New gTLDs now a month behind schedule

ICANN has announced yet another delay in its new generic top-level domains program.
Last night’s much-anticipated update on its efforts to deal with the fallout of the TLD Application System security bug merely deferred resolution of the problem for a week. Again.
The whole program is now essentially a month behind schedule.
Chief operating office Akram Atallah said in a statement:

ICANN will notify all applicants within the next seven business days whether our analysis shows they were affected by the technical glitch in the TLD application system.
…
Shortly after the notification process has been completed, we will announce the schedule for reopening the application system and completing the application period. We are mindful of the need to allow sufficient time during the reopening period for applicants to confirm the completeness of their submissions.

The seven business days for applicant notifications takes us to May 8.
It’s not clear whether TAS would reopen immediately after this, but I suspect we’re probably looking at a buffer of at least a day or two between the end of notifications and TAS coming back online.
ICANN has previously said that TAS will be open for five business days, to enable applicants to finish off their applications. This brings us to, at the very earliest, May 15.
The Big Reveal of the list of applications, I estimate, will come one to two weeks after that.
We’re essentially looking at a late May or early June finish to a process that should have ended in late April.
As a result, the entire timetable for evaluating, approving and delegating new gTLDs will likely also be pushed out by a month.
For applicants, the anticipated November 12 date for the completion of the first-batch Initial Evaluation phase is now likely to come some time in mid-December instead.
Unhelpfully, the deadlines for filing objections and requesting Extended Evaluation for first-batch applicants is now likely to fall around about January 1, 2013.
That’s assuming we do not see any more delays, of course, which I think would be optimistic.

4 Comments Tagged: batching, delays, digital archery, ICANN, new gTLDs, security, tas, vulnerability

Verisign selected for 220 new gTLDs

Verisign is the appointed back-end registry operator for 220 new generic top-level domain applications, according to the company.
Verisign itself has applied to ICANN for 14 new gTLDs, 12 of which are transliterations — ie, internationalized domain names — of .com and .net.
During its first-quarter 2012 earnings conference call, ongoing right now, CEO Jim Bidzos disclosed the numbers, saying:

VeriSign applied directly for 14 new gTLDs. Twelve of these 14 are transliterations of .com and .net. Also, applicants for approximately 220 new gTLDs selected Verisign to provide back-end registry services.

Many of these are dot-brands, Bidzos said.
Neustar, which also reported earnings yesterday, did not disclose how many applications it is involved in, other than to say that it has not applied for any as a front-end operator.

Comment Tagged: .com, .net, ICANN, new gTLDs, verisign

Newbie domain registrant discovers Whois, has Twitter meltdown

The need for the domain name industry to enforce accurate Whois is often cited by law enforcement and intellectual property interests as a consumer protection measure.
But most regular internet users haven’t got a clue that Whois even exists, let alone what data it contains or how to use it.
A study (pdf) carried out for ICANN’s Whois Review Team last year found that only 24% of consumers know what Whois is.
This stream of tweets I chanced across this afternoon, from what appears to be a first-time domain registrant, is probably more representative of consumer attitudes to Whois.
UPDATE (April 27): I’ve removed the tweets per the request of the Twitter user in question.

17 Comments Tagged: DomainTools, privacy, uk2, whois

Cops seize 36 carder domains

The FBI and UK Serious Organised Crime Agency have seized 36 domain names that were allegedly being used to sell compromised credit card information.
As well as seizing the domains and a number of computers, SOCA said it has arrested two men “suspected of making large scale purchases of compromised data” from the sites.
The sites all used what SOCA calls “automated vending cart” software to process the sale of credit card information. Judging by the video below, some of the operations were fairly professional.
One of the seized domains was cvvplaza.com. SOCA provided the following video which really has to be seen to be believed.

I wonder if the spokesmodel had any idea what she was getting into when she accepted this gig.
While the full list of domains was not released, a SOCA spokesperson said the breakdown by TLD was as follows:

.name – 2
.net – 11
.biz – 4
.us – 5
.com – 11
.org – 3

These are all TLDs whose registries are based in the United States, so I’m guessing the US authorities did the actual seizing.

