ICANN hires new Ombuds from WIPO

ICANN has named its new Ombuds, who will take over the role vacated by Herb Waye almost a year ago.

She’s Liz Field, a HR specialist who spent most of her career at Amnesty International but most recently has been working for WIPO as an independent outside consultant, according to her LinkedIn.

After almost two decades at Amnesty, Field worked for two years as an anti-harassment coordinator for the UK government’s Foreign, Commonwealth and Development Office.

Field, who says she also speaks French and Spanish, will take over from complaints officer Krista Papac, who has been filling in for Waye since his resignation.

ICANN said that 36 people applied for the job — 22 men and 14 women. The Ombuds Search Committee interviewed five of them and two candidates were interviewed by the full board of directors.

The genders of the applicants is relevant in this case. Some female ICANN community members have previously said they would be reluctant to make gender-related complaints, such as sexual harassment, to a male Ombuds.

ICANN chair Tripti Sinha earlier this week linked the hiring of the new Ombuds to a strengthened anti-harassment policy that the board hopes to shortly introduce. Field seems to have the CV to support such a goal.

The Ombuds role is to hear complaints about unfair treatment and unpleasant behavior in and from the Org and community.

The job occupies a unique position in ICANN’s structure, answering directly to the board rather than the Org’s management hierarchy. Only four people have occupied the role since it was created 20 year ago.

Comment Tagged: ICANN, ombuds

Big twist as ICANN bans new gTLD auctions

ICANN is to ban new gTLD applicants from paying each other off if they apply for the same strings, removing a business model that saw tens of millions of dollars change hands in the 2012 application round.

But, in a twist, applicants will be able to submit second-choice strings along with their main application, allowing them to switch if they find themselves in contention.

While ICANN’s board of directors has yet to pass a resolution on private resolution in forthcoming application rounds, chair Tripti Sinha said in a letter to the GNSO Council (pdf) and blog post that there’s agreement on three principles.

“Private resolution of contention sets will not be permitted during the Next Round,” Sinha told the Council. The idea of permitting joint-venture resolution was also ruled out as impractical and open to gaming.

This of course means that where contention sets do occur, they’ll be resolved with a “last resort” auction where ICANN gets all the cash from the winning bidder.

Funds raised this way in the last round, along with a decade’s worth of investment interest, have been used to replenish ICANN’s reserve fund, to fund the current Grant Program, and may be shortly used to subsidize the Applicant Support Program.

Second, applicants will be able to submit at least one alternate string with their applications, allowing them to avoid a contention set and last resort auction.

This potentially makes the cost of acquiring a gTLD cheaper for the applicant while increasing the number of gTLDs that go live. ICANN might also have to issue fewer refunds for withdrawn applications.

ICANN thinks this measure might make gTLDs more affordable for less well-resourced applicants from the Global South, where ICANN is keen to diversify the industry, although the applicants may not get their first-choice strings.

Applicants would only be able to switch to an alternate string, which they will have to have pre-selected, if doing so would not create a new contention set or make the applicant join a different existing contention set.

They’d also only be able avoid a contention set of exact-match strings, and not sets subsequently created by the String Similarity Review or String Confusion Objection results.

So, to take an example from 2012, any of the seven .hotels applicants would have been able to switch to a second-choice string immediately after Reveal Day, but not after the similarity review placed them in contention with .hoteis.

The third point of agreement from the board is that the last resort auctions should keep the ascending-clock second-price method used for the 2012 round, deciding against lotteries or the Vickrey auction method.

The ascending clock method sees bids filed in rounds until all bidders but one had dropped out. The last applicant standing then pays ICANN the last price offered by the runner-up.

A Vickrey auction would have seen applicants submit their maximum bids at the time of application, not knowing who they were bidding against. Lotteries are legally problematic under California gambling law.

Sinha said the board intends to pass a resolution embodying these three principles “in the coming weeks”.

This is going to create some extra work for the GNSO, as ruling out joint ventures as a means to private resolution goes against community policy recommendations (and the board’s adoption of those recommendations).

The GNSO Council is set to discuss Sinha’s letter at its regular monthly meeting this Thursday.

