ICANN loosens Whois privacy rules for registrars

ICANN has made it easier for registries and registrars to opt-out of Whois-related contractual provisions when they clash with local laws.
From this week, accredited domain firms will not have to show that they are being investigated by local privacy or law enforcement authorities before they can request a waiver from ICANN.
Instead, they’ll be also be able to request a waiver preemptively with a statement from said authorities to the effect that the ICANN contracts contradict local privacy laws.
In both cases, the opt-out request will trigger a community consultation — which would include the Governmental Advisory Committee — and a review by ICANN’s general counsel, before coming into effect.
The rules are mainly designed for European companies, as the EU states generally enjoy stricter privacy legislation than their North American counterparts.
European registrars and registries have so far been held to a contract that may force them to break the law, and the only way to comply with the law would be to wait for a law enforcement proceeding.
ICANN already allows registrars to request waivers from the data retention provisions of the 2013 Registrar Accreditation Agreement — which require the registrar to hold customer data for two years after the customer is no longer a customer.
Dozens of European registrars have applied for and obtained this RAA opt-out.

.feedback gTLD in breach of contract after big brand “fraud” claims

ICANN has slapped .feedback operator Top Level Spectrum with a contract breach notice after a huge complaint about alleged fraud filed by a gang of big brands.
The company becomes the third new gTLD to be hit by a breach notice, and the first to receive one as a result of losing a Public Interest Commitments Dispute Resolution Process case.
While TLS dodged the “fraud” charges on a technicality, the breach is arguably the most serious found by ICANN in a new gTLD registry to date.
The three-person PICDRP panel found TLS was in violation of the following commitment from its registry agreement:

Registry Operator will operate the TLD in a transparent manner consistent with general principles of openness and non-discrimination by establishing, publishing and adhering to clear registration policies.

But TLS dodged the more serious charges of “fraudulent” behavior, which it denied, largely on the technicality that its PICs only require it to bar its registrants from such behavior.
There’s nothing in the PICs preventing the registry from behaving fraudulently, so the PICDRP panel declined to rule on those allegations, saying only that they “may be actionable in another forum”.
The complainants, which filed their 1,800-page complaint in October, were MarkMonitor and a bunch of its clients, including Adobe, American Apparel, Best Buy, Facebook, Levi and Verizon.
They’d claimed among other things that 70% of .feedback domains were trademarked names actually registered by the registry, and that TLS had stuffed each site with reviews either paid for or scraped from services such as Yelp!.
They claimed that Free.Feedback, a free domains service hosted by an affiliated entity, had been set up to auto-populate Whois records with the names of brand owners (or whoever owned the matching .com domain) even when the registrant was not the brand owner.
This resulted in brand owners receiving “phishing” emails related to domains they’d never registered, the complainants stated.
TLS denied all all the allegations of fraud, but the PICDRP panel wound up not ruling on many of them anyway, stating:

the Panel finds that Respondent’s Registry Operator Agreement contains no covenant by the Respondent to not engage in fraudulent and deceptive practices.

The only violations it found related to the transparency of .feedback’s launch policies.
The panel found that TLS had not given 90 days notice of policy changes and had not made its unusual pricing model (which included an extra fee for domains that did not resolve to live sites) transparent.
The registry had a number of unusual launch programs, which I outlined in December 2015 but which were apparently not adequately communicated to registrars and registrants.
The panel also found that Free.Feedback had failed to verify the email addresses of registrants and had failed to make it easy for trademark owners to cancel domains registered in their names without their consent.
Finally, it also found that TLS had registered a bunch of trademark-match domain names to itself during the .feedback sunrise period:

self-allocating or reserving domains that correspond to the trademark owners’ marks during the Sunrise period constitutes a failure by the Respondent to adhere to Clause 6 of its Registration and Launch policies, versions 1 and 2. According to the policies, Sunrise period is exclusively reserved for trademark owners

TLS, in its defense, denied that it had self-allocated these names and told the panel it had “accidentally” released them into the zone file temporarily.
As a result of the PIC breaches found by the panel, ICANN Compliance has issued a breach notice (pdf) against the company.
To cure the breach, and avoid having its Registry Agreement taken away, TLD has to, by April 15:

Provide ICANN with corrective and preventative action(s), including implementation dates and milestones, to ensure that Top Level Spectrum will operate the TLD feedback in a transparent manner consistent with general principles of openness and nondiscrimination by establishing, publishing and adhering to clear registration policies;

That seems to me like it’s probably vague enough to go either way, but I’d be surprised if TLS doesn’t manage to comply.

