European privacy watchdog says ICANN’s Whois demands are “unlawful”

European Union privacy officials have told ICANN that it risks forcing registrars to break the law by placing “excessive” demands on Whois accuracy.
In a letter to ICANN yesterday, the Article 29 Working Party said that two key areas in the proposed next version of the Registrar Accreditation Agreement are problematic.
It’s bothered by ICANN’s attempt to make registrars retain data about their customers for up to two years after registration, and by the idea that registrars should re-verify contact data every year.
These were among the requests made by law enforcement, backed up by the Governmental Advisory Committee, that ICANN has been trying to negotiate into the RAA for almost a year.
The letter (pdf) reads:

The Working Party finds the proposed new requirement to re-verify both the telephone number and the e-mail address and publish these contact details in the publicly accessible WHOIS database excessive and therefore unlawful. Because ICANN is not addressing the root of the problem, the proposed solution is a disproportionate infringement of the right to protection of personal data.

The “root cause” points to a much deeper concern the Working Party has.
Whois was designed to help people find technical and operational contacts for domain names, it argues. Just because it has other uses — such as tracking down bad guys — that doesn’t excuse infringing on privacy.

The problem of inaccurate contact details in the WHOIS database cannot be solved without addressing the root of the problem: the unlimited public accessibility of private contact details in the WHOIS database.

It’s good news for registrars that were worried about the cost implications of implementing a new, more stringent RAA.
But it’s possible that ICANN will impose the new requirements anyway, giving European registrars an opt-out in order to comply with local laws.
The letter is potentially embarrassing for the GAC, which seemed to take offense at the Prague meeting this June when it was suggested that law enforcement’s recommendations were not being balanced with the views of privacy watchdogs.
During a June 26 session between the GAC and the ICANN board, Australia’s GAC rep said:

I don’t come here as an advocate for law enforcement only. I come here with an Australian government position, and the Australian government has privacy laws. So you can be sure that from a GAC point of view or certainly from my point of view that in my positions, those two issues have been balanced.

That view was echoed during the same session by the European Commission and the US and came across generally like a common GAC position.
The Article 29 Working Party is an advisory body set up by the EU in 1995. It’s independent of the Commission, but it comprises one representative from the data privacy watchdogs in each EU state.

12 Comments Tagged: .eu, article 29 working party, gac, ICANN, law enforcement, privacy, raa, whois

Directi says Karsten threatened it over .ping gTLD

The golf club maker Karsten has launched an attack on Directi due to their dispute over the new gTLD .ping, following through on threats Directi says the company made last month.
Karsten’s outside counsel, Paul McGrady of Winston & Strawn, filed over 200 comments and a 500-page letter against Direct’s new gTLD applications last night, shortly before the ICANN deadline.
In the comments, McGrady says that Directi should be banned from running any new gTLDs because its affiliated privacy service, PrivacyProtect.org, has lost dozens of UDRP cases.
But Directi said today that the Strawn comments — filed against applications such as .web, .hosting and .app — are just a smokescreen for Karsten’s claim over .ping.
Ping is a brand of golf clubs Karsten sells at ping.com, but Directi plans to use the gTLD in its other, geeky sense, open to all-comers.
Directi says that Karsten told it in an August 8 letter to withdraw the .ping bid or face action. According to Directi, the letter said in part:

Karsten is preparing to post this letter and the attached public comments for each of your applications, not just .ping, prior to the end of the public comment period. Once filed, this letter and the public comments will also be sent to the ICANN Board and Senior Staff. Further, as you know, Karsten may seek relief from the courts, through ICANN’s various processes, and through raising awareness of your activities within the ICANN community generally. Karsten will pursue all appropriate means to ensure that all of your applications are rejected.

Directi said in a statement: “Karsten is our only competitor for the .ping bid and their comment is submitted in bad faith and to further their self-interest.”
CEO Bhavin Turakhia said that PrivacyProtect.org did not own any of the domain names listed in the UDRP cases McGrady cited, it merely acted as the privacy service.
The company removes the privacy protection when UDRPs are filed, he said, but the registrant’s identity is not always listed in the published decision.