4 Comments Tagged: auctions, contention, ICANN, new gTLDs, next round

ICANN to “strengthen” harassment rules as it picks another homophobic meeting host

ICANN has revealed it is to “strengthen” its anti-harassment policy, but the announcement came the same day as it picked another public meeting host country where being gay can lead to jail time.

“The Board Anti-Harassment Working Group has recently worked to evaluate and strengthen the ICANN Community Anti-Harassment Policy,” chair Tripti Sinha posted over the weekend. “We do not accept any form of harassment, and we must continually seek opportunities to improve.”

The draft revisions shortly follow the revelations of a sexual harassment legal action by a veteran former staffer, at least the third such instance in the last five years I’m aware of.

The current Community Anti-Harassment Policy is already pretty broad, covering a wide range of protected characteristics (from race to marital status) and behaviors (from groping to dirty jokes).

The proposed revisions will be posted for public comment before ICANN’s Annual General Meeting in Istanbul this November, Sinha wrote.

It’s not illegal to be gay in Türkiye, but it is in Muscat, Oman, where ICANN announced just hours before the anti-harassment post it plans to hold its 2025 AGM.

Men and women can get three years imprisonment for gay sex or “cross-dressing” there, according to the Human Dignity Trust. It’s also technically illegal for unmarried straight couples to share a hotel room, according to the UK government.

While the law in Oman might not be rabidly enforced, it’s understandable that some LGBT members of the ICANN community could be made to feel nervous and adjust their travel plans accordingly — things like traveling with a same-sex partner, hooking up with someone, or having Grindr on your phone might carry additional risk.

Oman is just one of many countries with homophobic laws on the books that ICANN has invited its community members to attend over the years.

Looking back over just the last 10 years of meetings, ICANN has been to Malaysia (in 2022), the UAE, and Morocco (twice), where gay sex acts get you prison time. It’s also been to Singapore (twice) and India, which have since decriminalized homosexuality.

It’s baffling to me that ICANN can lecture its community about “microagressions” and yet also routinely invites its not-insignificant contingent of gay community members to return to the closet for a week, under pain of arrest.

4 Comments Tagged: harassment, ICANN

.my global relaunch starts slowly despite cheapo prices

Malaysia’s .my ccTLD has so far failed to attract the hoped-for thousands of new registrations since it relaunched to a global audience a few months ago, according to registry statistics.

MYNIC puts the total number of .my domains, including third-levels under the likes of .com.my and .biz.my, at 313,588 at the end of August, barely 3,500 above the end of May number.

Second-level domains directly under .my grew by about 3,000 over the same period to end August at 149,273.

June was when .my was due to go to general availability with scrapped local presence restrictions and a worldwide registrar channel under partnership with Internet Naming Co and Tucows.

Previously, .my domains were only available to Malaysia-based entities. Third-level domains continue to be available only to Malaysians.

MYNIC told the local Malaysian press in April, before the global launch was announced, that it hoped to hit the 400,000-domains mark by the end of the year. Its best monthly number so far was about 341,000, back in June 2018.

There’s not a great deal of retail registrar coverage outside of Asia right now, judging by the registry’s web site, but those registrars actually selling it are selling it cheap — around the $2 mark for the first year at Spaceship and Namecheap.

Comment Tagged: .my, inco, internet naming co, mynic, tucows

Hackers break .mobi after Whois domain expires

It’s probably a bad idea to let a critical infrastructure domain expire, even if you don’t use it any more, as Identity Digital seems to be discovering this week.

White-hat hackers at WatchTowr today published research showing how they managed to undermine SSL security in the entire .mobi TLD, by registering an expired domain previously used as the registry’s Whois server.

Identity Digital, which now runs .mobi after a series of acquisitions, originally used whois.dotmobiregistry.net for its Whois server, but this later changed to whois.nic.mobi and the original domain expired last December.

WatchTowr spotted this, registered the name, and set up a Whois server there, which went on to receive 2.5 million queries from 135,000 systems in less than a week.

Sources of the queries included security tools such as VirusTotal and URLSCAN, which apparently hadn’t updated the hard-coded Whois URL list in their software, the researchers said.

GoDaddy and Domain.com were among the registrars whose Whois tools were sending queries to the outdated URL, WatchTowr found.

