For only the second time, ICANN tells the GAC to get stuffed

ICANN’s board of directors has decided to formally disagree with its Governmental Advisory Committee for what I believe is only the second time in the organization’s history.
In a letter to new GAC chair Thomas Schneider today, ICANN chair Steve Crocker took issue with the fact that the GAC recently advised the board to cut the GNSO from a policy-making decision.
The letter kick-starts a formal “Consultation Procedure” in which the board and GAC try to reconcile their differences.
It’s only the second time, I believe, that this kind of procedure — which has been alluded to in the ICANN bylaws since the early days of the organization — has been invoked by the board.
The first time was in 2010, when the board initiated a consultation with the GAC when they disagreed about approval of the .xxx gTLD.
It was all a bit slapdash back then, but the procedure has since been formalized somewhat into a seven-step process that Crocker outlined in an attachment to his letter (pdf) today.
The actual substance of the disagreement is a bit “inside baseball”, relating to the long-running (embarrassing, time-wasting) saga over protection for Red Cross/Red Crescent names in new gTLDs.
Back in June at the ICANN 50 public meeting in London, the GAC issued advice stating:

the protections due to the Red Cross and Red Crescent terms and names should not be subjected to, or conditioned upon, a policy development process

A Policy Development Process is the mechanism through which the multi-stakeholder GNSO creates new ICANN policies. Generally, a PDP takes a really long time.
The GNSO had already finished a PDP that granted protection to the names of the Red Cross and Red Crescent in multiple scripts across all new gTLDs, but the GAC suddenly decided earlier this year that it wanted the names of 189 national Red Cross organizations protected too.
And it wasn’t prepared to wait for another PDP to get it.
So, in its haste to get its changing RC/RC demands met by ICANN, the GAC basically told ICANN’s board to ignore the GNSO.
That was obviously totally uncool — a slap in the face for the rest of the ICANN community and a bit of an admission that the GAC doesn’t like to play nicely in a multi-stakeholder context.
But it would also be, Crocker told Schneider today, a violation of ICANN’s bylaws:

The Board has concerns about the advice in the London Communiqué because it appears to be inconsistent with the framework established in the Bylaws granting the GNSO authority to recommend consensus policies to the Board, and the Board to appropriately act upon policies developed through the bottom-up consensus policy developed by the GNSO.

Now that Crocker has formally initiated the Consultation Procedure, the process now calls for a series of written and face-to-face interactions that could last as long as six months.
While the GAC may not be getting the speedy resolution it so wanted, the ICANN board’s New gTLD Program Committee has nevertheless already voted to give the Red Cross and Red Crescent the additional protections the GAC wanted, albeit only on a temporary basis.

ICANN may cancel Morocco meeting over Ebola fear

ICANN may cancel its forthcoming meeting in Marrakech, Morocco, due to fears about the spread of Ebola in Africa.
The organization issued a statement last night, after local reports said the decision to cancel had already been made:

Following Morocco’s recent request to postpone the Africa Cup of Nations football tournament because of possible African travel restrictions, ICANN is in active and ongoing discussions with our ICANN 52 Marrakech hosts.
ICANN is considering postponing the meeting in Marrakech scheduled for 8-12 February, 2015 as the likelihood of travel restrictions being imposed on nationals from African countries would reduce participation in the meeting. ICANN’s multistakeholder, bottom up model relies on the broad, active participation of communities across geography and society.
ICANN staff is working closely with the ICANN Board and its Community representatives.
No decision has been taken yet, however ICANN understands the importance of providing timely updates and path forward on the status and location of ICANN 52.

Citing an unnamed ICANN source, Le360 reported on Saturday that ICANN 52 had been canceled due to the Moroccan government’s reluctance to host large international gatherings.
While Morocco is not affected by the current Ebola outbreak — which has infected over 10,000 people thousands of kilometers away, mainly in Sierra Leone, Guinea and Liberia — there are fears that major international events could bring the virus into the country.
The government has been urging the Confederation of African Football to postpone the Africa Cup of Nations, a football tournament due to take place January 17 to February 8.
The ICANN meeting in Marrakech is scheduled for February 8 to 12.