Did Whois blow the lid off a Labour leadership coup, or is this just pig-fuckery?

A British Member of Parliament has been forced to deny he was behind the registration of several domain names promoting him as a future leader of the Labour party.
Clive Lewis, until recently a member of the shadow cabinet, told the Guardian yesterday that he did not register the batch of domains, which included cliveforleader.org.uk, cliveforlabour.org.uk and their matching .org, .uk and .co.uk domains.
“None of this is true: I haven’t done this,” he told the paper, following a Huffington Post article revealing the names had been registered June 29 last year, just a couple of days after he was appointed shadow defence secretary.
Lewis resigned from the shadow cabinet three weeks ago after refusing to vote in favor of triggering the Article 50 process that will take the UK out of the European Union.
The Labour Party has been dogged by stories about potential leadership challenges ever since Jeremy Corbyn — popular among grassroots party members, unpopular with voters — took over.
Questions about Corbyn’s leadership reemerged last week after a disastrous by-election defeat for the party.
The domains were taken as an indication that Lewis had been plotting a coup for many months, which he has denied.
The Whois records do not support a conclusion one way or another.
Under Nominet rules, individuals are allowed to keep their phone number, postal and email addresses out of Whois if the domains are to be used for non-commercial purposes, a right the registrant of the names in question chose to exercise.
Public Whois records show the .uk names registered to “Clive Lewis”, but contain no contact information.
They do contain the intriguing statement “Nominet was able to match the registrant’s name and address against a 3rd party data source on 29-Jun-2016”, a standard notice under Nominet’s Whois validation program.
But Nominet does not validate the identity of registrants, nor does it attempt to link the registrant’s name to their purported address.
The statement in the Whois records translates merely that Nominet was able to discover that a person called Clive Lewis exists somewhere in the world, and that the postal address given is a real address.
The .org and .com domains, registered the same day by the same registrar, use a Whois privacy service and contain no information about the registrant whatsoever.
Lewis himself suspects the batch of names may have been registered by a political opponent in order to force him to deny that he registered them, noting that fellow MP Lisa Nandy had a similar experience last July.
His initial statement to HuffPo, on which he reportedly declined to elaborate, was:

A lesson from LBJ [US President Lyndon B Johnson] in how to smash an opponent. Legend has it that LBJ, in one of his early congressional campaigns, told one of his aides to spread the story that Johnson’s opponent f*cked pigs. The aide responded: ‘Christ, Lyndon, we can’t call the guy a pigf*cker. It isn’t true.’ To which LBJ supposedly replied: ‘Of course it ain’t true, but I want to make the son-of-a-bitch deny it.’

Since then, along with his denial to the Guardian, he’s told his local Norwich newspaper that he’s tasked his lawyers with finding out who registered the names.
“I have instructed a solicitor to go away and look at this. They can try and make sure we find the identity, the IP address and the payment details,” he told the Eastern Daily Press.

Nigger.com returned to NAACP after expiration prompts $10,000 auction

US civil rights group the National Association for the Advancement of Colored People has reclaimed the domain name nigger.com after it expired and went to auction.
The names nigger.org and nigger.net were also affected, but according to Whois records the NAACP restored all three yesterday.
The names had been in pending renewal/delete status for three weeks, during which time the registrant was listed as Perfect Privacy, Web.com’s proxy/privacy provider.
While expired, the .com had been placed (presumably automatically) in a NameJet auction, as first reported by Raymond Hackney at The Domains.
At time of writing, the auction had attracted 72 bids and a high offer of $10,000.
It was a “Wish List Auction”, indicating that the domain’s prior registrant had not yet exhausted all options to have the name restored.
As Hackney noted, if these domains fell into the wrong hands it could have a negative impact on race relations in the US.
But the NAACP, which first got hold of the domains almost 20 years ago, seems to have had a remarkably lackadaisical attitude to them over the last few years.
Not only did it accidentally allow the names to expire, but DomainTools and Archive.org captures show that the associated web sites had been compromised repeatedly since late 2014.
Every capture since late 2014 shows taunting, racist messages from the hackers, at least one of which associated himself with troll group the “Gay Nigger Association of America”.

