ICANN reveals 12 more data breaches

Twelve more new gTLD applicants have been found to have exploited a glitch in ICANN’s new gTLD portal to view fellow applicants’ data.
ICANN said last night that it has determined that all 12 access incidents were “inadvertent” and did not disclose personally identifiable information.
The revelation follows an investigation that started in April this year.
ICANN said in a statement:

in addition to the previous disclosures, 12 user credentials were used to access contact information from eight registry operators. Based on the information collected during the investigation it appears that contact information for registry operators was accessed inadvertently. ICANN also concluded that the exposed registry contact information does not appear to contain sensitive personally identifiable information. Each of the affected parties has been notified of the data exposure.

The glitch in question was a misconfiguration of a portal used by gTLD applicants to file and view their documents.
It was possible to use the portal’s search function to view attachments belonging to other applicants, including competing applicants for the same string.
Donuts said in June that the prices it was willing to pay at auction for gTLD string could have been inferred from the compromised data.
ICANN told compromised users in May that the only incidents of non-accidental data access could be traced to the account of Dirk Krischenowski, CEO of dotBerlin.
Krischenowski has denied any wrongdoing.
ICANN said last night that its investigation is now over.

Comment Tagged: donuts, dotberlin, glitch, ICANN, new gTLDs, portal, security

ICANN reveals $1m of not-lobbying lobbying expenses

ICANN has revealed how much it has spent so far on a few controversial professional services firms that have been accused of “lobbying” the US government on behalf of the organization.
It said today that between July 2015 and September 2015 it spent $1,070,438 on six companies providing “Education/Engagement” services related to the transition of IANA from US government oversight.
Two of the payees are consulting firms run by former high-level US officials.
One is Albright Stonebridge Group LLC, founded by Clinton-era secretary of state Madeleine Albright.
The other is Rice Hadley Gates LLC, which counts W-era officials Condoleeza Rice, Stephen Rice and Robert Gates as its principles.
The $1 million figure also includes payouts to PR firm Edelman, which has been working with ICANN for as long as I can remember, a video production company, and two other consultants.
It’s substantially less than the $2.4 million spend estimated by Kieren McCarthy, whose public-forum questions at the last two ICANN meetings and subsequent The Register article seem to be responsible for the latest disclosures.
McCarthy, in heated public clashes with ICANN CEO Fadi Chehade, had argued that these payouts were essentially “lobbying” expenses that had not been disclosed because they fall into a “loophole” in US regulations that require lobbyists to disclose their clients.
ICANN said it spent $765,829 on external lobbying services — both related to the IANA transition and not — over the same period.
Its in-house lobbyist, James Hedlund, has separately disclosed a spend of $890,000 over the period.
McCarthy had argued that ICANN was trying to hide the true extent of its lobbying, because it’s trying to make a case with US authorities for ICANN the organization that is at odds with what the community-led IANA transition process is trying to achieve.
Today’s disclosures show that ICANN spent $4,809,949 — almost half of its transition-related professional services spend — on the two law firms that have been advising the two volunteer groups developing the IANA transition proposals.
It spent a more modest $1,150,213 on its own legal advisers, Jones Day.

3 Comments Tagged: iana, ICANN, lobbying, transition

English beats Portuguese in $2.2m .hotels auction

Booking.com has won the right to operate .hotels after an auction concluded a protracted fight over the gTLD.
In an ICANN-run auction yesterday, Booking.com prevailed with a winning bid of $2.2 million.
Its sole competitors was Travel Reservations (formerly Despegar Online), which had applied for the Portuguese word .hoteis.
In 2012, a String Similarity Review panel concluded that .hotels and .hoteis look too similar to coexist, due to the likelihood of confusion between I and l in sans-serif fonts.
Neither applicant agreed with that decision, knowing that it would result in a expensive auction, and Booking.com filed a Request for Reconsideration and then, in March 2013, an Independent Review Process complaint.
After two years, it lost the IRP. But the panel said it had “legitimate concerns” about the fairness of the SSR process and ordered ICANN to pay half of its costs.
Now, Booking.com has had to fork out another $2.2 million for the string.
That’s not particularly expensive as ICANN-auctioned gTLDs go. Eight of the 13 other strings ICANN has auctioned have sold for more.
ICANN’s auction proceeds to date now stands at $63,489,127, which is being held in a separate bank account for purposes yet to be determined.

