ICANN extends Covid-19 abuse monitoring to Ukraine war

ICANN has started monitoring domains related to the war in Ukraine for potential abuse, expanding an ongoing project related to the Covid-19 pandemic.

CEO Göran Marby has during multiple sessions at ICANN 73 this week said that the Org will soon announce an extension of its DNSTICR project — pronounced “DNS Ticker” and standing for Domain Name Security Threat Information Collection & Reporting.

The plan is to alert registrars about Ukraine-related domain names being used to scam people or drop malware.

“There will be coming up more information about this very soon, but we have decided to also add names in relationship to the conflict in Ukraine,” Marby said during a session with the Commercial Stakeholders Group.

DNSTICR was launched in March 2020, when the pandemic was in full swing, to find new domains containing keywords such as “covid”, “pandemic” and “coronavirus”, and check them against domain abuse lists.

From May 2020 to August last year, it flagged 210,939 pandemic-related domains, and found that 3,791 of them were malicious with “high confidence”.

CTO John Crain said in a session on Monday: “There’s a lot of stuff in the press and some technical papers out there that show clearly that the bad guys, as always, have, once again, pivoted to whatever is happening in the world. So if we can do a little bit to help, we will.”

Comment Tagged: dns abuse, dnsticr, ICANN, icann 73, malware, phishing, ukraine, war

ICANN’s Ukraine relief may extend to Russians too

Russian domain name registrants affected by sanctions could benefit from ICANN’s relaxation of its renewal rules.

ICANN on Monday announced that it was classifying the war in Ukraine as an “extenuating circumstance” under the terms of its standard Registrar Accreditation Agreement.

This means that Ukrainians cut off from the internet due to the invasion could be cut some slack, at their registrar’s discretion, when it comes to renewing their gTLD domains.

But ICANN’s executive team was asked, during a session at ICANN 73 later that day, whether the same benefits could be extended to Russian registrants, perhaps unable to pay due to Western sanctions on payment systems.

Visa, Mastercard, American Express and Paypal are among those to restrict Russian accounts in recent days.

ICANN mostly ducked the question.

Co-deputy CEO Theresa Swinehart responded by deferring to the original blog post, and general counsel John Jeffrey followed up by quoting some of the post’s language:

“I think we’re clear in that the events in Ukraine and the surrounding region are now considered by ICANN to be an extending circumstance under the Registrar Accreditation Agreement, under 3.7.5.1,” he said.

The words “surrounding region”, found in the original post alongside “affected region” and “affected area”, seem to be key here.

They could just as easily refer to Russia as they could to places such as Poland and Hungary, which are currently accepting hundreds of thousands of Ukrainian refugees.

It seems the registrars may have the discretion here; ICANN was apparently in no hurry to provide clarity.

The exchange came during a 90-minute session in which ICANN’s executive team were peppered with community questions, many related to the war and how ICANN might be affected by US-imposed sanctions.

Execs said that ICANN would comply with any US laws related to sanctions but that so far it had not seen anything that would affect its ability to contract with Russian companies.

A question apparently related to whether ICANN was reviewing its relationships with law firms and banks that may be involved with Russian oligarchs, much like Tucows is doing, was ducked.

They were also asked how the $1 million ICANN at the weekend earmarked to help keep Ukraine online might be spent, and while CEO Göran Marby alluded to a broad request from Ukraine for satellite terminals, he said it had been less than a day since the resolution was passed and it was too early to say.

“We obviously will focus on what we can do that makes the maximum impact as close to our mission as we possibly can,” added Sally Costerton, senior VP of stakeholder engagement.

Comment Tagged: ICANN, icann 73, raa, russia, sanctions, ukraine, war

ICANN offers $1 million to Ukraine projects, supports Ukrainian registrants

ICANN has allocated $1 million to help protect internet access in war-torn Ukraine.

Its board of directors at the weekend voted to set aside the “initial sum” of money “to provide financial assistance to support access to Internet infrastructure in emergency situations.”

There’s an expectation that the cash will be spent “on support for maintaining Internet access for users within Ukraine”, where the Russian invasion is described as “tragic and profoundly troubling”, over the next few months, the board said.

It’s not clear yet exactly how the money will be spent, though something related to the keeping the DNS up and running would seem to be the most probable. The resolution calls for the CEO to develop a process to figure it out.

Ukraine’s ccTLD manager, Hostmaster, moved its servers into other European countries shortly after the invasion, and signed up to Cloudlflare’s DDoS protection service. It’s not clear whether it had to spend money on these moves.

ICANN’s million will come from its regular operating budget, not the stash it has set aside from its new gTLD auctions. The auction money will probably be spent on similar things eventually, but the process for allocating that is still being worked out in a committee.

ICANN also said this week that it is, as I and others suggested, exercising section 3.7.5.1 of its Registrar Accreditation Agreement to declare the invasion an “extenuating circumstance”, meaning Ukrainians who are unable to renew their domain name registrations before they expire may not lose them.