“Send registrars to jail!”, ICANN hears

ICANN is ramping up its focus on contractual compliance in the midst of calls for domain industry offenders to “go to jail”.
CEO Fadi Chehade yesterday revealed that he has has promoted chief contracting counsel Allen Grogan to the newly created role of chief contract compliance officer.
Grogan, who Chehade has worked with off and on since 1991, will report directly to him. Maguy Serad, who has been heading compliance under Chehade for the last couple of years, will now report to Grogan.
In a session with the GNSO Council at the ICANN 51 public meeting in Los Angeles yesterday, Chehade said the appointment was part of a new “strategic, analytical” approach to compliance.
It was hinted that the compliance focus may form part of Chehade’s address at the formal opening ceremony of ICANN 51 later today.
Ron Andruff of the Business Constituency made the “jail” comments in response.
“We need to see action, we need to see teeth,” he said. “We never see any really strong action taken and it’s time we did. It’s time we saw people go to jail for doing things, lose their contracts for doing things.”
“We’ve lived through 15 years of ICANN with all manner of transgressions, some very serious ones, but they all get slid off to the side and there’s never any mention of it,” he said.
“Should someone be the recipient of extremely strong actions — losing their contract, being thrown out the community — that would send a signal,” he said.
Andruff appeared to be relating comments made by the Intellectual Property Constituency’s Kristina Rosette, at a private Commercial Stakeholders Group meeting earlier that day.
However, Rosette was quick to take to Twitter to deny she’d said anything about jail time.

Um, I never said anything about people going to jail for compliance breaches. Yikes.

— Kristina Rosette (@kristinarosette) October 12, 2014

Chehade, in reply to Andruff, agreed with the need for action but clarified what he plans to do.
“It doesn’t mean to create a police force, that’s not what we need,” he said. “What we need is thoughtful, analytical analysis.”
“It doesn’t mean we’re going to take the job of all the global consumer protection agencies,” he said earlier in the session.
The notion of ICANN having the power to directly jail somebody is of course laughable — all of its power comes from its contracts with registrars and registries.
However, it’s not beyond the bounds of possibility that ICANN could refer registrars to law enforcement should it come across suspected illegality in the course of its compliance investigations.
ICANN Compliance currently employs 21 people and deals with 5,000 complaints per month, Chehade said.
In the last year, the number of breach, suspension and termination notices against registrars has been on the increase.
Notably, last November a registrar owned by “spam king” Scott Richter was terminated. Notorious domain “slammer” NameJuice faces possible termination this Friday based on a July suspension notice.

.nz second-level names now available

The New Zealand Domain Name Commission has started making second-level domains under .nz available for the first time.
Like .uk, which opened up the second level this year, .nz names have previously only been available at the third level, under .co.nz, .net.nz and over a dozen other extensions.
But from this week, existing registrants will be able to register the shorter version of their name via their choice of registrar.
Registry fees are the same as under existing .nz SLDs, while a two-year reservation is free.
The priority period for existing registrants runs through March 30 next year. After that, .nz will open for first-come first-served general availability.
People who first registered their names between May 30 2012 and February 11 2014 — when the DNC was considering the second-level liberalization — get automatic rights to their names.
But for names registered before May 30 2012 there’s the possibility of conflicts — for example between the owners of matching .co.nz and .org.nz names.
In those cases, either party can either give up their rights, claim their rights, or demand that the .nz name not be registered to anyone.
It seems that while the DNC may offer a reconciliation service for conflicted registrants, any registrant of a 3LD registered before May 2012 will be able to dig their heels in and prevent the matching SLD being registered.
There were 551,024 domains across all .nz SLDs at the end of August.