Incredibly, so was Name.com, which is owned by Identity Digital, the actual .mobi registry.

More worryingly, it seems some Certificate Authorities, responsible for issuing the digital certificates that make SSL work, were also using the old Whois address to verify domain ownership.

WatchTowr says it was possible to obtain a cert for microsoft.mobi by providing its own email address in a phony Whois record served up by its bogus Whois server.

“Effectively, we had inadvertently undermined the CA process for the entire .mobi TLD,” the researchers wrote.

They said they would have also been able to send malicious code payloads to vulnerable Whois clients.

While WatchTowr’s research doesn’t mention ICANN, it might be worth noting that the change from whois.dotmobiregistry.net to whois.nic.mobi is very probably a result of .mobi’s transition to a standardized gTLD registry contract, which requires all registries to use the whois.nic.[TLD] format for their Whois servers.

As a pre-2012 gTLD, .mobi did not have this requirement until it signed a new Registry Agreement in 2017. There are still some legacy gTLDs, such as .post, that have not migrated to the new standard URL format.

The WatchTowr research, with a plentiful side order of cockiness, can be read in full here.

1 Comment Tagged: .mobi, domain.com, godaddy, identity digital, name.com, security, watchtowr

The new gTLD next, next and next round

“The goal is for the next application round to begin within one year of the close of the application submission period for the initial round.”

Believe it or not, that sentence appears in the new gTLD program’s Applicant Guidebook that ICANN published in June 2012, 12 years of seemingly interminable review and revision ago.

Ah, 2012…

Obama was reelected for his second term. The final of the Euros took place in Kyiv. Gangnam Style topped the charts. Harvey Weinstein won an Emmy. Microsoft released Windows 8. Jedward sang for Ireland in Eurovision. Everyone had an opinion on Joseph Kony and Grumpy Cat.

Naturally enough, a lot of people aren’t very happy about the massive delay between the close of the last application window and the opening of the next one, currently penciled in for the second quarter of 2026.

So the community has done something about it, placing language in the draft of the next AGB that commits ICANN to open subsequent, post-2026 rounds without all the mindless navel-gazing and fannying around.

The intent is pretty clear — make application rounds more frequent and more predictable — but there’s still plenty of wiggle-room for ICANN to exploit if it wants to delay things yet again.

Here’s what the proposed AGB language (pdf) says:

ICANN works towards future rounds of new gTLDs taking place at regular and predictable intervals without indeterminable periods of review and, absent extraordinary circumstances, application procedures will take place without pause. A new round may be initiated even if steps related to application processing and delegation from previous application rounds have not been fully completed.

The ICANN Board will determine the timing of the initiation of a subsequent application round of the New gTLD Program as soon as feasible, but preferably not later than the second Board meeting after all the following conditions have been met:

1. The list of applied-for strings for the ongoing round has been confirmed and the window for string change requests has closed. This will provide applicants in a subsequent round with an understanding of which strings can be applied for.

2. ICANN org has not encountered significant barriers to its ability to receive and process a new batch of applications.

Absent extraordinary circumstances, future reviews and/or policy development processes, including the next Competition, Consumer Choice & Consumer Trust (CCT) Review, should take place independent of subsequent application rounds. In other words, future reviews and/or policy development processes must not stop or delay subsequent new gTLD rounds.

If the outputs of any reviews and/or policy development processes has, or could reasonably have, a material impact on the manner in which application procedures are conducted, such changes will apply to the opening of the application round subsequent to the adoption of the relevant recommendations by the ICANN Board. Once adopted by the Board, the implementation of that policy or review recommendation(s) will then become a dependency for the timing of that subsequent round of applications.

The language is among several draft sections of the 2026 AGB that ICANN this week opened for public comment.

An intriguing question now arises: will this commitment on subsequent round timing have any impact on the number of applications submitted in 2026?

People in the know tell us that there’s a decade-long backlog of wannabe applicants, particularly in the dot-brand world, but will any of them decide to slow down their ambitions if they know they only have an extra year or two to wait for another round?

Or will they trust ICANN’s record of delay over the somewhat flexible promises of the AGB?

It’s not just an academic question. How much applicants will ultimately pay ICANN in application fees, after rebates, will depend on how may applications are filed.

