Chance of new gTLD delay “above zero”

ICANN has not completely ruled out the possibility that its new generic top-level domains program will be delayed, according to senior vice president Kurt Pritz.
Pritz was asked during a meeting of the GNSO Council last week whether the recent Congressional hearings into new gTLDs could lead to a delay of the January 12 launch.
“I think the risk is above zero,” Pritz said.
An “above zero” risk of delay could still mean a very small risk, of course.
He went on to point out that “the reputation of the multi-stakeholder model is wrapped up in this too”, and that to delay would be a disservice to all the people who have worked on the program.
He noted that the National Telecommunications and Information Administration assistant secretary Larry Strickling has come out in strong support of the multi-stakeholder model.
While the NTIA does not plan to enforce a delay, ICANN itself could make the decision under political pressure from elsewhere in the US, such as from Congress or the Federal Trade Commission.
Pritz faced a rough ride during a House Energy and Commerce Committee hearing last week, during which a number of Congressmen said they believed delay was appropriate.
The committee was largely concerned about the possible costs to trademark holders and implications for law enforcement agencies.
The hearing was called following lobbying by the Association of National Advertisers and the Coalition for Responsible Internet Domain Oversight.

7 Comments Tagged: congress, ftc, ICANN, new gTLDs, new TLDs, ntia

UDRP reform put on hold for four years

ICANN’s cybersquatting rules, including the Uniform Dispute Resolution Policy, will be reviewed and possibly reformed, but probably not until 2016 at the earliest.
The Generic Names Supporting Organization Council voted last Thursday to put the start of UDRP reform on hold until 18 months after the first new top-level domains go live.
The review will also take into account other cybersquatting policies including Uniform Rapid Suspension, which will be binding on all new gTLD registries but has yet to be be tested.
This is the relevant part of the resolution:

the GNSO Council requests a new Issue Report on the current state of all rights protection mechanisms implemented for both existing and new gTLDs, including but not limited to, the UDRP and URS, should be delivered to the GNSO Council by no later than eighteen (18) months following the delegation of the first new gTLD.

An Issue Report is compiled by ICANN staff and often leads to a Policy Development Process that creates policies binding on registries, registrars and ultimately registrants.
Because the first new gTLDs are not expected to be delegated until the first quarter of 2013 at the earliest, the Issue Report would not be delivered until half way through 2014.
After ICANN public comment and analysis, the GNSO Council would be unlikely to kick off a PDP until the first half of 2015. The PDP itself could take months or years to complete.
In short, if UDRP is going to be reformed, we’re unlikely to see the results until 2016.
The Council resolution, which was in line with Governmental Advisory Committee advice, was proposed by the registries, following many months of ICANN public outreach and discussion.
Non-commercial users in the GNSO were most strongly in favor of an accelerated timetable, but a request to reduce the 18-month breather to a year failed to find support.
The Intellectual Property Constituency had proposed an amendment that would have kicked off the process after 100 UDRP and 100 URS cases had been heard in new gTLDs, rather than after a specified time, but the motion was defeated.

2 Comments Tagged: cybersquatting, gnso, ICANN, new gTLDs, udrp, urs

ICANN bleeps brand names from new gTLDs podcast

Nike is a dirty word at ICANN.
At least, that’s my conclusion after listening to ICANN’s latest Start podcast on the new gTLDs program, which bleeps out the names of brands given as examples.
During a discussion between communications staffers Scott Pinzon and Michele Jourdan about the possibility of .brand top-level domains, Jourdan remarks:

If you’re looking for [BLEEP!] shoes and you go to shoes.[BLEEP!] you can be pretty sure that those are going to be actual [BLEEP!]-branded shoes.

Later, Pinzon poses a hypothetical:

I have an idea on how I think I can make a lot of money. I’m going to apply for the TLD dot-[BLEEP!] and then just hold out until a certain firm bought it from me. What are my chances?

It just sounds filthy (at least it does with my mind filling in the blanks).
Since I assume Pinzon and Jourdan would not have used words they intended to subsequently censor, I’m thinking an excessively paranoid legal department is probably to blame here.
You can download the 20-minute podcast, which is aimed at new gTLD newbies, here.