Second new gTLD round “possible” but not “probable” in 2016

If there are any companies clamoring to get on the new gTLD bandwagon, they’ve got some waiting to do.
Based on a sketchy timetable published by ICANN this week, it seems unlikely that a second application round will open before 2017, and even that might be optimistic.
While ICANN said that “based on current estimates, a subsequent application round is not expected to launch until 2016 at the earliest”, that date seems unlikely even to senior ICANN staffers.
“The possibility exists,” ICANN vice president Cyrus Namazi told DI, “but the probability, from my perspective, is not that high when you think about all the pieces that have to come together.”
Here’s an ICANN graphic illustrating these pieces:

As you can see, the two biggest time-eaters on the road-map, pushing it into 2017, are a GNSO Policy Development Process (green) and the Affirmation of Commitments Review (yellow).
The timetable envisages the PDP, which will focus on what changes need to be made to the program, lasting two and a half years, starting in the first quarter 2015 and running until mid-2017.
That could be a realistic time-frame, but the GNSO has been known to work quicker.
An ICANN study in 2012 found that 263 days is the absolute minimum amount of time a PDP has to last from start to finish, but 620 days — one year and nine months — is the average.
So the GNSO could, conceivably, wrap up in late 2016 rather than mid-2017. It will depend on how cooperative everybody is feeling and how tricky it is to find consensus on the issues.
The AoC review, which will focus on “competition, consumer trust and consumer choice” is a bit harder to gauge.
The 2009 Affirmation of Commitments is ICANN’s deal with the US government that gives it some of its authority over the DNS. On the review, it states:

If and when new gTLDs (whether in ASCII or other language character sets) have been in operation for one year, ICANN will organize a review that will examine the extent to which the introduction or expansion of gTLDs has promoted competition, consumer trust and consumer choice, as well as effectiveness of (a) the application and evaluation process, and (b) safeguards put in place to mitigate issues involved in the introduction or expansion.

The AoC does not specify how long the review must last, just when it must begin, though it does say the ICANN board must react to it within six months.
That six-month window is a maximum, however, not a minimum. The board could easily take action on the review’s findings in a month or less.
ICANN’s timeline anticipates the review itself taking a year, starting in Q3 2015 and broken down like this:

Based on the timelines of previous Review Team processes, a rough estimate for this process is that the convening of the team occurs across 3-5 months, a draft report is issued within 6-9 months, and a final report is issued within 3-6 months from the draft.

Working from these estimates, it seems that the review could in fact take anywhere from 12 to 20 months. That would mean a final report would be delivered between September 2016 and July 2017.
If the review and board consideration of its report take the longest amount of time permitted or envisaged, the AoC process might not complete until early 2018, a little over three years from now.
Clearly there are a lot of variables to consider here.
Namazi is probably on safe ground by urging caution over the hypothetical launch of a second round in 2016.
Given than new gTLD evaluations were always seen as a “rolling” process, one of the things that the GNSO surely needs to look into is a mechanism to reduce the delay between rounds.

Which made more money — .website, .press or .host?

Radix Registry launched its first three new gTLDs yesterday, and the first day’s numbers make an interesting case study in how difficult it can be to judge the health of a TLD.
Based on zone file numbers, .website was the clear winner. It had 6,340 names in its zone at the end of the day, compared to .host’s 778 and .press’s 801.
There’s clearly more demand for .website names right now.
But which made the most money? That’s actually a lot harder to figure out.
To make those calculations accurately, you’d need to know a) Radix’s base registry fee, b) the promotional discounts it applied for the launch c) which premium names sold and d) for how much.
None of that information is publicly available.
If we were to use Go Daddy’s base retail pricing as a proxy guide, .host was hypothetically the biggest money-spinner yesterday. At $129.99 a year, it would have made $101,132.
Because .website only costs $14.99 at Go Daddy, it would have only made $95,037, even though it sold thousands more names.
But Radix offered registrars what appears to be steep discounts for the launch. Go Daddy marked down its .host names from $129.99 to $49.99. That would make revenue of $38,892, less than half of .website.
With the discounts in mind, .host didn’t have as good a day from a cash-flow perspective as .website, but it arguably looks healthier from a long-term revenue perspective.
That’s all based on the snapshot of today’s zone files and an obviously incorrect assumption that Go Daddy sold all the names, of course.
Complicating matters further are the premium names.
Radix has priced a lot of its names with premium renewal fees and Radix business head Sandeep Ramchandani said that the company sold five five-figure premium names across all three gTLDs.
Given the relatively small amount of money we’re talking about, those five sales would have significantly impacted the three new gTLD’s relative revenue.

