ICANN affirms full refunds for pissed-off gTLD applicants, silent on new CEO

ICANN’s board of directors has approved full refunds for any new gTLD applicant that asks for one – something that the organization has already been offering for over a month.
At its two-day retreat in Amsterdam this weekend, the board’s New gTLD Program Committee resolved:

to offer to applicants a full refund of the New gTLD Application fee actually paid to ICANN if the applicant wishes to withdraw its application prior to the date that ICANN publicly posts the identification of all TLD applications.

The date of the Big Reveal, when the names of every applicant and every applied-for gTLD will be publicly posted and the refunds will no longer be available, has not yet been set.
While the resolution refers to the TLD Application System data leakage bug, the refund does not appear to be restricted to directly affected applicants. Anyone can claim it.
However, as regular DI readers know, ICANN had been offering full refunds to applicants that withdraw before the Big Reveal for weeks before the TAS bug emerged.
ICANN customer services reps told DI and at least one gTLD applicant in March that: “Applications withdrawn prior to the posting of the applied-for strings are qualified for a $180000 refund”.
ICANN said in a statement today:

We recognize that this represents an increase of only US $5000 over the refund that withdrawing applicants would otherwise receive, but we believe it is an important part of fulfilling our commitment to treat applicants fairly.

Under the terms of the Applicant Guidebook, the maximum refund available after the Reveal is $148,000.
In other news from Amsterdam…
The ICANN board has decided to let director Thomas Narten join the New gTLD Program Committee, which comprises all of the board members without new gTLD conflicts of interest.
Narten had been barred from the recently formed committee because he worked for IBM, which planned to apply for one or more new gTLDs.
But the board said he has now “mitigated the previously-identified conflict of interest with respect to the New gTLD Program”, so he gets to join the committee as a non-voting liaison.
It’s not clear from the weekend’s resolution why Narten is no longer conflicted. Two obvious possibilities spring to mind.
There was no news from Amsterdam on ICANN’s CEO hunt.
Incumbent Rod Beckstrom intends to “hand the baton” to his successor at the Prague meeting in late June, and the board already has a favored candidate lined up to replace him.
I understand that this candidate did attend the Amsterdam board retreat, albeit under a veil of secrecy lest his or her identity leak out before official confirmation.
But I also understand that the board has decided to move super-cautiously on the CEO decision, in order to avoid repeating the mistakes of the past.

Comment Tagged: ceo, conflicts of interest, ICANN, new gTLDs, refunds, tas

How to make $10,000 from .xxx domains

The policy body overseeing .xxx domain names plans to dish out grants of up to $10,000 to worthy causes.
The International Foundation For Online Responsibility expects to launch a new IFFOR Grants Program on June 1, according to a March announcement I only just noticed.
According to IFFOR, the grants will be capped at $10,000 per individual or organization and will be given to those who contribute to IFFOR’s four official policy goals:

Fostering communication between the Sponsored Community and other Internet stakeholders
Protecting free expression rights as defined in the United Nations Declaration of Human Rights
Promoting the development and adoption of responsible business practices designed to combat online child abuse images and to support user choice and parental control regarding access to online adult entertainment, and
Protecting the privacy, security, and consumer rights of consenting adult consumers of online adult entertainment goods and services

It seems like a pretty good opportunity for free speech advocacy groups to top up their funding.
ICM Registry, the .xxx manager, gives IFFOR $10 per year for every resolving .xxx domain name registered.
Its funding is therefore very likely approaching the $1.5 million mark in the hundreds of thousands of dollars right about now.

3 Comments Tagged: grants, icm registry, iffor, xxx

ICANN expects up to 2,305 new gTLD applications

After months of speculation, ICANN has finally revealed how many new generic top-level domain applications it expects to receive.
The lowest amount appears to be 2,091.
That’s the number of applications in the TLD Application System when it was taken offline due to the data leakage bug on April 12, ICANN said.
Another 214 applications had been registered but not yet paid for.
That’s a potential total of 2,305 applications.
ICANN has $350 million in application fees in the bank as a result.
How many of the unpaid bids convert to full applications will be key in deciding how many evaluation batches the first gTLD round will have.
Closer to 2,091, and it’s likely to be four batches. Closer to 2,305, and we may see a fifth batch.
With Initial Evaluation expected to take five months per batch, with a possible 11 months after that for the final Extended Evaluations and string contention resolution, it could be June 2015 before the first new gTLD round is completely processed.
It remains to be seen how many unique strings have been applied for, and how many applications will be successful, but with ICANN only planning to delegate 200 to 300 new gTLDs per year, the first round is likely going to last a loooong time.