1 Comment Tagged: cvvplaza.com, fbi, security, seizures, soca

ANA demands TAS bug probe

Never one to miss the chance for a bit of trouble-making, the Association of National Advertisers has demanded a full independent probe into ICANN’s TLD Application System bug.
Writing to ICANN today, ANA president Bob Liodice has pointed to the TAS outage – now in its 13th day – as an example of why the new gTLD program needs to be scaled back.
“Doesn’t this situation demonstrate the need for a pilot project/test roll-out of the new Top Level Domain process to resolve any such problems before a major roll-out?” he asks.
In a press release, he added:

We are urgently requesting that the Department of Commerce and its National Telecommunications and Information Administration (NTIA) exercise their oversight of ICANN and encourage ICANN to engage an independent IT expert to fully investigate this serious and inadequately explained vulnerability.

The ANA has of course been the loudest objector to the program, forming the Coalition For Responsible Internet Domain Oversight last year to lobby against the gTLD expansion.
Liodice’s latest letter puts 10 questions to ICANN, several quite sensible and precisely the kinds of things I plan to ask just as soon as ICANN changes its mind about doing media interviews.
But it also asks for the release of information ICANN has already provided or has said it intends to provide, such as the number of affected TAS users or the date of the first reported incident.
The ANA also does not appear to be aware that the ICANN board new gTLD subcommittee recently passed a resolution calling for more work on the defensive registration problem.
Liodice notes that ICANN has not responded to its demands for a “Do Not Sell” list that would enable brand owners to block others from registering their trademarks in the DNS.
You can read the letter in PDF format here.
ICANN currently plans to provide its next big update on the TAS outage before the end of Friday.

Comment Tagged: ana, association of national advertisers, data leakage, ICANN, new gTLDs, security, tas, vulnerability

ZoneEdit offline for five days

The Dotster-owned DNS service provider ZoneEdit this morning returned from an unexplained five-day outage that has left many users extremely miffed.
The interruption affected only ZoneEdit’s management interface, not its DNS resolution, so it only affected customers who needed to make changes to their zones.
Users first started reporting they couldn’t access their accounts on Friday.
I’ve reported the story for The Register here.

Comment Tagged: dns, dotster, outage, security, zoneedit

OpenRegistry behind 20 new gTLD apps

OpenRegistry will provide the back-end technical infrastructure for 20 new generic top-level domain applications filed by 15 clients, according to a report.
Dutch telco KPN, consultancy Deloitte and financial management firm LPL Financial are among its dot-brand clients, according to Knack.be, quoting executives.
Presumably, we’re looking at bids for .kpn and .lpl as well as .deloitte, which Deloitte confirmed earlier this month.
Its portfolio of applications also includes two cities – one is .gent for Ghent, the other is an American city – and two generic terms that have not yet been revealed.
(UPDATE: While OpenRegistry is not naming the American city, I hear through the grapevine that it might be Boston).
Its clients have a total market cap of $150 billion, according to the report.
That’s not a bad roster for the start-up, whose technical arm is known as Sensirius. The Benelux company was founded in late 2010 by former executives from EuroDNS and Belgian ccTLD manager DNS.be.
A year ago it won the contract to manage the back-end for .sx, the new ccTLD for Sint Maarten.

3 Comments Tagged: .gent, .kpn, .lpl, deloitte, ICANN, lpl financial, new gTLDs, openregistry, sensirius

Rugby board tries for .rugby with TLDH

The International Rugby Board has applied to ICANN for the generic top-level domain .rugby with Top Level Domain Holdings, the IRB announced today.
It appears to be a defensive as well as offensive move, judging by the press release.
It’s about “protecting and promoting Rugby’s values and ethos” and ensuring .rugby “resides within the sport”, according to IRB chairman Bernard Lapasset.
The application will be filed in partnership with TLDH, as well as a new company called ROAR Domains, which appears to be a part of a Kiwi sports marketing agency.
If the bid is successful, TLDH subsidiary Minds + Machines will provide the registry back-end.
The IRB is the international body for rugby associations which organizes the Rugby World Cup.
There are already a few .sport bids, and the Australian Football League has applied for a .afl dot-brand, but I think .rugby may be the first sport-specific gTLD application to be announced.