.vegas beats all six new M+M gTLDs combined

Minds + Machines’ first day of general availability for its first six wholly owned new gTLDs has produced some very disappointing numbers.
The company managed to net just 1,694 new domains across .country, .cooking, .vodka, .rodeo, .horse and .fishing combined yesterday, according to this morning’s zone files.
It has fewer than 2,000 names across all six zones.
Meanwhile, .vegas, which also went to GA yesterday, managed to net 2,933 new domains, ending the day at 3,903.
Here’s a table of M+M’s performance over its first seven or eight hours of GA, which began at 1600 UTC yesterday.
[table id=31 /]
Assuming the zone files are fresh, it’s a poor first day for the company whichever way you look at it, especially given that M+M has been accepting pre-registrations in its TLDs since November 2013.
As well as being vertically integrated, M+M has about 80 third-party registrars on board to sell its names, including the largest.
Afilias’ .organic, which also went to GA yesterday, shows just one new registration today.
However, this can be attributed to the fact that registrants need to submit credentials for manual verification before their new domains are allowed to go live in the zone file.

Russian hackers breaking in to NameCheap accounts

If you have an account at NameCheap, now might be a good time to think about changing your password.
According to the registrar, hackers based in Russia are using a haul of a reported 4.5 billion username/password combinations to attempt to break into its customers’ accounts.
Some attempts have been successful, NameCheap warned.
The attackers are using credentials stolen from third-party sources in a large-scale, automated attempt to log in to user accounts, disguised as regular users, the company said in a blog post.
NameCheap said:

The vast majority of these login attempts have been unsuccessful as the data is incorrect or old and passwords have been changed. As a precaution, we are aggressively blocking the IP addresses that appear to be logging in with the stolen password data. We are also logging these IP addresses and will be exporting blocking rules across our network to completely eliminate access to any Namecheap system or service, as well as making this data available to law enforcement.
While the vast majority of these logins are unsuccessful, some have been successful. To combat this, we’ve temporarily secured the Namecheap accounts that have been affected and are currently contacting customers involved requesting they improve the security for these accounts.

Affected users have been emailed, the company said.
NameCheap suspects the attack is linked to a reported cache of 1.2 billion unique username/password combinations amassed by a hacker group from databases vulnerable to SQL injection.
The registrar pointed out that its own systems haven’t been hacked. Customers should only be vulnerable if they use the same username and password at NameCheap as they use on other sites.

