ICANN holds its ground on weaseled GAC advice

While many members of the community are getting upset about the plan to make it harder for ICANN’s board to overrule GAC advice, today we got a reminder that the board is not the GAC’s lapdog.
The New gTLD Program Committee is standing firm on the way it creatively reinterpreted Governmental Advisory Committee advice to make it less punishing on a few dozen new gTLD registries.
The NGPC passed a resolution on Monday approving an updated scorecard to send to the GAC. ICANN chair Steve Crocker delivered it to GAC chair Heather Dryden yesterday.
A “GAC scorecard” is a table of the GAC’s demands, taken from the formal advice it issues at the end of each public meeting, with the NGPC’s formal responses listed alongside.
The latest scorecard (pdf) addresses issues raised in the last five ICANN meetings, dating back to the Beijing meeting in April 2013.
The issues mainly relate to the GAC’s desire that certain new gTLDs, such as those related to regulated industries, be locked down much tighter than many of the actual applicants want.
One big point of contention has been the GAC’s demand that registrants in gTLDs such as .attorney, .bank and .doctor should be forced to provide a relevant licence or other credentials at point of sale.
The GAC’s exact words, from its Beijing communique (pdf), were:

At the time of registration, the registry operator must verify and validate the registrants’ authorisations, charters, licenses and/or other related credentials for participation in that sector.

However, when the NGPC came up with its first response, in November last year, it had substantially diluted the advice. The creative reinterpretation I mentioned earlier read:

Registry operators will include a provision in their Registry-Registrar Agreements that requires Registrars to include in their Registration Agreements a provision requiring a representation that the Registrant possesses any necessary authorisations, charters, licenses and/or other related credentials for participation in the sector associated with the Registry TLD string.

In other words, rather than presenting your medical licence to a registrar when buying a .doctor domain, registrants would merely assert they have such a licence on the understanding that they could lose their domain if they fail to present it on demand in future.
The GAC, which isn’t entirely stupid, spotted ICANN’s reimagining of the Beijing communique.
At the Singapore meeting this March, it issued a list of passive-aggressive questions (pdf) for the NGPC, noting that its Beijing advice had been “amended” by the board and wondering whether this would lead to “greater risks of fraud and deception” in new gTLDs.
ICANN’s response this week is quite lengthy.
The NGPC said it had “to balance many competing positions” when figuring out how to respond to the Beijing communique, and that it tried “to address all of the completing concerns in a way that respected the spirit and intent of the GAC’s advice.”
The committee gives a number of examples (starting on page 15 of this PDF) explaining why the GAC’s original demands would be unreasonably burdensome not only on registries and registrars but also on registrants.
Here’s one example:

consider a potential registrant that is a multinational insurance company seeking to register a domain name in the .insurance TLD. Suppose the multinational insurance company has locations in over 30 countries, including the United States and Kenya. If the potential registrant insurance company attempts to register a domain name in the .insurance TLD, would that trigger an obligation to verify and validate its credentials, licenses, charters, etc. in the location of its headquarters, or all of the places around the globe where it does business. Is it realistic for a Registry Operator or Registrar to have the knowledge and expertise to determine precisely what credentials or authorizations are required in every country around the world (and in every city, county or other political division if those political subdivisions also require credentials [e.g. in the United States, insurance is primarily regulated at the state level and require a license in each of the 50 states])?

The short version is that the NGPC isn’t budging on this particular issue.
Rather than backpedaling, it’s giving the GAC the reasons it disagreed with its advice and explaining how it attempted to at least comply with the spirit, if not the letter, of Beijing.
As far as I can tell, that seems to be the case in each of the 39 items in the new scorecard — explanation not capitulation. Read the full thing here.

