and we exercise our powers.”
Invoking the ITU is a way to turn a relatively trivial disagreement into an existential threat to ICANN, a typical negotiating tactic of governments that don’t get what they want from ICANN.
The relatively trivial disagreement in this case is ICANN’s decision to allow gTLD registries to release all previously reserved two-letter strings.
In November, ICANN approved a policy that released all two-letter strings on the proviso that registrants have to assert that they will not pass themselves off as affiliated with the countries concerned.
Registries also were given a duty to investigate — but not necessarily act upon — governmental complaints about confusion.
ICANN thinks that this policy is perfectly compliant with the GAC’s latest official advice, supplied following the Helsinki meeting last June, which asked ICANN to:

urge the relevant Registry or the Registrar to engage with the relevant GAC members when a risk is identified in order to come to an agreement on how to manage it or to have a third-party assessment of the situation if the name is already registered.

Disspain patiently pointed out during Wednesday’s session that governments have no legal rights to their ccTLD strings at the second level, and that most of the complaining governments don’t even protect two-letter strings in their own ccTLDs.
But some GAC reps disagreed.
China stated (via the official interpreter): “We believe the board doesn’t have the right or the mandate to decide whether GAC members have the right over two-character domain names.”
While no government spoke in favor of the ICANN policy on Wednesday, the complaining governments do appear to be in a minority of the GAC.
Despite this, they seem to have been effective in swaying fellow committee members to issue some stern new advice. The Copenhagen communique, published last night (pdf), reads:

a. The GAC advises the ICANN Board to:
I. Take into account the serious concerns expressed by some GAC Members as contained in previous GAC Advice
II. Engage with concerned governments by the next ICANN meeting to resolve those concerns.
III. Immediately explore measures to find a satisfactory solution of the matter to meet the concerns of these countries before being further aggravated.
IV. Provide clarification of the decision-making process and of the rationale for the November 2016 resolution, particularly in regard to consideration of the GAC advice, timing and level of support for this resolution.

ICANN is being compelled to retroactively revisit a policy that was issued in compliance with previous GAC advice, it seems.
The next ICANN meeting is being held in Johannesburg in June, so the clock is ticking.
Two-letter domains are valuable properties even in new gTLDs. With each expected to sell for thousands, two-letter names are likely to be a multimillion dollar windfall for even moderately sized portfolio registries.

1 Comment Tagged: gac, ICANN, icann 58, new gTLDs, reserved, two-character, two-letter