Registrars now have the option to keep these domains registered after their usual expiration date and ICANN will not send its Compliance enforcers after them.

“We encourage registrars and registries to support this action and take these circumstances into consideration when reviewing impacted registrants’ renewal delinquencies in affected regions,” ICANN said.

It’s the first time ICANN has exercised this power in connection with a human-made disaster. It previously invoked 3.7.5.1 in response to Hurricane Maria in Puerto Rico and worldwide in response to the Covid-19 pandemic.

Hostmaster itself has extended the redemption period for .ua domains from 30 to 60 days.

Comment Tagged: compliance, hostmaster ua, ICANN, raa, russia, ukraine, war

Here’s a way ICANN could actually help the people of Ukraine

ICANN may have today decided to decline Ukraine’s request for Russian and Belarusian top-level domains to be taken down, but there’s still at least one way it could do a little bit to help the country’s citizens.

ICANN has the power to help make sure Ukrainian registrants’ domain names don’t expire, which would render their email and web sites unusable if they are unable to access the internet to pay for renewals for an extended period.

The Org is able to waive the contractual requirement for registrars to cancel domains that have not been renewed, in the event of “extenuating circumstances”.

ICANN has used this power twice before. The first time when Hurricane Maria hit the Caribbean in 2017. The second was when the ongoing coronavirus pandemic hit the world in April 2020.

In both cases, ICANN invoked section 3.7.5.1 of the standard Registrar Accreditation Agreement and said the circumstances amounted to a “natural disaster”.

But there’s nothing in the RAA that limits “extenuating circumstances” to just “natural disasters”. The term “natural disasters” does not appear in the contract.

The contract says “other circumstance as approved specifically by ICANN” is a good enough reason to waive the deletion requirements.

It appears that ICANN can unilaterally decide whether the war in Ukraine is a sufficiently “extenuating circumstance” to give Ukrainian domain name owners a break when it comes to renewals.

6 Comments Tagged: icann. war, raa, russia, ukraine

GoDaddy stops selling .ru domains, commits money to support Ukraine

Domain registrar market-share leader GoDaddy will no longer sell .ru domain names, and has reached into its pocket to provide financial support for Ukraine relief efforts.

In a two-pronged response to the Russian invasion, the company outlined several measures aimed at both supporting Ukraine and putting some sanction-style pressure on Russia.

It’s not kicking out existing Russian registrants, but it is, according to a statement:

• Removing the Russian version of our website
• No longer supporting new registrations of .ru and .ru.com
• Removing all .ru domain names from our domain name aftermarket
• Removing the Russian Ruble

“What’s happened in Ukraine is horrible. We do not condone the unwarranted aggression from the Russian Government,” the statement says.

For Ukrainian customers, GoDaddy is renewing their products and services due to expire in the next 60 days for free.

“Customers can also contact us at any time, and if they need something specific, we’ll help them as best we can,” the company added.

It’s also donating $500,000 to humanitarian relief in Ukraine, donation-matching its employees’ gifts, and offering to help pay its Ukrainian contractors’ salaries for the next 60 days.

Other registrars to share their support for Ukraine so far include Namecheap, Tucows, IONOS and Gandi.

2 Comments Tagged: godaddy, russia, ukraine, war

Gandi says it supports Ukraine but WON’T cut off Russians

Gandi has become the latest large registrar to issue a statement about the war in Ukraine, saying that while it deplores the violence it won’t be disconnecting Russian customers.

CEO Stephan Ramoin wrote that Gandi “condemns” the invasion and is “working on supporting Ukraine, according to the suggestions of our Ukrainian tech colleagues”, adding:

The internet is about including all humanity and working toward a greater goal, giving every human being a voice and a clear vision of the world, not excluding and antagonizing one group of people against another. That’s why we want to support the people of Russia and Belarus expressing their disagreement with this war. We don’t need to escalate, war is not the answer.

Cutting off Russians and Belarusians would only encourage the creation of different closed worlds and digital networks. We have chosen to hold out our hand to these people. We are not at war with them. Only their leaders, and their madness, need to be stopped. We will of course react quickly against war propaganda of any kind.

The statement follows those coming from Namecheap and IONOS, which have both this week announced their intentions to remove most Russian and Belarusian customers.

Based in Paris, Gandi is one of the oldest registrars and has over 1.3 million gTLD domains under management.

1 Comment Tagged: gandi, russia, ukraine, war

Now IONOS kicks out Russian customers

IONOS has become the second major registrar to say it will turf out its Russian customers in response to the invasion of Ukraine.

The company’s board of directors today issued a statement expressing support for the people of Ukraine and saying:

To support worldwide sanctions on Russia, we are not accepting any new customer contracts from Russia and are also terminating existing relationships with Russian customers. This also applies to business relationships with Russian service providers and suppliers. We are currently reviewing all existing supplier contracts.

The directors said that many of their colleagues come from Ukraine and have family in the region.