5 Comments Tagged: ICANN, new gTLDs, new TLDs

Key-Systems wins .dm registry deal, 20 others

The German domain name registrar Key-Systems will provide the registry platform for Dominica’s soon-to-relaunch .dm country-code domain, the company has announced.
The company will provide local registry manager DotDM Corp with “tools to facilitate .dm registrations at the registry, registrar and reseller levels”, according to a press release.
It’s the first TLD deal Key-Systems, under its KSregistry registry services brand, has announced since it stopped providing back-end services for .cd back in 2005.
But KSregistry will also be involved in “more than 20” new ICANN gTLD applications next year, including brand, geographic and generic strings, according to a spokesperson.
DotDM has been the de facto manager of the .dm zone since 2001, but did not receive its official IANA redelegation until 2007. It plans to “market the .dm suffix worldwide” according to its web site.
It plans to launch the new system in the first quarter next year and is currently looking for registrars interested in accreditation.
Dominica is a small Caribbean island with a population of around 72,000, best known for its bananas.

Comment Tagged: .dm, cctlds, dominica, ICANN, key-systems, ksregistry, new gTLDs

Will new gTLDs really increase phishing?

The US Federal Trade Commission has come out swinging against ICANN’s new generic top-level domains program, saying it will increase online fraud and should be scaled back.
In an open letter to ICANN’s top brass yesterday, the FTC’s four commissioners claimed that “the dramatic introduction of new gTLDs poses significant risks to consumers”.
Saying that more gTLDs will make it easier for scammers to acquire domain names confusingly similar to existing brands, the commissioners said the program should be rolled out as a limited pilot.
The FTC commissioners wrote (pdf):

A rapid, exponential expansion of gTLDs has the potential to magnify both the abuse of the domain name system and the corresponding challenges we encounter in tracking down Internet fraudsters. In particular, the proliferation of existing scams, such as phishing, is likely to become a serious challenge given the infinite opportunities that scam artists will now have at their fingertips. Fraudsters will be able to register misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down the site and launching a new one.

The letter demands better Whois accuracy enforcement, better ICANN compliance programs, and a cap on approved new gTLDs in the first round perhaps as low as a couple dozen.
The FTC’s claims that new gTLDs will increase phishing may not be supported by reality, however.
The latest data (pdf) from the Anti-Phishing Working Group shows that in the first half of the year only 18% of domain names used in phishing attacks were registered by the attacker.
That was down from 28% in the second half of 2010. Phishers are much more likely to compromise a domain belonging to somebody else – by hacking a web server, for example.
Of the 14,650 maliciously registered domains 10,444 (70%) were used to phish Chinese targets, “overwhelmingly” the e-commerce site Taobao.com, the APWG found.
Furthermore, only 2% of these domains – just 1,816 over six months – were judged to have been registered due to their confusing similarity with the brands they target.
The APWG said (emphasis in the original):

These are the lowest numbers we have observed in the last past four years, and show that using domain names containing brand strings has fallen further out of favor among phishers.
…
the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories

The APWG found only one gTLD that ICANN has introduced – .info, with 4.5% – in its top ten phishing TLDs. The .com space accounts for 48.9% of all phishing domains.
Will the increase in the number of gTLDs reverse these trends? The FTC seems to think so, but the claims in its letter appear to be based largely on guesswork and fear rather than data.
I suspect that the FTC’s letter is more concerned with ICANN’s ongoing bilateral talks with registrars over law enforcement-demanded amendments to the Registrar Accreditation Agreement.
These talks are completely separate and distinct from the new gTLDs program policies, but in the last few weeks we’ve seen them being repeatedly conflated by US lawmakers, and now the FTC.
This may be ignorance, but it could just as well be an attempt to apply political pressure on ICANN to make sure the RAA talks produce the results law enforcement agencies want to see.
ICANN does not want to be forced into an embarrassing retreat on its hard-fought gTLD expansion. By producing a strong RAA, it could deflect some of the concerns about the program.