9 Comments Tagged: ICANN, new gTLDs, tas

Is .xxx really that crappy?

It’s not a huge secret that the new .xxx gTLD isn’t doing as well, five months after launch, as ICM Registry would have hoped, but how does it shape up against other top-level domains?
Domain Name News earlier this week published an analysis of the top one million most-trafficked web sites, according to Alexa rankings, and found that .xxx had just 61 entries.
Per DNN reporter Mike Cohen:

We would not have thought that only 61 domains in total would be ranking inside the top 1,000,000 most visited sites in the world. That number was suppose to be exponentially higher by all accounts even a few month’s in, which we now are well into 2012, however reality says otherwise.

I’m not sure what “all accounts” DNN is referring to — possibly ICM’s marketing hype — but I thought the analysis was interesting so I thought I’d try to replicate it.
This morning I parsed today’s Alexa top million sites list and came up with the following (sortable) table.
[table id=7 /]
These are quick and dirty numbers, based on Alexa data, and my code might be wonky, so please don’t place too much faith in them.
I only looked at the “new” gTLDs introduced since 2001, as well as two mass-market ccTLDs (.co and .me) introduced over the same period.
The .co numbers do not include third-level domains under .com.co and the ccTLD’s other legacy extensions.
The “Months Active” column is the number of months since the TLD was delegated into the DNS root, measured by the date of the first registry report it filed with ICANN or the IANA (re)delegation date, not the date of general availability.
The fourth column is the number of domains divided by the number of months. It’s a fairly arbitrary measure, presented merely to give you an idea of the “success” of the TLD over time.
You could possibly, loosely, think of it as “how many domains a TLD can expect to get into the Alexa 1 Million per month”.
By that measure, .xxx isn’t doing too badly.
It’s even beating .jobs and .tel in absolute terms.

8 Comments Tagged: alexa, icm registry, new gTLDs, xxx

TAS bug hit over 100 new gTLD applicants

It just keeps getting worse.
ICANN’s TLD Application System security bug could have revealed file names belonging to 105 new gTLD applicants to 50 other applicants on 451 occasions, according to the organization.
With 1,268 applicants in the system, those numbers certainly fit with the “a minority of applicants” description previously given, but it still shows that the bug was widespread.
The supplied numbers are “approximate”, but ICANN said it is “continuing to review system logs and packet-level traffic to confirm how many viewings actually did occur.”
The latest news means, for example, that 50 new gTLD applicants may have had the ability to see information belonging to other applicants on average nine times each.
While the new data may not strongly suggest that the bug was deliberately exploited by any applicant(s), it’s not inconsistent with that scenario.
It could mean that one applicant saw the details of 56 others (suggesting exploitation), but it could also mean that 50 applicants saw about two third-party file names each (suggesting accidental viewing).
Without further information, it’s impossible to know.
ICANN has not revealed, and is unlikely to reveal in the short term, whether any applicant was able to view the metadata of another applicant for the same gTLD.
The organization has however started to notify affected applicants whether they were affected as victim or beneficiary, according to the latest update from chief operating officer Akram Atallah.
Atallah also revealed that TAS had 95,000 file attachments in the system when it was taken down April 12.
At an average of 75 files per TAS account, this would support the idea that, on average, each TAS account was being used to file more than one application.
ICANN still plans to wrap up the notification process before next Tuesday, May 8, but there’s no word yet on when TAS will reopen for the final five days of the application window.