1 Comment Tagged: ICANN, international rugby board, irb, new gTLDs, roar domains, tldh, top level domain holdings

TAS down for at least another week

If you’re just joining us, welcome to the ICANN community.
The TLD Application System will be offline for another week, possibly more, as ICANN struggles to deal with the fallout from its embarrassing data leakage bug.
ICANN had promised an update today on the timing of the reopening of TAS, which was taken offline April 12 just 12 hours before the new gTLD application filing deadline arrived.
But what applicants got instead was a promise to provide another timing update a week from now.
Chief operating officer Akram Atallah said in a statement:

identifying which applicants may have been affected by the technical glitch, and determining who may have been able to see someone else’s data, require extensive analysis of a very large data set. This is a time-consuming task, but it is essential to ensure that all potentially affected applicants are accurately identified and notified.
Until that process is complete, we are unable to provide a specific date for reopening the application system.
In order to give all applicants notice and an opportunity to review and complete their applications, upon reopening the system we will keep it open for at least five business days.
No later than 27 April 2012 we will provide an update on the reopening of the system and the publication of the applied-for new domain names.

So the best-case scenario, if these dates hold up, would see TAS coming back online Monday, April 30 and closing Friday, May 4.
The April 30 target date for the Big Reveal is clearly no longer possible.
ICANN has stated previously that it expects to take two weeks between the closing of the application window and the revelation of the list of gTLDs being applied for.
The Big Reveal could therefore be postponed until mid-May, almost a month from now.
Any applicant who has already booked flights and hotels in order to attend one of the various reveal events currently being planned by third parties may find themselves out of pocket.
Regular ICANN participants are of course accustomed to delay.
ICANN’s image problem now is rather with the hundreds of companies interfacing with the organization for the first time, applying for new gTLDs, which may be wondering whether this kind of thing is par for the course.
Well, yes, frankly, it is.
That said, the time to avoid this problem was during testing, before the application window opened in January.
Now that the bug has manifested, it’s probably in most people’s best interests for ICANN to fully understand went wrong and what impact it could have had on which applicants. This takes time.

Comment Tagged: data leakage, delay, ICANN, new gTLDs, security, tas

ICANN vows to fight TAS bug “monkey business”

ICANN chief security officer Jeff Moss has pledged to fully disclose what new gTLD application data was leaked to which users via the TLD Application System security bug.
Talking to ICANN media chief Brad White in a video interview, Moss said:

We’re putting everyone on notice: we know what file names and user names were displayed to what people who were logged in and when. We want to do this very publicly because we want to prevent any monkey business. We are able to reconstruct what file names and user names were displayed.

ICANN has been going through its logs and will know “very specifically” what data was visible to which TAS users, he said.
The bug, he confirmed, was related to file deletions:

Under certain circumstances that were hard to replicate users that had previously deleted files could end up seeing file names of users that had uploaded a file… Certain data was being revealed to users that were not seeking data, it was just showing up on their screen.

The actual contents of the files uploaded to TAS were not visible to unauthorized users, he confirmed. There are also no reasons to believe any outside attacks occurred, he said.
He refused to reveal how many applicants were affected by the vulnerability, saying that ICANN has to first double-check its data in order to verify the full extent of the problem.
The interview reveals that the bug could manifest itself in a number of different ways. Moss said:

The problem has several ways it can express itself… we would solve it one way and it would appear another way, we would solve it another way and it would appear a third way. At some point we were just uncomfortable that we understood the core issue and that’s when we took the system offline.

TAS was taken down April 12, just 12 hours before the new gTLD application window closed.
ICANN has been providing daily updates ever since, and has promised to reveal tonight when TAS will reopen for business, for how long, and whether April 30 Big Reveal day has been postponed.
Applicants first reported the bug March 19, but ICANN did not realize the extent of the problem until later, Moss said.

In hindsight now we realized the 19th was the first expression of this problem, but at the time the information displayed made no sense to the applicant, it was just random numbers… at that point there were no dots to connect.

Here’s the video:

12 Comments Tagged: data leakage, ICANN, new gTLDs, security, tas