ISOC New York challenges Neustar’s .nyc contract

The New York chapter of the Internet Society has called upon the city to delay the renewal of Neustar’s contract to run the .nyc gTLD, citing numerous concerns about how it is being managed.
In a letter (pdf) to Mayor Bill de Blasio, the group calls for a “town hall” and community consultation and for the city to “make appropriate adjustments” before the contract is renewed.
Its beef appears to be what it sees as .nyc’s lackluster performance in the market and the lack of promised community engagement.
The ISOC-NY letter contains a list of over a dozen “observations and nitpicks”.
These include a decline in .nyc registration volume, that fact that most .nyc names are parked, and the fact that Whois privacy is banned from the gTLD.
Neustar’s current contract is due to be renewed March, according to the letter.
(This post was updated February 8 to correct the expiry date of Neustar’s contract.)

Complaints about registrars dip in 2016

There were slightly fewer complaints about domain name registrars in 2016, compared to 2015, according to newly published ICANN data, but complaints still run into the tens of thousands.
There were 43,156 complaints about registrars to ICANN Compliance in 2016, compared to 45,926 in 2015, according to the data (pdf). That’s a dip of about 6%.
The overall volume of complaints, and the dip, can be attributed to Whois.
About three quarters of the complaints directed at registrars in 2016 were for Whois inaccuracy — 32,292 complaints in total, down from 34,740 in 2015.
The number of complaints about gTLD registries was pretty much flat at 2,230, despite hundreds of new gTLDs being delegated during the year.
The vast majority of those gTLDs were dot-brands, however, with nowhere near the same kind of potential for abuse as generally available gTLDs.
The biggest cause for complaint against registries, representing about half the total, was the Zone File Access program. I’ve filed a few of these myself, against dot-brands that decide the ZFA policy doesn’t apply to them.
Formal, published breach notices were also down on the year, with 25 breaches, four suspensions and four terminations, compared to 32 breaches, six suspensions and eight terminations in 2015.
That’s the second consecutive year the number of breach notices was down.

Thick Whois policy for .com is now live

The domain name industry is kicking off one of its most fundamental shifts in its plumbing this week.
Over the next two years, Verisign and every registrar that sells .com domains will have to rejigger their systems to convert .com from a “thin” to “thick” Whois.
This means that by February 1, 2019, Verisign will for the first time control the master database of all Whois records for .com domains, rather than it being spread piecemeal across all registrars.
The switch comes as a result of a years-in-the-making ICANN policy that officially came into force yesterday. It also applies to .com stablemates .net and .jobs.
The first big change will come August 1 this year, the deadline by which Verisign has to give all of its registrars the ability to submit thick Whois records both live (for new regs) and in bulk (for existing ones).
May 1, 2018 is the deadline for all registrars to start submitting thick Whois for new regs to Verisign, but they can start doing so as early as August this year if they want to.
Registrars have until February 1, 2019 to supply Verisign with thick Whois for all their existing registrations.
There’s a process for registrars who believe they would be violating local privacy laws by transferring this data to US-based Verisign to request an exemption, which may prevent the transition going perfectly uniformly.
Some say that the implementation of this policy may allow Verisign to ask for the ability to ask a for an increase in .com registry fees — currently frozen at the command of the US government — due to its inevitably increased costs.
Personally, I think the added costs will likely be chickenfeed compared to the cash-printing machine that is .com, so I think it’s far from a slam-dunk that such fee increases would be approved.

The biggest dot-brand in the world has 50,000 domains, but are they legit?