10 Comments Tagged: anti-phishing working group, apwg, cybersquatting, federal trade commission, fraud, ftc, ICANN, new gTLDs, new TLDs, phishing

Typosquatting is huge but not dangerous, study finds

A study of typosquatted domain names has found that the practice is reaching pandemic levels for the largest brands, but that there’s surprisingly little malware distribution going on.
The security company Sophos surveyed 2,249 domains that were one letter different to the .com sites of Facebook, Google, Twitter, Apple and Microsoft, and found that two thirds resolved.
Not all of those 1,502 sites were malicious typosquats; some were legitimate sites that just happened to have similarly spelled names (such as goole.com and witter.com) Sophos noted.
Apple was the most-squatted company, according to this method: resolving Microsoft typos were at 61%, Twitter at 74%, Facebook at 81%, Google at 83% and Apple at 86%.
Sophos concluded that “there is a significant typosquatting ecosystem around high-profile, often-typed domain names.”
But it did not find as much malware as it was expecting, with only one domain leading to a malware site, 0.07% of the total.
However, 2.7% of the URLs “fell into the loose category of cybercrime”, which “means they are, or have been, associated with hacking, phishing, online fraud or spamming”.
The report, which also fingers parking services from Demand Media, Sedo, Oversee and Bodis as the recipients of 37% of the typo traffic, contains much more data and is well worth a read.
Annoyingly, it appears that Sophos only surveyed .com domains, so the data doesn’t really tell us much about the impact of TLDs (such as .co) on the typosquatting problem.

2 Comments Tagged: cybersquatting, security, sophos, typosquatting

Half the industry fighting over EBERO contracts

ICANN received a whopping 14 responses to its recent request for emergency back-end registry operators, contracts that could turn lucrative if and when new gTLDs start going out of business.
Following a request for information last month, responses received before the December 5 deadline came from Europe, Asia and North and South America, ICANN’s Karla Valente blogged.
While 14 may not seem like a lot, I’m only aware of 19 companies that are actively marketing new gTLD back-end registry services, so it’s a pretty high response rate.
The EBERO’s job is to make sure domain names continue to work after a new gTLD registry goes out of business. In the worst case scenario, it keeps the names resolving for up to three years, giving registrants the opportunity to migrate to another TLD.
The EBERO may, and I’m speculating here, also have an advantage in talks to take over the failed TLD full-time.
The successful providers will be paid from the Continuing Operations Instrument, a big chunk of cash that all new gTLD applicants are obliged to put aside to pay for their own funeral costs.
The price the successful EBEROs intend to charge is an important consideration when applicants calculate the size of their own COI, but those numbers have not yet been revealed.
The EBERO idea has come in for a bit of criticism due to ICANN’s high technical demands – 25,000 concurrent connections for an essentially stagnant TLD, for example – which some say favors incumbent registry operators such as VeriSign, Afilias and Neustar.
ICANN may wind up selecting more than one EBERO when it makes its decision early next year.

1 Comment Tagged: ebero, ICANN, new gTLDs, new TLDs

IGOs plead for special new gTLD protections

Twenty-eight intergovernmental organizations, including the UN, ITU and WIPO, have asked ICANN for special protection for their acronyms in the new top-level domains program.
A letter sent to ICANN earlier this week and obtained by DI, reads:

we formally request ICANN to make provision for a targeted exclusion of third party registrations of the names and acronyms of IGOs both at the top and second level, at least during ICANN’s first application round and until further appropriate policy could be developed.