8 Comments Tagged: ICANN, security, tas, tld application system. data leakage, vulnerability

Sex.com relaunches as Pinterest for porn

The world’s most valuable domain name has gone all Web 2.0.
Sex.com, which sold for $13 million in 2010, officially relaunched today as the “Pinterest for Sex”, a social networking site for sharing porn.
I must confess I had no clue what “Pinterest” was until ten minutes ago. According to Wikipedia, it’s one of the world’s biggest social networking web sites, bigger than LinkedIn
Perhaps my ignorance can be excused. According to Sex.com’s press release, I’m not the demographic:

Analytics have indicated that women make up over 97% of accounts created on Pinterest. Because of its specific audience, most pictures are of weddings, decorations, recipes and fashion, which seem to be of very little interest to men.

Sex.com is about sharing images of porn, therefore. Man stuff.
I believe this will be the first time the domain name sex.com has been properly “developed” in this way.

3 Comments Tagged: pinterest, sex.com

ICANN budgets for 2,000 new gTLDs

ICANN could net $150 million from a 2,000-application new gTLD round.
That’s according to a proposed budget published for comment last night, which for the first time contemplates more than 500 new generic top-level domain applications.
The budget also contains budgets for 500-application and 1,000-application rounds.
But with ICANN revealing this week that it has 1,268 registered users of its TLD Application System, 2,000 applications is beginning to look extremely plausible.
ICANN would receive $368 million in fees from a 2,000-app round, according to the budget, of which an estimated $33 million would be returned in refunds when applicants withdraw.
But the operating cost of the program would only come in at $156 million – slightly cheaper on a per-application basis than a 500-app round due to volume discounts from its contractors.
What happens to the rest of the money?
About $30 million is returned to the ICANN contingency fund to recoup program development costs. A $31 million surplus could be considered “profit” – it’s budgeted as an increase in net assets.
But the majority – $120 million – is budgeted to the amorphous “risk costs” line item.
The risk fund – sometimes flippantly referred to as the legal war chest – was budgeted to cover unanticipated costs such as delays and litigation.
ICANN evidently does not anticipate any economies of scale here. The $120 million in the budget is a simple multiple of the $30 million it said it needed to cover risk in a 500-application round.
It’s quite possible that ICANN won’t even need to dip into the risk fund, or that it might only need to withdraw a small amount, which would leave it sitting on an embarrassingly large wedge of cash.
The organization has yet to decide how its surplus would be deployed, but it’s going to be kept in a separate bank account and accounted for separately.

5 Comments Tagged: budget, icann. new gtlds

ICANN cancels Fridays. Bad for transparency.

ICANN’s next public meeting, and all its public meetings thereafter, will be a day shorter than usual, following a decision to cancel the regular Friday morning program.
No Friday means no public meeting of the board of directors.
While the move is being characterized as an effort to enhance the effectiveness of ICANN’s board – a particular concern, frequently voiced, of chairman Steve Crocker – it’s also a perplexing shift away from ICANN’s core tenet of transparency.
One of the effects could be to mask dissent on the board.
From now on, it appears that all of ICANN’s top-level decision-making will happen in private.
Instead of wrapping up each public meeting with a board session at which resolutions get voted on, each meeting will instead be book-ended by less formal “community sessions”.
During these sessions, the board will apparently report to attendees about what it has been doing since the last meeting and what it plans to do before the next meeting.
Crocker said in a statement:

We believe that the removal of the Friday public Board meeting and its replacement with two Board community sessions will improve the effectiveness of both the Board and the staff and increase the time that the Board has to interact with the community.