The biggest dot-brand gTLD active today has about 50,000 domains under management, but the vast majority of them may not be compliant with ICANN rules.
Real Estate Domains LLC runs .realtor in partnership with the National Association of Realtors, a US-based real estate agent membership organization.
RED/NAR has an ICANN policy exemption that means it does not have to open .realtor to competition between registrars, but it does not appear to be sticking to the promises it made when it asked for that exemption.
RED has told DI that it believes it is fully compliant with its contractual obligations.
The .realtor gTLD is highly unusual, possibly even unique, in the market.
It is, by most comparisons, a thriving new gTLD. It has tens of thousands of domain names and thousands of active web sites.
It’s the 59th-biggest 2012-round gTLD, according to zone file counts. It has more names than .blog, .webcam and .ninja.
It currently has about 48,000 names in its zone file, a bit less than half of its November 2015 peak of 110,000. It’s been offering a free first-year name to NAR members since launch, which may account for the first-year peak and second-year trough.
It’s arguably a “dot-brand”, but its domains are primarily used by fee-paying third parties, which is not the case for the over 500 other dot-brands out there today.
The string “realtor” is in fact an trademark, fiercely guarded by the NAR and apparently at genuine risk of genericide.
To call yourself a realtor, you have to pay NAR local and national membership fees that can run into hundreds of dollars a year.
To register a .realtor domain, you have to be an NAR member. So, even though the price of a .realtor domain is only around $40 at Name Share (the only approved .realtor registrar), the cost of eligibility is much higher.
I think that the way the NAR is selling its names to third-party realtors is very possibly a breach of ICANN rules, but explaining why I think that will get a bit complicated.
To begin with, whether a gTLD is a “dot-brand” depends to a great extent on your definition of the term.
I usually take “dot-brand” to mean any new gTLD that has Specification 13 — which allows registries to ignore ICANN policies such as the otherwise mandatory Sunrise period — in its Registry Agreement.
There are 463 gTLDs that have Spec 13 so far. They’re being used to a greater or lesser extent by the respective registries to promote their own brands.
Some have set up a bunch of domains with redirects to specific URLs on their .com or ccTLD site. Others have built a modest number of custom sites to promote various products, services, offers or marketing campaigns.
A small number have been using their domains to help business partners. Spanish car maker Seat points scores of .seat domains to cookie-cutter sites promoting local car dealerships, but I’ve seen no evidence these dealers have any control over these domains.
Almost all of the time, the only entity actually using the domain is the registry — that is, the brand owner — itself.
There’s also another definition of dot-brand — any gTLD that does not have Spec 13, but does have an exemption to Specification 9 of the standard ICANN Registry Agreement.
Spec 9, also called the “Code of Conduct”, is the part of the RA that requires registries to give equal, non-discriminatory access to all ICANN-accredited registrars.
It’s there to stop registries favoring registrars they have close relationships with and therefore to keep the market competitive.
Every Spec 13 dot-brand has a Spec 9 exemption, but not every TLD with a Spec 9 exemption has signed Spec 13.
There are 66 gTLDs that have the Spec 9 exemption but do not have Spec 13 in their contracts. Almost all of these have fewer than 100 domains in their zone file today.
The Spec 9 exemption was created to avoid the stupid and undesirable situation where a big-name company has to open access to its dot-brand back-end registry to multiple registrars, even though it is the only registrant permitted to register names there.
The Code of Conduct is there to protect registrants. When there is only one registrant, there’s no need for protection. With multiple registrants, competition needs to be enforced.
To get the Spec 9 exemption, dot-brands have to send a letter to ICANN promising three things:

1. All domain name registrations in the TLD are registered to, and maintained by, Registry Operator for the exclusive use of Registry Operator or its Affiliates (as defined in the Registry Agreement);
2. Registry Operator does not sell, distribute or transfer control or use of any registrations in the TLD to any third party that is not an Affiliate of Registry Operator; and
3. Application of the Code of Conduct to the TLD is not necessary to protect the public interest

Those bullets are copied from the March 2014 .realtor letter (pdf), but they’re all basically the same.
The first bullet says that domains have to be registered to the registry operator. In the case of .realtor, that’s RED/NAR.
And in fact, as far as I can tell, every .realtor domain has the RED/NAR listed in the “Registrant” field of its Whois record. The registry owns the lot.
But that bullet also says that .realtor domains have to be “maintained by” and “for the exclusive use of” the registry operator (in this case, the NAR) and its “Affiliates”.
The second bullet says that the registry cannot give “control or use” of any .realtor domain to a third party that is not an “Affiliate” of the registry.
The term “Affiliate” is important here. The Spec 9 exemption states that it is defined by the RA, and the RA defines it like this:

For the purposes of this Agreement: (i) “Affiliate” means a person or entity that, directly or indirectly, through one or more intermediaries, or in combination with one or more other persons or entities, controls, is controlled by, or is under common control with, the person or entity specified, and (ii) “control” (including the terms “controlled by” and “under common control with”) means the possession, directly or indirectly, of the power to direct or cause the direction of the management or policies of a person or entity, whether through the ownership of securities, as trustee or executor, by serving as an employee or a member of a board of directors or equivalent governing body, by contract, by credit arrangement or otherwise.