Panel slaps ICANN in .africa case

A panel of arbitrators had some stern words for ICANN as it handed controversial .africa gTLD applicant DotConnectAfrica another win in its Independent Review Process case.
In a 33-page procedural ruling (pdf) published by ICANN late Friday, the IRP panel disagreed with ICANN’s lawyers on almost every argument they made, siding with DCA instead.
The panel strongly indicated that it believes ICANN has attempted to render the IRP toothless, after losing the first such case against ICM Registry a few years ago.
The ruling means that ICANN’s top executives and board may have to face hostile cross-examination by DCA lawyers, rather than simply filing written statements with the panel.
It also means that whatever the IRP panel ultimately decides will in all likelihood be binding on ICANN.
DCA filed the IRP with the International Center for Dispute resolution after ICANN, accepting Governmental Advisory Committee advice, rejected the company’s application for .africa.
The ICDR panel has not yet ruled on the merits of the case — personally, I don’t think DCA has a leg to stand on — but last week’s ruling is certainly embarrassing for ICANN.
On a number of counts, ICANN tried to wriggle out of its accountability responsibilities, the ruling suggests.
Primarily, ICANN lawyers had argued that the eventual outcome of the IRP case should be advisory, rather than binding, but the panel disagreed.
The panel noted that new gTLD applicants sign away their rights to sue when they apply for a gTLD, meaning IRP is their last form of appeal against rejection.
It also called into question ICANN’s ability to police itself without a binding decision from an independent third party, pointing to previously reported accountability problems (my emphasis):

The need for a compulsory remedy is concretely shown by ICANN’s longstanding failure to implement the provision of the Bylaws and Supplementary Procedures requiring the creation of a standing panel. ICANN has offered no explanation for this failure, which evidences that a self-policing regime at ICANN is insufficient. The failure to create a standing panel has consequences, as this case shows, delaying the processing of DCA Trust’s claim, and also prejudicing the interest of a competing .AFRICA applicant.
Moreover, assuming for the sake of argument that it is acceptable for ICANN to adopt a remedial scheme with no teeth, the Panel is of the opinion that, at a minimum, the IRP should forthrightly explain and acknowledge that the process is merely advisory. This would at least let parties know before embarking on a potentially expensive process that a victory before the IRP panel may be ignored by ICANN.

The decision is the opposite of what the IRP panel found in the ICM Registry case, which was ruled to be “non-binding” in nature.
While deciding that its own eventual ruling will be precedential, the panel said it did not have to follow the precedent from the ICM case, due to changes made to the IRP procedure in the meantime.
ICANN had also argued against the idea of witnesses being cross-examined, but the panel again disagreed, saying that both parties will have the opportunity “to challenge and test the veracity of statements made by witnesses”.
The hearing will be conducted by video ink, which could reduce costs somewhat, but it’s not quite as streamlined as ICANN was looking for.
Not only will ICANN’s top people face a grilling by DCA’s lawyers, but ICANN’s lawyers will, it seems, get a chance to put DCA boss Sophia Bekele on the stand.
I’d pay good money for a ticket to that hearing.

The top 35 most-popular new gTLD sites

New gTLDs have been on the market for months now, and the slow process of building out sites is underway.
As regular readers and DI PRO subscribers know, one way DI tracks the popularity of domain names, and therefore their corresponding TLDs, is using Alexa rankings.
These scores are not perfect, but they’re a reasonable way to highlight which new gTLD domain names are getting traffic from internet users.
There are currently 635 new gTLD domains in Alexa’s top one million most-trafficked sites, up from just 10 when I checked almost six months ago, February 19.
Only 35 of those have a ranking better than 100,000.
I visited each in turn today to determine to what use the registrants have put their names.
In this top 35, I found two instances of apparent malware distribution and one instance of possible cybersquatting. Four returned errors. One (www.link) is a blocked name collision name.
Notably, controversial BitTorrent index The Pirate Bay, which has been TLD-hopping for many months and recently got kicked out of .guru, seems to have found a home in .uno.
Only one of the domains redirects to a domain in a different TLD.
One (gen.xyz) is a new gTLD registry’s official homepage.
The remainder represent a broad cross section of regular internet usage: blogs, tools, photos, sport, porn, get-rich-quick schemes, forums, file-hosting, and so on and so forth.
Varying degrees of professionalism can be found on these sites. Some are very pretty, others very ugly.
There’s even one site on the list that appears to be a legitimate corporate home page. On reflection, no it isn’t. It’s a Get-Rich-Quick site.
These are my results, make of them what you will.
[table id=30 /]