It goes on to claim that fighting abusive domain registrations and enforcing rights diverts funds from causes such as famine relief, scientific research and children’s rights.
For the sake of brevity, this is the list of the letter’s signatories in acronym form only: AfDB, EBRD, ESO, CERN, ESA, IADB, IAEA, IFAD, ILO, IMO, IMF, IOM, ITU, NIB, NATO, OECD, OPCW, UN, UNESCO, UNIDO, UPU, WB, WHO, WIPO, WMO, UNWTO, and WTO.
The letter justifies its request by citing the rights given to IGO names under the Paris Convention for the Protection of Industrial Property.
It’s a pretty flimsy argument. The Paris convention does not give IGOs exclusive rights to strings. It may protect the World Bank abbreviation WB, for example, but not to the extent that Warner Brothers can’t also use it to market movies.
The letter also cites ICANN’s Governmental Advisory Committee, which called for IGOs to be protected in its March 2007 GAC Principles regarding New gTLDs advice.
The Principles, however, talk about IGOs in the same breath as regular trademark owners, which is exactly how the new gTLD Applicant Guidebook treats them today.
There is some ICANN precedent for giving in to this kind of special pleading, however.
The latest Guidebook makes several dozen trademarks relating to the Red Cross, Red Crescent and Olympic movements “ineligible for delegation” as gTLDs, but offers them no second-level protection.
It was noted at the time the decision was made – at the behest of the GAC – that giving the Olympics special treatment would create a slippery slope to a full-blown Globally Protected Marks List, a concept ICANN has already rejected.
The UN et al only really have a shot at getting what they want if they can get the GAC on side, and several influential GAC members have already stated that the Olympic/Red Cross case was unique.
I think the response from ICANN will be a letter from president Rod Beckstrom politely declining the request and inviting its signatories to participate in the ICANN community.

1 Comment Tagged: gac, ICANN, igos, itu, nato, new gTLDs, olympics, un, wipo

ICM opens can of worms with .xxx domain seizures

ICM Registry has suspended several dozen .xxx domain names registered by cybersquatters.
It’s believed to be unprecedented for a mainstream registry to unilaterally shut down domains purely on the grounds of alleged cybersquatting, as I reported for The Register earlier today.
ICM took down 70 to 80 domains including washingtonpost.xxx, cnbc.xxx and verizonwireless.xxx because it decided that the domains infringed trademarks and were therefore abusive.
Many belonged to the squatter Domain Name Wire first fingered as the registrant of huffingtonpost.xxx, named in Whois as Justin Crews.
Crews had told MSNBC that he planned to sell the domains at profit.
There was no UDRP arbitration, no court order, just a breach of the .xxx registry-registrant agreement, which gives ICM the right to suspend squatted domains at will.
This is the relevant part of the agreement, which all .xxx registrants must agree to:

You acknowledge and agree that the Registry reserves the right to disqualify you or your agents from making or maintaining any Registrations or Reservations in the .XXX TLD if you are found to have repeatedly engaged in abusive registrations, in its sole discretion.

I blogged back in May about why it might not be necessary to spend a fortune on defensive registrations in .xxx, given the existence of this policy and others.
Nevertheless, while it may take a while for the implications to become clear, I think the suspensions represent a very significant development.
Coming so soon after the end of ICM’s sunrise period, which saw many organizations spend thousands on useless non-resolving defensive registrations, I wouldn’t be surprised if many companies feel like they may have wasted their money.
If you’ve just spent $200 defending your brand, I imagine it would be quite annoying to see the likes of verizonwireless.xxx or businessweek.xxx get the same protection for free.
I would also not be surprised if, from now on, trademark attorneys trying to defend their rights in .xxx first contacted ICM, rather than WIPO or the National Arbitration Forum.
Why spend thousands on a UDRP complaint when you can just send a legal nastygram to ICM?
ICM president Stuart Lawley told DI today that this wave of suspensions was done independently, not in response to any legal demands.
Still, the precedent has been set: ICM will suspend domains for free, under certain circumstances.
What those circumstances are is less clear.
Lawley said that ICM will not get involved in complaints about individual domains – but it will shut down cybersquatters with multiple infringements.
But what constitutes cybersquatting? UDRP has a definition, but I’m not sure ICM does. It may be quite subjective.
It’s also not clear what ICM will do with the suspended domains, not all of which necessarily infringe trademarks. Some may be bona fide, but the ICM policy is to take down the registrant’s entire portfolio.
So will those non-infringing domains be released back into the pool? And if so, how will ICM determine which are squats and which are not?
And what about the ones that are squats? Will they be released?
AOL may be content for huffingtonpost.xxx to remain suspended forever. As long as it’s suspended, the company does not have to worry about defensive registration fees.
But consider gayroom.xxx, which was also suspended.
The owner of gayroom.com owns a trademark on the word “gayroom”. Gayroom.com is a porn site, but one that has chosen not to buy its equivalent .xxx domain.
What if it changes its mind? If gayroom.com wants gayroom.xxx in future, is there a way to take it out of suspension, or is the company stuck without its .xxx forever, just because a cybersquatter got there first?
ICM’s policies do not seem to answer this question and the company has not yet revealed its plans for the suspended domains.
As a post-script, I should note that Huffington Post owner AOL is currently listed as the registrant of huffingtonpost.xxx in the Whois record.
It’s not yet clear why this is the case, but Lawley stated unequivocally today that the apparent transfer is completely unrelated to ICM’s own crackdown.
Go Daddy, the registrar of record for the domain, declined to comment, citing its customer privacy policy.
Did the cybersquatter transfer the domain to AOL before the suspension? Did he sell it to AOL? Or did he just update the Whois with phoney data? Either seems possible at this point.