That may well be true — time will tell — but let’s look at what the ICANN community is almost certainly losing.
First, there will be no more transcripts of board meetings at all.
Today, only the public meetings have published recordings and transcripts. Intersessional meetings are minuted, but not transcribed. If recordings are made, they are not published.
Killing off transcripts completely is a pretty obvious step backwards for an organization committed by its bylaws to “operate to the maximum extent feasible in an open and transparent manner”.
Second, if there is dissent on the board, it will be essentially shielded from the community’s view for some time after the fact.
Take, for example, the approval of the new gTLD program or the approval of ICM Registry’s .xxx contract – the two most controversial decisions ICANN made in 2011.
In both cases, certain directors read prepared statements into the record harshly criticizing the majority view.
In March 2011, for example, George Sadowsky stated that ICM’s purported community support for .xxx was “illusory” and that approving the TLD could lead to DNS Balkanization.
And with new gTLDs last June, Mike Silber abstained in the belief that the program was incomplete and that the vote had been scheduled “based on artificial and ego-driven deadlines”.
In both cases, the ICANN community heard the dissenting views – in person, webcast, recorded and transcribed – moments before the vote actually took place.
With no public board meetings, it seems likely that in future that we’re going to have to wait a week to read the voting record for any given resolution and a month or more to read directors’ statements.
Under ICANN’s bylaws, the voting record, which breaks down who voted for and against resolutions, is contained in a preliminary report that is not published for seven days after the vote.
Also under the bylaws, directors’ voting statements are not published until the minutes of the meeting are approved at the board’s next meeting, typically one to two months later.
If the new procedures had been in effect last year, the statements of Sadowsky and Silber would not have been published for over a month after they were made.
With that in mind, it’s clear that killing off the public board meetings could in no way be seen as a positive step for transparency at ICANN.
It’s true that these meetings have for several years been pure theater, but it was theater with value.

2 Comments Tagged: board, ICANN, prague, toronto, transparency

Beckstrom breaks TAS bug silence, says Big Reveal could be as late as Prague

ICANN may not reveal its list of new generic top-level domain applications until as late as the last week of June, according to CEO Rod Beckstrom.
In his first interview since ICANN took its TLD Application System offline due to a security bug, Beckstrom told DI that he “hopes” to host the Big Reveal before he steps down as ICANN’s CEO.
He said he expects to have the new gTLD program back on track before he hands the reins to the organization over to his successor at the end of the ICANN 44 meeting in Prague, June 29:

I’d like to see us obviously get the technical issues resolved, notify applicants, reopen the window and publish the strings before I pass the baton in Prague. That’s not a commitment at this point in time, it’s an indication as CEO that it’s absolutely my intention to push for a timely resolution of this issue… If we can get things done sooner, then the sooner the better.

That’s two months away, a full month later than anyone was expecting.
The Big Reveal was originally scheduled for today. However, the TAS delays made this impossible. Following an ICANN update on Friday, a late-May date for the Big Reveal was looking more probable.
But Beckstrom would not commit even to the Prague date. He said:

That’s my hope as a CEO, to get these issues resolved by that time-frame and have the string reveal in that time-frame. I haven’t committed the organization, I’m indicating to you volitionally my desire as CEO and the person who’s running the organization.

He framed the issue as a blip on a nine-year process (six years of policy development, one year of outreach and application filing, and up to two years of evaluation). He said:

In the context of nine-year program, a delay of between here and Prague of a few months is undesirable, it’s not what we want to have happen, but the quality of this program is more important to everyone involved than the specific date and time. We’re all focused on quality here and not just doing things in a hurry. This program is too important.

He said he is “sympathetic” to applicants that are burning through start-up funding waiting for ICANN to sort this out, but he noted that the same concerns have been raised over the years whenever the program has previously missed a launch deadline.

We know that some parties have been very patient and we know it’s got to be frustrating right now to see any delay in the program. At the same time, I’m sure that those parties are very concerned that this be done well and that the program be reopened and administered successfully.

Beckstrom reaffirmed ICANN’s promise to notify all applicants whether or not they were affected by the TAS bug – which revealed user names and file names to other TAS users – by May 8.
But TAS will not, it seems, reopen immediately after the notifications have been sent. As well as the log audit, ICANN is also working on performance upgrades.
While Beckstrom confirmed that the plan is to open TAS for five business days, to give applicants a chance to finish uploading their applications and confirm that their data has not been corrupted, he would not say when this window is due to open.