Comment Tagged: .ping, directi, ICANN, karsten, new gTLDs, radix, Winston & Strawn

Beckstrom probed over bizarre spam complaint

ICANN’s Ombudsman looked into a complaint that former CEO Rod Beckstrom allegedly spammed community members the day after he left the organization, it has emerged.
Whoever filed the complaint evidently did not like Beckstrom one bit.
According to Ombudsman Chris LaHatte, who rejected the complaint, the complainant said:

I wish to file a formal complaint about the below SPAM originating from ICANN’s servers. Since Mr. Beckstrom has left yesterday it is clear that he cannot have had access to ICANN infrastructure any longer. If however this were the case, one would have to consider YET ANOTHER serious breach. In any case I do not wish to receive communications of any kind from this person, Mr. Beckstrom. Please confirm receipt of this complaint, commence an investigation and advise me of the outcome.

LaHatte found that the email in question was “a courteous farewell and introduction to the new CEO” sent to between 50 and 60 people, all movers and shakers in the ICANN community.
According to LaHatte, who blogged about the complaint today:

After discussing this matter with the ICANN staff, it is clear that this email was in fact not spam in the common meaning of the term. Spam is usually considered bulk emailing sent indiscriminately to very large numbers of recipients. By way of contrast, 60 emails specifically tailored for groups of recipients is hardly unusual within a large organisation such as ICANN.

I know Beckstrom was not a massively popular individual with some in the ICANN community, but this complaint seems to be way out of proportion for a simple unwanted email.
Somebody out there needs to take a chill pill.

4 Comments Tagged: ICANN, Ombudsman, rod beckstrom, spam

ICANN publishes RFI for URS provider

ICANN has issued an open call for dispute resolution providers interested in running its Uniform Rapid Suspension system.
In a request for information published last night, ICANN says it expects to pick a provider or providers by February 28, 2013.
If you’re not already running a dispute resolution service at scale there seems to be little point in applying. The RFI states that respondents must, at a minimum:

Have a track record in competently handling clerical aspects of Alternative Dispute Resolution or UDRP proceedings
…
Have a team of globally diverse and highly qualified neutrals, with experience handling UDRP or similar complaints, to serve as panelists.

With that in mind, will the RFI help sort out the problems with the URS?
What ICANN needs right now is a provider happy to administer proceedings for $300 to $500 per case.
ICANN has already asked WIPO and the National Arbitration Forum for their pricing expectations and neither apparently thinks they can do it much cheaper than UDRP. Hence the RFI.
Could the Czech Arbitration Court be in with a shot?
CAC already has UDRP experience and a stable of trademark experts on hand, and some say its level of automation is superior to — and presumably more cost-efficient than — both WIPO and NAF.

Comment Tagged: cac, czech arbitration court, ICANN, naf, udrp, urs, wipo

Identity checks coming to Whois

Pretty soon, if you want to register a domain name in a gTLD you’ll have to verify your email address and/or phone number or risk having your domain turned off.
That’s the latest to come out of talks between registrars, ICANN, governments and law enforcement agencies, which met last week in Washington DC to thrash out a new Registrar Accreditation Agreement.
While a new draft RAA has not yet been published, ICANN has reported some significant breakthroughs since the Prague meeting in June.
Notably, the registrars have agreed for the first time to do some minimal registrant identity checks — phone number and/or email address — at the point of registration.
Verification of mailing addresses and other data points — feared by registrars for massively adding to the cost of registrations — appears to be no longer under discussion.
The registrars have also managed to win another concession: newly registered domain names will be able to go live before identities have been verified, rather than only after.
The sticking point is in the “and/or”. Registrars think they should be able to choose which check to carry out, while ICANN and law enforcement negotiators think they should do both.
According to a memo released for discussion by ICANN last night:

It is our current understanding that law enforcement representatives are willing to accept post-­‐resolution verification of registrant Whois data, with a requirement to suspend the registration if verification is not successful within a specified time period. However, law enforcement recommends that if registrant Whois data is verified after the domain name resolves (as opposed to before), two points of data (a phone number and an email address) should be verified.