2 Comments Tagged: beijing, category 1, gac, ICANN, new gTLDs, ngpc, singapore, verification

Community panel hands .radio to EBU because nobody objected

The European Broadcasting Union is likely to win the right to the .radio new gTLD, beating three portfolio applicants, after a favorable Community Priority Evaluation.
The main reason the EBU managed to score a passing 14 out of 16 points in the CPE is that there was no significant objection to the EBU’s bid on the public record.
The EBU managed to win, under ICANN’s complex scoring system, despite the fact that the CPE panel ruled that no one entity, not even the EBU, can claim to represent the “radio” community.
The win means that Donuts, Afilias and BRS Media, which all applied for open .radio gTLDs, will likely have to withdraw their bids and leave .radio in the hands of the EBU’s more restrictive policies.
The EBU’s bid envisages a post-registration enforcement regime, in which registrants’ web sites and Whois records are vetted to ensure they have a community “nexus” and are using their domains in the spirit of the community.
Registrants would have to provide a statement of their usage intent at the point of registration.
Domain investors are explicitly not welcome in the TLD, judging by the EBU’s application.
The EBU, as mentioned, scored 14 out of 16 points in the CPE. The threshold to pass is 14.
As I’ve been saying for years, passing a CPE should be very difficult because applicants can immediately lose two points if there’s any decent opposition to their applications.
The other three applicants for .radio could have easily beaten back the EBU had they managed to effectively organize just a single significant member of the radio community against the EBU’s bid.
However, they failed to do so.
The EBU scored the maximum of two points under the “Opposition” part of the CPE, because, in the words of the panel:

To receive the maximum score for Opposition, the application must not have received any opposition of relevance. To receive a partial score for Opposition, the application must have received opposition from, at most, one group of non-negligible size.
The application received letters of opposition, which were determined not to be relevant, as they were (1) from individuals or groups of negligible size, or (2) were not from communities either explicitly mentioned in the application nor from those with an implicit association to such communities.

Donuts, Afilias and BRS Media all submitted comments in opposition to the EBU application. As competing applicants, these submissions were (probably correctly) disregarded by the panel.
There were a small number of other objecting comments on the record that the CPE panel (again probably correctly) chose to disregard as coming from organizations of negligible size.
The was one comment, in Polish, from a Polish law firm. Another comment came from a something dodgy-looking calling itself the International Radio Emergency Support Coalition.
A third comment came from the Webcaster Alliance, a group that made a bit of a name for itself a decade ago but which today has a one-page web site that doesn’t even list its members (assuming it has any).
Attempts by BRS Media, which already runs .am and .fm, to orchestrate a campaign of opposition seem to have failed miserably.
In short, the panel’s decision that there was no relevant, on-the-record opposition seems to be on pretty safe ground.
What’s slightly disturbing about the CPE is that the panel seems to have decided that the EBU does not actually represent the radio community as described in its application.
It dropped one point on the “Community Establishment” criteria, and another on the “Nexus between Proposed String and Community” criteria.
Specifically, it lost a point because, as the panel stated:

Based on information provided in the application materials and the Panel’s research, there is no such entity that organizes the community defined in the application. Therefore, as there is no entity that is mainly dedicated to the community as defined in the .RADIO application, as the Panel has determined, there cannot be documented evidence of community activities.

In other words, there may be a “radio community”, but nobody, not even the EBU, is responsible for organizing it.
It also lost a point because while the string “radio” does “identify” the community, it does not “match” it.
The panel explained:

To receive the maximum score for Nexus, the applied-for string must “match” the name of the community or be a well-known short-form or abbreviation of the community name. To receive a partial score for Nexus, the applied-for string must “identify” the community. “Identify” means that the applied-for string should closely describe the community or the community members, without over-reaching substantially beyond the community.

Failing to get full marks on community and nexus would usually, in my view, indicate that an application would not succeed in its CPE bid.
However, the lack of any outcry from significant members of the community (either because there was no such opposition or the three rival applicants failed to muster it) seems set to allow .radio to be managed by the applicant with the most restrictive policies.

1 Comment Tagged: .radio, afilias, brs media, community priority evaluation, cpe, donuts, ebu, european broadcasting union, ICANN, new gTLDs

US-based Moniker gets Euro data retention waiver

ICANN has approved Moniker’s request for a partial waiver of the Registrar Accreditation Agreement based on European privacy law, despite the fact that the registrar is based in the US.
The data retention waiver for Moniker was one of a few granted to members of the KeyDrive group of registrars that were approved by ICANN yesterday.
KeyDrive is based in Luxembourg, but the waiver request was granted because complying with the 2013 RAA could violate German privacy law and Moniker’s data is stored in Germany.
ICANN said:

Registrar’s technical backend services provider as well as data storage and collection occur on servers hosted and operated in Germany, and is subject to German law. Accordingly, ICANN has determined that it is appropriate to grant Registrar a data retention waiver

Group members Key-Systems AG (a German company) Key-Systems LLC (an American company) also received waivers yesterday.
InternetX, part of Germany-based United Internet, and http.net Internet also had their requests approved.
The waiver process was introduced because the 2013 RAA requires registrars to store customer data long after their domains expire, which registrars’ lawyers say forces them to break local laws.
An EU directive implemented in many European countries says that companies cannot store personal data for longer than it is needed for the purpose for which is was collected.