We’re going to share more precise dates when we have them. What I can tell you precisely right now is that the key thing we’re working on is combing through this large data set we have so that the parties that were affected are notified within the seven days. When we have clarity on the next milestone in the process we’ll communicate that openly.
…
We’re still doing system testing, we’re still looking at some of the performance issues. We have a whole set of things to do and feel comfortable that we’re ready and have full internal sign off. We’ll notify you and other parties when we have that clarity. Right now we have the clarity that we’re going to get the notification done in seven days – that’s the key dating item at this time.
…
We have very strong reason to believe we understand the bug and we’ve fixed the bug, but every day that we continue to test we gain a higher level of confidence in the system that this specific issue will not reappear.

While the first report of the bug was received March 19, it was not until April 12 that ICANN managed to “connect the dots” and figure out that the problem was serious and recurring, Beckstrom said.
ICANN saw the bug show up again repeatedly on April 12, as many TAS users logged in to finish off their applications, which was why it chose to take the system down with just 12 hours to go before the filing deadline.
ICANN is currently analyzing a 500GB log containing a record of every data packet that went into and out of the TAS between January 12 and April 12, to reconstruct every user session and determine who could see what and when, Beckstrom said.
He refused to comment on whether this analysis has revealed any attempts by TAS users to deliberately exploit the bug for competitive intelligence on other applicants.
He also declined to comment on whether ICANN has discovered instances of data leakage between two applicants for the same gTLD string.
The full packet capture system was introduced following a third-party security audit of the system conducted late last year, he said.
That audit, of course, did not reveal the data leakage vulnerability that continues to delayed the program.
When I put it to him that this is precisely the kind of problem ICANN wanted to avoid, due to the confidentiality of the applications, Beckstrom played down the seriousness of the bug.

Let’s be clear here: some user names and file names were visible, not the contents of applications and not the contents of those files. I think that if that had occurred it would be an even more undesirable situation and we have no indication that that occurred.
I wouldn’t call this a security issue, I’d call this… every major software system we use has bugs in it or bugs that are discovered over time. Whether that’s our operating systems or desktop applications or specific applications, you conduct the best tests you can. You assemble a testing suite, you assemble testers, you take various methods, but there’s never a guarantee that software is bug-free. The issue is that if and when bugs are encountered you deal with them appropriately, and that’s what we’re doing right now.

But Beckstrom admitted that the problem is embarrassing for ICANN, adding that sorting out the mess is currently the top priority.

Obviously any time you have a software problem or technical problem with any program you come under enhanced scrutiny and criticism, and I think that’s understandable, that’s fair. What we’re focused on is resolving this successfully and I think ICANN has dealt with many challenges in its past successfully and we’re committed to resolve this issue professionally.
…
I should tell you that this is our top priority right now internally right now. The resolution of this issue is our number one priority, the number one issue for me as CEO, number one for most members of the executive management team and for a large part of the organization. We’re extremely focused on this.

ICANN plans to reveal how many applicants were affected by the bug at the same time as it notifies applicants, Beckstrom said. It will not publish information about who could see what, he said.
Unfortunately for applicants, it seems they will have to wait well into next week before they have any more clarity on the timetable for TAS coming back online and the application window finally closing.
With Prague now emerged as a potential deadline for the reveal, the delays could in fact be much worse than anyone was expecting.
DI PRO subscribers can read a full transcript of the 30-minute interview.

6 Comments Tagged: data leakage, ICANN, icann 44, new gTLDs, prague, security, tas, tld application system, vulnerability

ICANN expects at least 1,268 new gTLD applications

ICANN is expecting at least 1,268 applications for new generic top-level domains, according to CEO Rod Beckstrom.
Speaking to DI at the weekend, Beckstrom said that the TLD Application System had 1,268 user accounts when registration closed March 29.
That represents a spike of over 50% from the 839 registered TAS accounts that ICANN had reported just four days earlier, March 25.
As before, there is not a one-to-one correlation between the number of TAS accounts and the number of applications. Each TAS account can be used to file up to 50 applications.
However, with each TAS slot costing $5,000, 1,268 now seems to be the minimum number of new gTLD applications we’re likely to see.
“It’s unlikely to be lower than that number,” Beckstrom said.
Read more of our interview with Beckstrom.

Comment Tagged: ICANN, new gTLDs, tas, tld application system