Among the other big changes is an agreement by registrars to an ICANN-run Whois privacy service accreditation system. Work is already underway on an accreditation framework.
After it launches, registrars will only be able to accept private registrations made via accredited privacy and proxy services.
Registrars have also agreed to some of law enforcement’s data retention demands, which has been a bone of contention due to worries about varying national privacy laws.
Under the new RAA, they would keep some registrant transaction data for six months after a domain is registered and other data for two years. It’s not yet clear which data falls into which category.
These and other issues outlined in ICANN’s latest update are expected to be talking points in Toronto next month.
It looks like a lot of progress has been made since Prague — no doubt helped by the fact that law enforcement has actually been at the table — and I’d be surprised if we don’t see a draft RAA by Beijing next April.
How long it takes to be adopted ICANN’s hundreds of accredited registrars is another matter.

4 Comments Tagged: gac, ICANN, law enforcement, privacy, proxy, raa, registrar accreditation agreement, whois

Governments to focus on new gTLDs during ICANN’s new eight-day Toronto meeting

ICANN may have received a bit of flak for cancelling Fridays earlier this year, but as it turns out ICANN meetings are getting longer, not shorter.
The recently published schedule for next month’s Toronto meeting covers eight days, from Friday October 12 to Friday October 19.
The official start of the event will as always be on the Monday (with the work really starting on the Saturday) and the official end will be on Thursday for the second time in a row.
But this time there’s also going to be some special-interest sessions on both Fridays too.
In a change to the usual order of things, the Governmental Advisory Committee has scrapped some of its meetings with other ICANN advisory committees and supporting organizations.
Instead, word is that the GAC plans to focus almost entirely on developing its new gTLD Early Warnings — preliminary warnings about objectionable applications — during the Toronto meeting.
It’s replacing its smaller inter-committee sessions with a one-off High-Level Meeting with SO and AC heads, which we understand is designed to bring newly participating governments up to speed on how ICANN works.
Should we expect to see a bigger GAC in Toronto, now that governments have the opportunity to start complaining about specific applications? It certainly seems possible.