20 Comments Tagged: aol, cybersquatting, huffington post, icm registry, seizures, trademarks, xxx

Congressmen ask for new gTLDs delay

ICANN should consider delaying the launch of its new top-level domains program, a number of US lawmakers said at a House of Representatives committee hearing today.
If the Senate’s hearing on new gTLDs last week could be characterized as a “win” for ICANN, today’s House meeting probably went in favor of its adversaries in the Association of National Advertisers.
“I don’t think it’s ready for prime time,” Rep. Anna Eshoo said during the Energy & Commerce Committee hearing. “I suggest that it is delayed until consensus is developed among relevant stakeholders.”
That’s exactly what the ANA and the Coalition for Responsible Internet Domain Oversight wanted to hear, and her views were echoed by several other Congresspeople, using similar language.
ICANN’s senior vice president Kurt Pritz, who was put forward to defend the new gTLD program in Washington DC for the second consecutive week, disagreed.
“This process has not been rushed, it’s been seven years in the making,” he said. “All the issues have been discussed and no new issues have been raised.”
National Telecommunications and Information Administration associate administrator Fiona Alexander, there to defend the ICANN process if not its results, observed that “consensus” does not necessarily always mean “unanimity”.
The hearing also heard from Josh Bourne of the Coalition Against Domain Name Abuse, a long-time critic of ICANN and new gTLDs.
CADNA has recently taken a more pragmatic view of the program, coinciding with sister group Fairwinds Partners’ decision to emerge as a new gTLD consultancy.
Bourne therefore found himself not only defending the program but also praising .xxx, saying that its novel trademark protection mechanisms should be mandatory in new gTLDs.
CADNA’s main demand nowadays is for clarity into the dates of subsequent application rounds, which Bourne said would relieve the “condition of scarcity” that the uncertainty has created.
Bourne also said that Congress could fight fraud by revising the the 12-year-old US Anticybersquatting Consumer Protection Act.
Also on the panel as an opponent of the program was Anjali Hansen, an IP attorney with the Better Business Bureau, who came to complain about the cost of defending the “BBB” trademark.
Hansen’s testimony was essentially worthless. When she was not complaining about fraudsters infringing copyright on BBB’s logo (obviously irrelevant in the context of domains) she seemed to be claiming that the Better Business Bureau has exclusive rights to the string “BBB”.
As Pritz noted later, there are 50 registered trademarks for “BBB” – I’ve counted about 18 live ones in the US alone – and any one of those trademark owners would be able to object to .bbb.
There was also substantial confusion about the state of the program. Congressmen conflated separate controversies in order to support the view that new gTLDs should be delayed.
As I’ve noted before, there’s a worrying lack of detail on certain outstanding issues – such as continuity funding requirements – but Congressmen had evidently been fed different talking points and therefore peppered Pritz with questions about the state of ICANN’s negotiations to amend the Registrar Accreditation Agreement, an unrelated matter.
If two themes could be said to have emerged from the hearing, and last week’s Senate hearing, often expressed by the same Congressmen or witnesses, I’d say they were:
First, ICANN should make it harder for criminals to abuse new gTLDs.
Second, ICANN should make it cheaper and easier to obtain new gTLDs.
I would point out that a certain degree of doublethink is required to hold both positions true, but to do so would imply that the necessary singlethink had been done already.

1 Comment Tagged: ana, better business bureau, congress, crido, ICANN, new gTLDs, new TLDs