Comment Tagged: 2013 raa, data retention, ICANN, key-systems, keydrive, moniker, waiver

.global a victim of new gTLD launch cluster?

Poor GA-day results from .global are being blamed on registrars being swamped by a cluster of new gTLD launches occurring in close proximity.
Dot Global added 1,074 domains in the first seven hours of .global’s general availability, bringing its zone to 1,637 names in total.
CEO Rolf Larsen told us the number of registrations yesterday was actually closer to 1,200.
The numbers aren’t great for a first day, considering that .global is in place at about 80 registrars, but Larsen said that the lack of a long runway of pre-registrations was to blame.
“We are not unhappy with the 1,200, but unhappy to not have had months of pre-regs to make that number higher,” he said.
“Most registrars don’t even do pre-regs,” he said. “Those who do have had a hard time keeping up with all the launches. Our launch was in a very busy period, so difficult to get on board with all those registrars early. Some, including GoDaddy did pre-regs for us, but over just a few weeks instead of months like with many other launches.”
Go Daddy was the biggest registrar yesterday, he said.
Dot Global has a number of plans to increase its marketing over the coming weeks and months, by itself and in conjunction with its registrar partners.
These plans include broad promotions to registrars’ existing customer bases as well as targeted mailings to companies that already have the word “global” at the second level of their domains.

9 Comments Tagged: .global, dot global, new gTLDs

.london launch day biggest yet for new gTLDs, but did it miss targets?

Dot London Domains’ .london had just shy of 35,000 domains in its zone file this morning, after its first partial day of general availability.
That’s an addition of 12,421 domains over yesterday’s number, making .london the 11th most-registered new gTLD.
This makes .london — which in my opinion has had one of the best launch marketing campaigns we’ve seen this year — the most-successful gTLD, in volume terms, after its first GA day.
It has beaten the 33,012 names that .在线 (“.online” in Chinese) and the 31,645 names that .berlin had in their zone files at the end of their respective GA days.
.london domains are not particularly cheap, either. Minds + Machines sells at £30 ($48) a year and Go Daddy (which lists .london at the top of its UK home page today) sells at $59.99.
UK-based Domainmonster, part of Host Europe Group, performed well with a £34.99 ($56) annual fee.
There were 22,547 .london names claimed during the “London Priority Period”, a combined sunrise/landrush phase that gave first dibs on names to trademark owners followed by London residents.
The registry has not broken down the mix between sunrise and landrush, but I believe based on the paltry sunrise performance of every other new gTLD to date that the vast majority were landrush names.
The full priority period queue has not yet been processed — domains with more than one applicant are currently in auction.
Back-end provider Minds + Machines, recently told the markets that it expects about a quarter of landrush/sunrise names to go to auction, so we could be looking at something like 7,500 applications (as opposed to domains) currently in the auction queue.
What this may mean is that .london had roughly 30,000 applications during its priority period, about 20,000 less than it had predicted back in July.
Dot London Domains is closely affiliated with London & Partners, the PR machine for the Mayor of London, so it had resources and access to throw at an effective marketing campaign.

Comment Tagged: .london, dot london domains, landrush, m+m, Minds + Machines, new gTLDs, sunrise

Donuts beats trademark owner to .coach

Donuts has won the right to the new gTLD .coach, after an exact-match trademark owner withdrew its bid.
Coach Inc is a chain of clothing and accessories outlets, best known for its handbags, founded in New York in 1941.
The company owns coach.com, but withdrew its application for .coach this week, leaving Donuts unchallenged.
Coach had filed a Legal Rights Objection against Donuts, claiming .coach would infringe its trademark, but the objection panelist disagreed (pdf).
The panelist agreed instead with Donuts that “coach” has multiple meanings, and that that was “a risk that the Objector assumed when it adopted as its trademark a common dictionary word.”