3 Comments Tagged: agb, ICANN, new gTLDs, next round

Squarespace gets sweetened $7.2 billion takeover offer

Squarespace looks set to be acquired by private equity firm Permira in a sweetened cash deal valuing the registrar at about $7.2 billion.

The new $46.50 per share offer is an improvement over Permira’s initial May offer of $44 and represents a 36.4% premium over Squarespace’s share price the day before the takeover way announced.

Squarespace said the deal, which values the company at about $300 million more than the May offer, has been approved by an independent committee of its board of directors and is Permira’s “best and final” offer.

Squarespace has about 10 million gTLD domains under management across two ICANN accreditations, one of which is the old Google Domains, but is perhaps best known for its web site building services.

The company has previously said that going private will help it compete better in the small business online presence market, where it sees its competition as the likes of GoDaddy and Wix.

Comment Tagged: acquisition, permira, squarespace

ICANN hit by DDoS attack

If you noticed ICANN’s web site acting sluggishly or failing to respond at all last week, now you know why.

The site at icann.org was hit by a distributed denial of service attack on September 3 through September 4, according to a brief statement on the Org’s now-functional site.

ICANN identified a Distributed Denial of Service (DDoS) event that occurred on www.icann.org on 3 Sept. 2024. The situation was mitigated and service to ICANN’s website was restored on 4 Sept. 2024.

No additional information has yet been released on the size, duration or possible motivations behind the attack.

It’s the first security incident ICANN has judged significant enough to publicly disclose in over two years.

1 Comment Tagged: ddos, ICANN

Russia calls for ICANN to split from US

The Russian government has called on ICANN to further distance itself from US legal jurisdiction, complaining that the current war-related sanctions could prevent its companies from applying for new gTLDs.

In recent comments, Russia said that “no single state or group of states should have the right to interfere in the operation of critical Internet infrastructure and/or the activities of ICANN, including the mechanisms for legal regulation of ICANN’s operations”.

It added that it is “necessary… to prepare by the ICANN community and stakeholders proposals for measures or mechanisms that can make ICANN less dependent on one state”.

The call came in comments filed in ICANN’s public comment period on the terms and conditions of the new gTLD program’s Applicant Support Program and Registry Service Provider Evaluation Program.

The Ts&Cs contain a clause requiring applicants to abide by all US economic sanctions, such as those overseen by the Office of Foreign Assets Control, which has sanctioned Russian entities since the 2022 invasion of Ukraine.

Russia’s comment was filed late and has not been published or analysed by ICANN in the usual way. Instead, it was appended to the summary report (pdf) prepared by ICANN staff.

It’s not the only war-related beef Russia has with ICANN right now. The government has also complained (pdf) that about 400 domains registered by Russian entities, including airports and airlines, in the .aero gTLD have been suspended.

The .aero registry, aerospace industry IT service provider SITA, is headquartered in Switzerland but the contracting entity is a US-based subsidiary.

According to OFAC, domain registration services are exempt from the US sanctions. That has not stopped several domain registries and registrars ceasing business with Russians on moral grounds.

ICANN told Russia to file a complaint about SITA with its Compliance department. SITA has not yet responded to a request for comment.

Calls for ICANN to distance itself from the US have been coming for over two decades, usually from America’s opponents, and did not stop when the Org severed its formal ties with the 2016 IANA transition.

6 Comments Tagged: .aero, asp, ICANN, new gTLDs, rsp evaluation program, russia, sita

China loses over half a million domains

The Chinese ccTLD .cn shrunk by over half a million domains in the first half of the year, according to the latest semiannual report from the local registry.

There were 19,562,007 registered .cn names at the end of June, down from 20,125,764 at the end of 2023, a decline of 563,757 domains, according to the CNNIC report.

Despite the decline, .cn is still the largest ccTLD, ahead of the 17,703,602 that Germany’s DENIC (.de) reported June 30.

The dip is not surprising. Verisign has pointed to weakness in China as a reason .com’s volume has been tumbling in recent quarters.

The fact that .cn is going down too suggests the negative growth is in fact due to macroeconomic factors rather that Chinese .com registrants migrating to their local ccTLD.

Comment Tagged: cnnic