Comment Tagged: early warnings, gac, ICANN, icann 45, new gTLDs, toronto

Tonkin says better new gTLD trademark protections could come in the first round

Groups pushing for stronger new gTLD trademark protection mechanisms could get some of their wishes if they present a unified, coherent position to ICANN.
That’s according to Melbourne IT chief strategy officer and ICANN vice chairman Bruce Tonkin, speaking to DI today about the company’s trademarks summit in Washington DC last week.
Tonkin said that the event identified five rough areas of consensus about changes to rights protection mechanisms, at least two of which could be made before new gTLDs start to go live (which he expects to happen in the fourth quarter of 2013).
The Business Constituency, IP Constituency and so-called “brand summit” are now talking about their areas of common ground and are expected to continue the conversation at the ICANN meeting in Toronto next month.
One area of apparent agreement is an extension to the Trademark Claims service – which alerts trademark owners when somebody registers a domain matching their mark – beyond the 60 days mandated by the Applicant Guidebook.
Trademark interests want the service made permanent, because cybersquatters don’t suddenly stop registering infringing domain names 60 days after a TLD hits general availability.
ICANN has resisted this change, as CEO Fadi Chehade explained last week, largely because several companies already offer commercial trademark watch services.
Many registries and registrars are also against such a move due to the potential cost considerations.
However, Tonkin does not appear to be convinced by either argument.
“Even though a single gTLD might be for 60 days, gTLDs will launch at a range of different times over a number of years. Registries and registrars will have to support that process over a couple of years,” he said. “The cost to industry to extend it over 60 days isn’t that high.”
While supporting the extension may seem like an own goal for Melbourne IT – one of the companies already selling brand monitoring services – Tonkin is not too concerned about losing business.
The value of such services is in the added intelligence, such as monitoring the usage of infringing domains and recommending recovery strategies, he said, not just supplying lists of domains.
“Just that raw data isn’t especially beneficial,” he said.
There’s also no service on the market today that, like Trademark Claims, alerts registrants about third-party trademark rights at the point of registration, Tonkin noted.
Extending Trademark Claims could be seen as a matter of implementation, rather than policy, and may be one of the easiest goals for the trademark community to achieve.
“With enough community support, GNSO advice or ALAC advice could be presented to the board, which could make changes to the Applicant Guidebook,” Tonkin said.
“But I think the board would be reluctant to do that unless it saw very clear support from the community,” he added.
A faster, cheaper Uniform Rapid Suspension system is something that could also be made to happen via “implementation” tweaks, he indicated.
Trademark owners are looking for URS to be priced in the $300-$500 range, which WIPO and the National Arbitration Forum don’t think is feasible the way it is currently structured.
ICANN plans to issue a Request For Proposals soon, according to chief of strategy Kurt Pritz, in order to see if any other provider can do it more cheaply, however.
Another request from trademark holders, to do registrant identity checking — such as email authentication — could be handled via the ongoing Registrar Accreditation Agreement talks, Tonkin suggest.
But other emerging consensus areas would be more suited to a full GNSO Policy Development Process, he said.
The IP community wants the Trademark Clearinghouse to include not only exact matches of their trademarks, but also mark+keyword records (such as googlesearch.tld or paypalpayments.tld).
While there’s agreement in principle among these constituencies, there are still some differences in the details, however.
Some say that the keywords should be limited to words included in the trademark registration, while others believe that mark+keywords won in UDRP cases should be included.
If the former approach is used, domains such as paypal-support.tld, to borrow the example repeatedly used at last week’s summit, would probably not be protected.
Tonkin said that last week’s summit seemed to produce agreement that an algorithmic approach would be too complex, and would generate far to many false positives, to be effective.
A PDP would also be likely be required to find agreement on a mandatory “blocking” system, along the lines of what ICM Registry created for its Sunrise B, Tonkin said.
The problem with PDPs is that they take a long time, and it’s very unlikely that they could produce results in time for the first new gTLD launches.
Tonkin, however, suggested that moving forward with a PDP would create a strong incentive for new gTLD registries to create and adhere to voluntary best practices.
He pointed out that many applicants plan to bring in stronger rights protection mechanisms than ICANN requires already.
While Tonkin is vice chairman of ICANN’s board, he’s not involved in any new gTLD decisions or discussions due to his conflict of interest as a senior executive at a major registrar.

2 Comments Tagged: cybersquatting, ICANN, new gTLDs, tmch, trademark claims, trademark clearinghouse, uniform rapid suspension, urs

Delaware secretary of state opposes any corporate-themed new gTLDs

The secretary of state for Delaware has come out in opposition to new gTLD applications such as .inc, .corp and .ltd.
Jeff Bullock filed the comments with ICANN today, despite having previously suggested that some applications might have sufficient restrictions to make them acceptable.
Bullock wrote (emphasis added):

none of the applications contains a fully thought out, achievable, transparent and enforceable system for fully safeguarding that a firm remains legally registered with a company registry at all times.
…
none of the applications adequately safeguards consumers, legitimate businesses, the public at large, state regulators, and the internet itself from the risks that “company endings” are used for fraudulent or misleading purposes.
Therefore, at this stage of the gTLD process, I strongly believe that the public is best served if these company endings are not made available for use. There is no overriding public policy purpose or strong business case for making them available and the opportunity for fraud and abuse is very high.

There are a few dozen corporate-themed gTLD applications, including contests for: .inc, .corp, .llp, .ltd, .company and .gmbh.
Back in March, before any of the applications had been published, Bullock and other secretaries of state said that such gTLDs should only be approved with “restrictions that would attempt to protect legitimate businesses and consumers from confusion or fraud.”
His letter suggested that DOT Registry’s proposals might be adequate, but he’s apparently changed his mind after reading the applications.
Based on the March letters, I’d say there’s a strong possibility of objections being filed against some or all of these applications.
Delaware is of course the state most big US companies choose to register themselves in, due to its generous company laws.