2 Comments Tagged: .hoteis, .hotels, auctions, booking.com, ICANN, new gTLDs, string confusion

How one registrar allegedly dodges ICANN Compliance

A Chinese registrar has been accused by ICANN of playing games to avoid complying with Whois policy.
In a breach notice from ICANN Compliance last week, Beijing-based 35 Technology is told that it has failed to verify Whois records as required by its accreditation agreement.
The domain in question was shoesbbalweb.com, which DomainTools’ archived screenshots show was once used to sell branded running shoes.
I understand that 35 is believed to have suspended the domain when ICANN first referred a Whois accuracy complaint to it.
It is then said to have un-suspended the domain, without any change to the Whois record, as soon as ICANN closed the complaint.
The breach notice (pdf) instructs 35 to:

Provide records and information demonstrating that 35 Technology took steps to verify and validate the Whois information of the domain name since 23 March 2015, or provide ICANN with an explanation why the domain name suspension was removed without verifying and validation Whois information

The switcheroo appears to have been brief enough that its suspended state was not recorded by DomainTools.
ICANN has a monitoring program, however, that randomly spot-checks previously complained-about domains for ongoing compliance.
The registrar, which does business at 35.com, is not tiny. It had over 450,000 domains under management, in legacy gTLDs and a handful of Chinese-script new gTLDs, at the last count.
It has until the end of the month to explain itself or risk termination.

1 Comment Tagged: 35 technology, compliance, ICANN, whois

.pro now open to all

Afilias today made the .pro gTLD available to anyone, regardless of their professional qualifications.
The previously restricted TLD was able to do so as a result of its six-week-old contract with ICANN, which loosened many of the conditions former registry RegistryPro originally agreed to when the TLD was delegated 13 years ago.
Under the original Registry Agreements, RegistryPro — since acquired by Afilias — had to verify the professional credentials of potential registrants.
Now that .pro has been brought under something that looks a lot like the 2012 new gTLD RA, it’s pretty much a free-for-all.
The registry said in a press release:

despite demand from registrants and registrars alike, .PRO names have historically been denied to professionals from a wide range of fields such as policemen, firefighters, journalists, programmers, artists, writers, and many others.

In my personal experience, it has been possible to register a .pro domain without providing credentials. I’ve been paying for one for a few years, though I’ve been unable to actually use it.
The gTLD was approved in the original, first round of new gTLD applications, back in 2000.
Part of the original deal was that it would be restricted to three classes of professions — lawyer, doctor, accountant — and only available to buy at the third level.
The third-level limitation was lifted many years ago, but .pro continued to be restricted to people who could show a credential.
However, even as recently as 2012 then-RegistryPro-CEO Karim Jiwani was telling DI that the secret to growth was more restrictions, not less.
He’s no longer with the company.
.pro’s registration numbers have have been suffering the last few years.
The registry peaked at roughly 160,000 names in July 2012, and has been on a downward track ever since. It started this July with about 122,000 registrations.
As part of its new deal with ICANN, Afilias no longer has price caps — previously set around .com prices — and has had to implement some of the provisions of the new gTLD Registry Agreement.
One such provision is the Uniform Rapid Suspension policy, which continues to cause controversy in the industry.