My reading of this is that an Affiliate is an entity that is controlled, in a corporate sense, by the registry. The definition came about as a way to stop domain companies trying to avoid policy obligations by hiding behind shell companies.
However, in my opinion, the vast majority of .realtor domains today are in fact being controlled and used by third parties that are not registry Affiliates by the RA definition.
The first giveaway is Whois. While RED/NAR is listed as the “Registrant” of pretty much all .realtor domains, in most cases the “Administrative” contact is listed as the person or company who caused the name to be registered. Third-party realtors, in other words.
Second, the registry’s web site states plainly that NAR member realtors can “get” and “use” .realtor domains and goes on to specify that they can use the names to build a web site, set up an email address, and even redirect the domain to an existing site.
Doing a Google search for .realtor sites, you’ll find that realtors are in fact using .realtor domains for these permitted purposes.
This seems to be a case of thousands of non-registry parties paying for “control” and “use” of domains that are supposed to be restricted to the registry’s control and use.
It seems to be true that they don’t “own” the domains that they “use”, but they nevertheless do “use” them in much the same way as I expect a significant majority of non-domainer registrants in other TLDs “use” their domains.
NAR/RED is of course fully aware of its RA obligations, and has written its own terms to accommodate them.
On a .realtor registry web site, its registration agreement, or “License Agreement”, states:

You represent, warrant and agree that you are a REALTOR®, an NAR member, the Canadian Real Estate Association (“CREA”), a member of CREA, an NAR or CREA member Board or Association, an NAR affiliate, an NAR licensee, or otherwise in a contractual relationship with NAR relating to use of NAR’s REALTOR® mark and that, in such capacity, you are deemed an “Affiliate” of RED as such is defined in the Registry Agreement, including as specifically set forth in the Code of Conduct Exemption.

The NAR is basically asking its members to affirm, via the small print of their registration agreement (that the majority won’t read) and the .realtor RA (which I’m sure none of them will read), that the NAR has some kind of corporate control over them.
That’s clearly not the case, in my understanding. The NAR’s members are generally fully independent sole traders or limited companies.
Realtors causing .realtor domains to be registered on their behalf are no more “Affiliates” of RED or the NAR than I would be an Affiliate of Facebook if, perchance, there’s a similar clause in the Facebook terms of service.
While I’ve been asking industry experts about this for the last couple of weeks, it was suggested to me that the fact that .realtor registrants have a “contract” with the registry (to license the Realtor trademark) is enough to satisfy the “Affiliate” definition.
I don’t buy it. Every registrant in every TLD signs a contract whenever they register a domain name. If a contract were sufficient for a Spec 9 opt-out, every gTLD would have the opt-out.
At this point you may be wondering what the harm of this business model is. I wondered the same thing myself.
The main harm, as far as I can see it, is that it sets a precedent for other gTLDs to avoid contractual obligations.
The other is that .realtor registrants (for want of a better term) are locked into the one approved registrar, Name Share, forever. If Name Share were to raise its prices, they would not have the option to move to another registrar.
Name Share, part of the EnCirca registrar family, specializes in niche TLDs and currently charges a not-unreasonable $39.95 per year for a .realtor domain.
There’s also the fact that gTLDs themed around real estate are thin on the ground right now.
RED/NAR also controls the new gTLD .realestate, but it has yet to launch for unknown reasons.
.realtor went from delegation to general availability in less than three months back in mid-2014 — a fast launch — but .realestate was delegated in April 2016 and hasn’t even set out its launch plan yet.
It’s a fully generic, non-brand gTLD but it hasn’t told ICANN when its sunrise, trademark claims or GA dates are yet. It hasn’t even launched its nic.realestate web site yet, which is a contractual obligation also in the RA.
I don’t know why RED/NAR has not started to launch .realestate yet. When I asked RED’s top brass I did not get a reply.
But I do know that a real estate agent in North America today who wants to get a domain in a semantically valuable TLD has one fewer option due to the absence of .realestate from the market.
Another option, buying a .realty domain from Top Level Spectrum, is not possible either because, 18 months after delegation, it also has not launched.
Then there’s .homes, a restricted gTLD operated by Dominion Enterprises, but that has virtually no registrar support and fewer than 100 names in its zone eight months after general availability started.
The only real option right now (other than using an unrelated TLD) is to buy a .realtor domain, but they’d have to pay hundreds of dollars to NAR for membership and then would not have a choice of registrars through which to register.
I put all of my questions about the business model and the Spec 9 exemption to RED last week.
“We believe we are in full compliance with the Spec 9 exemption as granted by ICANN based on our request and posted publicly here,” CEO Matthew Embrescia said in an email (link in original).
Brian Johnson, general counsel for RED, said in a separate email:

our position is that RED is in full compliance as such relates to Spec 9 for .REALTOR. In fact, we think .REALTOR is a very successful example of a TLD with a legitimate business model which incorporates a Spec 9 exemption.

I also pushed Johnson and Embrescia for specific explanations of why I might be wrong in my interpretation of the Spec 9 exemption and how RED is applying it, but I did not get any replies.
A senior ICANN staffer, while declining to comment on the specifics of any TLD or any compliance investigation, told me that my understanding of the Spec 9 exemption is correct.
I gather that all Spec 9-exempt registries are obliged to submit an annual report about their exemption compliance, and that the 2016 report is due tomorrow.
However, I believe .realtor’s business model is well over one year old already, so it’s debateble whether ICANN has been paying attention.

ICANN terminates penis pill pimp registrar

ICANN is to terminate the contract of a Chinese registrar linked to dodgy pharmaceuticals web sites and other malfeasance.
Nanjing Imperiosus Technology Co, which does business as DomainersChoice.com, has been told it will lose its registrar accreditation February 3.
ICANN said in the termination notice that the company had failed to keep records related to abuse reports, failed to validate Whois records, and failed to provide ICANN with registration records, all in breach of the Registrar Accreditation Agreement.
The breaches related to complaints filed by illegal pharmacy watchdog LegitScript last September, I believe.
DomainersChoice and its CEO Stefan Hansmann were listed in Whois as the owners of potentially hundreds of domains that were being used to sell medicines for conditions ranging from heart disease to erectile dysfunction.
The domains 5mg-cialis20mg.com, acheterdutadalafil.com, viagra-100mgbestprice.net and 100mgviagralowestprice.net were among those apparently owned by the registrar.
According to LegitScript, thousands of DomainersChoice domains were “rogue internet pharmacies”.
The registrar has also been linked by security researchers to mass typosquatting campaigns.
The company’s web site even has a typo generator. While one could argue such tools are also useful to brand owners, DomainersChoice’s name suggests it’s geared towards domainers, not brands.
DomainersChoice had about 27,000 domains under management at the last count, which ICANN will now migrate to another registrar.
It’s not known how many of those were self-registered domains and how many were being used nefariously, but LegitScript CEO John Horton estimated (pdf) at least 2,300 dodgy pharma sites used the registrar.

Registrars off the hook for silly ICANN transfer policy

Domain name registrars have been assured that ICANN Compliance will not pursue them for failing to implement the new Transfer Policy on privacy-protected names.
As we reported late November, the new policy requires registrars to send out “change of registrant” confirmation emails whenever certain fields in the Whois are changed, regardless of whether the registrant has actually changed.
The GNSO Council pointed out to ICANN a number of unforeseen flaws in the policy, saying that vulnerable registrants privacy could be at risk in certain edge cases.
They also pointed out that the confirmation emails could be triggered, with not action by the registrant, when privacy services automatically cycle proxy email addresses in the Whois.
This appears to have already happened with at least one registrar that wasn’t paying attention.
But ICANN chair Steve Crocker told the GNSO Council chair last week that ICANN staff have been instructed to ignore violations of the new policy, which came into effect December 1, in cases involving privacy-protected domains (pdf).
It’s a temporary measure until the ICANN board decides whether or not to defer the issue to the GNSO working group currently looking at policies specifically for privacy and proxy services.