2 Comments Tagged: coach, contention, donuts, new gTLDs

Uniregistry beats 1-800-FLOWERS.COM to .flowers

Uniregistry has won the contention set for .flowers, beating three other new gTLD applicants.
The company won the rights to the string after withdrawals from Donuts, Minds + Machines and a subsidiary of 1-800-FLOWERS.COM.
The price of forcing the withdrawals, as usual, has not been disclosed.
Uniregistry currently has 15 delegated new gTLDs and a handful of others, won at auction, that are in the contracting stage of the process.
The string “flowers” has a bit of a tainted history in the domain name space.
Investor Rick Schwartz famously paid $200,000 for flowers.mobi, only to sell it on a few years later to another investor for $6,500.
That domainer flipped it in 2012, and it ultimately wound up in the hands of 1-800-FLOWERS.COM for an undisclosed sum.

Comment Tagged: .flowers, auctions, new gTLDs, uniregistry

Russian hackers breaking in to NameCheap accounts

If you have an account at NameCheap, now might be a good time to think about changing your password.
According to the registrar, hackers based in Russia are using a haul of a reported 4.5 billion username/password combinations to attempt to break into its customers’ accounts.
Some attempts have been successful, NameCheap warned.
The attackers are using credentials stolen from third-party sources in a large-scale, automated attempt to log in to user accounts, disguised as regular users, the company said in a blog post.
NameCheap said:

The vast majority of these login attempts have been unsuccessful as the data is incorrect or old and passwords have been changed. As a precaution, we are aggressively blocking the IP addresses that appear to be logging in with the stolen password data. We are also logging these IP addresses and will be exporting blocking rules across our network to completely eliminate access to any Namecheap system or service, as well as making this data available to law enforcement.
While the vast majority of these logins are unsuccessful, some have been successful. To combat this, we’ve temporarily secured the Namecheap accounts that have been affected and are currently contacting customers involved requesting they improve the security for these accounts.

Affected users have been emailed, the company said.
NameCheap suspects the attack is linked to a reported cache of 1.2 billion unique username/password combinations amassed by a hacker group from databases vulnerable to SQL injection.
The registrar pointed out that its own systems haven’t been hacked. Customers should only be vulnerable if they use the same username and password at NameCheap as they use on other sites.

Comment Tagged: hacking, namecheap, security

.club first new gTLD to sell 100,000 domains

.club hit a landmark this week with its 100,000th domain name registration, according to .CLUB Domains.
It’s the first new gTLD to get to this level of success without giving away names for free — .xyz and .berlin have over 460,000 and 130,000 names respectively but fall under 100k if you factor out the freebies.
The .club zone file showed 98,984 names (excluding swelling from the name collisions program) last night, and it’s been growing at steady rate of roughly 250-300 names per day.
It appears that there are 1,000 or so names that do not appear in the zone file, perhaps because they’re not configured yet.
.club hit general availability May 7, 114 days ago.

Comment Tagged: .club, .club domains, new gTLDs

ICANN terminates billion-dollar gTLD applicant over unpaid $3,000 bill

Telefonica Brasil, part of the massive Telefonica group of telecoms companies, has lost its registrar accreditation after failing to pay its ICANN fees.
The company, which had revenue last year of $14.6 billion, is facing termination of its Registrar Accreditation Agreement over the pitiful sum of $3,082.12.
It’s also embarrassing because Telefonica is applying for the new gTLD .vivo, its consumer brand in Brasil, which will require it to sign a Registry Agreement with ICANN.
I don’t think the loss of the RAA affects the company’s ability to get its gTLD contracted and delegated.
According to ICANN (pdf), Telefonica also failed to comply with the Registrar Information Specification, a pretty basic rule in the 2013 Registrar Accreditation Agreement requiring registrars to provide their address and names of officers and any parent companies.
The company has no gTLD names under management, so registrants will not be affected by the termination, which will take effect September 25.
ICANN sent its initial breach notice in July, but Telefonica did not comply before the August deadline. It also received a breach notice over an unpaid $10,000 bill a year ago.

Comment Tagged: .vivo, 2013 raa, compliance, ICANN, new gTLDs, telefonica