3 Comments Tagged: .pro, afilias, registrypro, sponsored

.feedback regs Fox trademark to itself during sunrise

Top Level Spectrum, the new .feedback registry, has painted a second gigantic target on itself by registering to itself a .feedback domain matching one of the world’s largest media brands.
The company has registered fox.feedback and put up a web site soliciting comment on Fox Broadcasting Company.
This has happened whilst .feedback is still in its sunrise period.
The intellectual property community is, I gather, not particularly happy about the move.
The domain fox.feedback points to a web site that uses TLS’ standard feedback platform, enabling visitors to rate and comment on Fox.
The site has a footnote: “Disclaimer: This site is provided to facilitate free speech regarding fox. No direct endorsement or association should be conferred.”
Fox had no involvement with the registration, which Whois records show is registered to Top Level Spectrum itself.
Registry CEO Jay Westerdal said that the domain is one of the 100 “promotional” domains that new gTLD registries are allowed to set aside for their own use under the terms of their ICANN contracts.
Registries usually register names like “buy.example” or “go.example”, along with the names of early adopter anchor tenant registrants, using this mechanism.
I’m not aware of any case where a registry has consciously registered a famous brand, without permission, as part of its promotional allotment.
“The website is hosted automatically by the Feedback platform,” Westerdal said. “Fox Television Network has raised no concerns and has not applied for the domain during sunrise. We are testing out promotion of the TLD with the domain as per our ICANN contract.”
Fox may still be able to buy the domain during sunrise, he said.
“This is a Registry Operation name. During sunrise, If we receive an application from a sunrise-eligible rights holders during sunrise for a Registry Operations name we may release the name for registration,” he said.
Fox’s usual registrar is MarkMonitor. Matt Serlin, VP there, said in an email that the TLS move could be raised with ICANN Compliance:

I find it curious that this branded domain name would have been registered to the registry prior to the sunrise period which is restricted to the 100 registry promotional names. The fact that the domain is actually resolving to a live site soliciting feedback for The Fox Broadcasting Company is even more troubling. MarkMonitor may look to raise this to ICANN Compliance once the registry is able to confirm how this domain was registered seemingly outside of the required process.

The IP community originally fought the introduction of the 100-domain pre-sunrise exception, saying unscrupulous registries would use it to stop trademark owners registering their brands.
While there have been some grumblings about registries reserving dictionary terms that match trademarks, this may be the first case of a registry unambiguously targeting a brand.
Top Level Spectrum courted controversy with the trademark community last week when it told DI that it plans to sell 5,000-brand match domains to a third party company after .feedback goes into general availability in January.
Westerdal told us this is not “cybersquatting”, as the sites contain disclaimers and are there to facilitate free speech.
What do you think about this use of brands as “promotional” domains?
It’s indisputably pushing the envelope of what is acceptable, but is it fair? Should registries be allowed to do this?

1 Comment Tagged: .feedback, .promotion, fox, ICANN, markmonitor, new gTLDs, sunrise, top level spectrum, trademarks

Web.com just gave itself another reason to bid high for .web gTLD

Registrar group Web.com is changing its stock market ticker symbol to WEB tomorrow, in another sign that it really, really wants to be identified with the string.
The switch from WWWW may indicate that the NASDAQ-listed company’s six rivals for the new gTLD .web have a fight — and a possible big payday — on their hands when .web finally goes to auction.
Web.com is competing with Nu Dot Co, Radix, Google, Donuts, Afilias and Schlund for the gTLD.
The company has already fiercely defended its “right” to .web, filing successful String Confusion Objections against .webs applicant Vistaprint.
Vistaprint subsequently filed an ICANN Independent Review Process complaint to appeal its SCO loss.
Last month, the IRP was won by ICANN, but the panel left the door open for ICANN to reconsider its decision.
The .web auction is not likely to go ahead until the Vistaprint issue is resolved.
If ICANN decides the two strings can be delegated separately, what I think is the last barrier to the .web auction going ahead disappears.
If not, then Vistaprint finds itself as the seventh contender in the auction, which may give it the impetus to carry on challenging the ruling.
ICANN’s board plans to discuss the issue at its next meeting, December 10.
Which way it leans will give an indication of how long it will be before .web goes to auction.