2 Comments Tagged: .company, .gmbh, .inc, .llc, .llp, .ltd, delaware, ICANN, new gTLDs

New ICANN chief pours cold water on new gTLD trademark protection demands

Some of the enhanced trademark protection mechanisms being discussed currently by the IP lobby seem unlikely to be adopted by ICANN any time soon, if a response to Congress from new CEO Fadi Chehadé is any guide.
In a letter published tonight, Chehadé appears to rule out both the inclusion of ‘brand+keyword’ records in the Trademark Clearinghouse and an extension of the Trademark Claims service beyond 60 days.
These are two of the common demands to emerge recently from ICANN’s Business Consituency, Intellectual Property Constituency, and the so-called “brand summit” proposal.
The Chehadé letter was sent yesterday to the chairs and ranking members of the Judiciary Committees of both the House and Senate, in response to their August 7 letter.
On extending the Trademark Claims service — which alerts trademark owners when somebody registers a domain exactly matching their mark — beyond the current 60 days, he wrote:

For the first round of new gTLDs, ICANN is not in a position to unilaterally require today an extension of the 60-day minimum length of the trademark claims service. The 60-day period was reached through a multi-year, extensive process with the ICANN community. One reason for this is that there are existing IP Watch services that address this needs. Those community members that designed the Trademark Claims process were cognizant of existing protections and sought to fill gaps, not replace existing services and business models.

While this obviously does not rule out an extension of Trademark Claims, it’s pretty clear from the letter that ICANN has no plans to do so without some form of community consent.
On the matter of brand+keyword protections, seen by the trademark community as a crucial component of a strong anti-cybersquatting regime, Chehadé wrote:

It is important to note that the Trademark Clearinghouse is intended be a repository for existing legal rights, and not an adjudicator of such rights or creator of new rights. Extending the protections offered through the Trademark Clearinghouse to any form of name (such as the mark + generic term suggested in your letter) would potentially expand rights beyond those granted under trademark law and put the Clearinghouse in the role of making determinations as to the scope of particular rights.

He goes on to say that providing enhanced rights protection mechanisms is optional for new gTLD registries and may be one way that they can competitively differentiate themselves.
Indeed, large applicants such as Donuts, Uniregistry and Google say they will offer RPMs that go above and beyond what is required by ICANN.
Extended trademark claims and the brand+keyword protections are two of the changes to the current proposed mesh of mechanisms that the trademark community has found common ground on recently.
At the Melbourne IT trademark summit in Washington DC earlier this week, these two areas were among those that appeared to have the most consensus.
However, applicants for mass-market gTLDs are fervently opposed to changes being made to the Applicant Guidebook at this late stage.
Jon Nevett, co-founder of Donuts, said at the Melbourne IT event that “the Applicant Guidebook at this point should be deemed closed”.
He pointed out that, having paid ICANN about $350 million in application fees, applicants should be considered contracted parties and have their expectations respected.

8 Comments Tagged: congress, ICANN, new gTLDs, trademark claims, trademark clearinghouse

Consumer Watchdog slams “outrageous” Google and Amazon keyword gTLD bids

Consumer Watchdog, a California-based consumer rights advocacy group, has attacked Google and Amazon’s new gTLD applications in a letter to an influential senator.
The organization has asked Sen. Jay Rockefeller, chair of the Senate Commerce, Science and Transportation Committee, to “thwart” the “outrageous” plans for single-registrant dictionary-word gTLDs.
Google and Amazon have separately applied for dozens of gTLDs — such as .music, .blog and .book — that they would exclusively use to market their own products and services.
Consumer Watchdog said in its letter (pdf):

If these applications are granted, large parts of the Internet would be privatized. It is one thing to own a domain associated with your brand, but it is a huge problem to take control of generic strings. Both Google and Amazon are already dominant players on the Internet. Allowing them further control by buying generic domain strings would threaten the free and open Internet that consumers rely upon. Consumer Watchdog urges you to do all that you can to thwart these outrageous efforts and ensure that the Internet continues its vibrant growth while serving the interests of all of its users.

As we reported yesterday, a number of domain name industry participants are planning to complain to ICANN about these applications on pretty much the same grounds.

1 Comment Tagged: .blog, .book, .music, amazon, google, ICANN, new gTLDs, senate, single-registrant