It’s not immediately clear whether the ban applies to domain name registrants as well as hosting customers, and what options Russian registrants have been given. An IONOS spokesperson said the details are still being worked out.

Earlier in the week, US-based registrar Namecheap, which has its customer support based in Ukraine, gave its Russian registrants notice to transfer their names elsewhere. It later said it would offer free domains to Russian dissidents.

While a little smaller than Namecheap, IONOS is part of Germany-based United-Internet and, with over five million names, a top-10 registrar in terms of gTLD domains under management.

Comment Tagged: ionos, russia, ukraine, united internet, war

ICANN says NO to Ukraine’s Big Ask

“ICANN has been built to ensure that the Internet works, not for its coordination role to be used to stop it from working.”

That’s ICANN’s response to Ukraine, which earlier this week asked for Russia to lose its top-level domains and IP addresses, to help prevent propaganda supporting its invasion of the country.

The request was arguably based on a misunderstanding of the extent of ICANN’s powers, and CEO Göran Marby says as much in his response last night (pdf) to Ukraine’s deputy prime minister Mykhailo Fedorov:

In our role as the technical coordinator of unique identifiers for the Internet, we take actions to ensure that the workings of the Internet are not politicized, and we have no sanction-levying authority

He goes on to warn about the “devastating and permanent effects” of ICANN suddenly deciding to take unilateral action against .ru, .рф and .su:

For country-code top-level domains, our work predominantly involves validating requests that come from authorized parties within the respective country or territory. The globally agreed policies do not provide for ICANN to take unilateral action to disconnect these domains as you request. You can understand why such a system cannot operate based on requests from one territory or country concerning internal operations within another territory or country. Such a change in the process would have devastating and permanent effects on the trust and utility of this global system.

He concludes:

Within our mission, we maintain neutrality and act in support of the global Internet. Our mission does not extend to taking punitive actions, issuing sanctions, or restricting access against segments of the Internet — regardless of the provocations. ICANN applies its policies consistently and in alignment with documented processes. To make unilateral changes would erode trust in the multistakeholder model and the policies designed to sustain global Internet interoperability.

The response is expected, and I believe broadly, if not unanimously, supported in the ICANN community.

In a line I wish I’d written, the Internet Society’s CEO Andrew Sullivan put it pretty succinctly in a blog post yesterday:

The idea of unplugging a country is as wrong when people want to do it to another country as it is when governments want to do it to their own.

And Sébastien Bachollet, chair of ICANN stakeholder group EURALO, insisted (pdf) that “the Internet must remain intact”.

RIPE NCC, which had been asked to revoke IP addresses supplied to Russian organizations, wrote that it “believes that the means to communicate should not be affected by domestic political disputes, international conflicts or war.”

ICANN may take a short-term PR hit in the wider world, which includes people who have a misunderstanding of how powerful ICANN is and how tenuous its grasp on the powers it does have.

While .ru appears to be safe, there’s nothing I read in Marby’s letter that would preclude it from initiating retirement proceedings against .su, when the proper policies have been approved.

Comment Tagged: .ru, .su, ICANN, isoc, ripe ncc, russia, ukraine, war

Namecheap offers free services to Russian dissidents

Namecheap will offer “free anonymous domain registration and free web hosting” to anti-war protest web sites based in Russia or Belarus.

The registrar said in a statement today that the move is in response to imprisoned Russian opposition leader Alexei Navalny’s call for war protests in Russia.

The offer modifies the company’s hard-line position from earlier in the week, in which it banned Russians altogether from its services and gave registrants there a week to get out.

Namecheap’s English-language customer service is based in Ukraine, including in cities under heavy bombardment this week.

Russians interested in the free hosting offer are asked to contact customer service for details.

2 Comments Tagged: namecheap, russia, ukraine, war

CENTR kicks out Russia

CENTR, the association of European domain registries, has kicked out the Russian ccTLD operator due to the war in Ukraine.

In a brief statement today, the organization said:

The CENTR Board is following Russian military actions in Ukraine with concern and strongly condemns the violation of international law and Ukraine’s territorial integrity. Ukraine’s national TLD registry is a member of CENTR and we stand with Ukrainians in their efforts to resist Russia’s invasion. We hope for a swift and peaceful resolution of the conflict, and will continue to offer support and help to our Ukrainian colleagues.

Knowledge and information sharing are key to CENTR’s mission, and the CENTR Board needs to safeguard trust within the CENTR community. The Board has therefore decided to suspend the membership of the Coordination Center for TLD RU/РФ, effective immediately. The Board would like to underline that this is in no way targeted at our Russian colleagues. This suspension will be assessed by the CENTR General Assembly at their meeting in March.

I’m not sure the move will have much of an impact on the Coordination Center, but it’s a strong gesture of solidarity with the people of Ukraine, and the latest response from the domain industry to Russia’s insane war.

1 Comment Tagged: .ru, centr, russia, ukraine, war