3 Comments Tagged: .web, .webs, auctions, ICANN, new gTLDs, vistaprint, web.com

Most US presidential hopefuls use Whois privacy despite begging for cash

More than half of the remaining US presidential candidates could have risked losing their official campaign web sites under proposed Whois privacy rules.
Today I carried out Whois queries on all 18 candidates to discover that 10, or over 55%, use a Whois privacy service.
Of the three remaining Democrat candidates, only Bernie Sanders uses privacy. Martin O’Malley and Hillary Clinton do not.
Here’s a table of the Republican candidates and their chosen privacy services. N/A means their campaigns are using what appears to be genuine contact information.
[table id=38 /]
The results are interesting because rules under discussion at ICANN earlier this year — which are apparently still on the table in other international fora — would have banned the use of privacy services for commercial web sites that allow financial transactions.
All 18 candidates — even Trump — solicit donations on their campaign sites, and many sell T-shirts, bumper stickers and such.
Back in May, a minority of ICANN’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) were in favor of banning privacy for such registrants.
The rationale was that criminals, such as those selling counterfeit drugs, should not be allowed to mask their Whois details.
Judging by a working group report at the ICANN meeting in Dublin last month, the proposed new rules have been killed off by the PPSAI after a deluge of comments — around 22,000 — that were solicited by registrars and civil rights groups.
However, according to the Electronic Frontier Foundation, at the exact same time as the PPSAI was revealing its change of heart, the US government was pushing for virtually identical policy at a meeting of the OECD, the Organization for Economic Cooperation and Development.
The EFF says the proposed OECD Recommendation “would require domain name registration information to be made publicly available for websites that are promoting or engaged in commercial transactions with consumers.”
It’s remarkable that the US government is apparently pushing for rules that are being violated by most of its own hopeful commanders-in-chief as part of the democratic process.
Clearly, fake pharmacies are not the only class of crook to find value in privacy.

Comment Tagged: eff, ICANN, oecd, ppsai, privacy, usg, whois

NamesCon hotel “scam” doing the rounds

A company with a track record of misleading conference attendees into booking hotels with higher fees appears to be targeting NamesCon.
This morning I received a phone call from somebody claiming to be from NamesCon, but he pronounced it “Name Escon”.
I asked him what company he worked for, and he continued to insist he worked for “Name Escon”.
So I indulged him for a while, and it turned out he was trying to book me into a Las Vegas hotel for the duration of the January 10-13 trade show.
He offered me a rate at the Tropicana of $99 per night, including breakfast. That’s actually not a bad rate — about $20 less than what Expedia is currently asking.
I kept him on the phone until he sent an email to an address he had on file for me (the one from DI’s About page, which I don’t use to sign up for anything).
It arrived immediately, from Exhibitors Housing Services (ehshousing.com), which appears to be a Los Angeles company, with a link to housing-portal.com.
The link led to a credit card authorization form, pre-tailored to my details and the rate offered, which included some terms and conditions I didn’t like the look of.
A simple web search revealed that the company is widely believed to be Bad News.
The same outfit appears to regularly target annual conferences using the exhibitor lists published on earlier conference web sites. Contact information appears to be taken from the exhibitor’s own site.
According to the likes of Affiliate Summit and The Physiological Society, and the Society of Trust and Estate Practitioners and the Agricultural & Applied Economics Association these guys may charge up-front processing fees and/or have a very unfavorable cancellation policy.
In fact, just Googling for “Exhibitors Housing Services” will return pretty much nothing but scam warnings from various conference organizers.
One chap even posted a YouTube video explaining what he thinks the scam is.
I’m pretty certain the company has nothing to do with NamesCon.

2 Comments Tagged: namescon, scam

ICANN opens blog to comments, immediately trolled

Welcome to my world, ICANN.
The organization on Friday opened its blog to commenters for the first time in years, allowing any registered user of the ICANN site to submit comments on its posts.
The switch appears to be retroactive on all previous posts on the platform.
The post announcing the move was immediately commented on by habitual, single-issue commenter Graham Schreiber, a name familiar to anyone who regularly reads the comments sections of industry blogs.
He’s the guy who unsuccessfully sued ICANN — for some reason — back in 2012 and has continued his tirade against the organization in social media ever since.
Trolling aside, it’s a good move by ICANN, something it should have done a long time ago.
While ICANN obviously accepts comments on pretty much everything it does, the usual format of emailed PDFs perhaps lacks some of the brevity, openness and immediacy of a two-way blog.

2 Comments Tagged: ICANN