Zero registrars pass ICANN audit

Some of the biggest names in the registrar game were among a bewildering 100% that failed an ICANN first-pass audit in the latest round of random compliance checks.
Of the 55 registrars picked to participate in the audit, a resounding 0 passed the initial audit, according to data released today.
Among them were recognizable names including Tucows, Register.com, 1&1, Google and Xin Net.
ICANN found 86% of the registrars had three or more “deficiencies” in their compliance with the 2013 Registrar Accreditation Agreement.
By far the most problematic area was compliance with sections 3.7.7.1 to 3.7.7.12 of the RAA, which specifies what terms registrars must put in their registration agreements and how they verify the contact details of their customers.
A full three quarters of audited registrars failed on that count, according to ICANN’s report (pdf).
More than half of tested registrars failed to live up to their commitments to respond to reports of abuse, where they’re obliged among other things to have a 24/7 contact number available.
There was one breach notice to a registrar as a result of the audit, but none of the failures were serious enough for ICANN to terminate the deficient registrar’s contract. Two registrars self-terminated during the process.
ICANN’s audit program is ongoing and operates in rounds.
In the current round, registrars were selected from those which either hadn’t had an audit in a couple of years, were found lacking in previous rounds, or had veered dangerously close to formal breach notices.
The round kicked off last September with requests for documents. The initial audit, which all registrars failed, was followed by a remediation phase from January to May.
Over the remediation phase, only one third of the registrars successfully resolved all the issues highlight by the audit. The remainder issued remediation plans and will be followed up on in future rounds.
The 0% pass rate is not unprecedented. It’s the same as the immediately prior audit (pdf), which ran from May to October 2016.

.feedback gTLD in breach of contract after big brand “fraud” claims

ICANN has slapped .feedback operator Top Level Spectrum with a contract breach notice after a huge complaint about alleged fraud filed by a gang of big brands.
The company becomes the third new gTLD to be hit by a breach notice, and the first to receive one as a result of losing a Public Interest Commitments Dispute Resolution Process case.
While TLS dodged the “fraud” charges on a technicality, the breach is arguably the most serious found by ICANN in a new gTLD registry to date.
The three-person PICDRP panel found TLS was in violation of the following commitment from its registry agreement:

Registry Operator will operate the TLD in a transparent manner consistent with general principles of openness and non-discrimination by establishing, publishing and adhering to clear registration policies.

But TLS dodged the more serious charges of “fraudulent” behavior, which it denied, largely on the technicality that its PICs only require it to bar its registrants from such behavior.
There’s nothing in the PICs preventing the registry from behaving fraudulently, so the PICDRP panel declined to rule on those allegations, saying only that they “may be actionable in another forum”.
The complainants, which filed their 1,800-page complaint in October, were MarkMonitor and a bunch of its clients, including Adobe, American Apparel, Best Buy, Facebook, Levi and Verizon.
They’d claimed among other things that 70% of .feedback domains were trademarked names actually registered by the registry, and that TLS had stuffed each site with reviews either paid for or scraped from services such as Yelp!.
They claimed that Free.Feedback, a free domains service hosted by an affiliated entity, had been set up to auto-populate Whois records with the names of brand owners (or whoever owned the matching .com domain) even when the registrant was not the brand owner.
This resulted in brand owners receiving “phishing” emails related to domains they’d never registered, the complainants stated.
TLS denied all all the allegations of fraud, but the PICDRP panel wound up not ruling on many of them anyway, stating:

the Panel finds that Respondent’s Registry Operator Agreement contains no covenant by the Respondent to not engage in fraudulent and deceptive practices.

The only violations it found related to the transparency of .feedback’s launch policies.
The panel found that TLS had not given 90 days notice of policy changes and had not made its unusual pricing model (which included an extra fee for domains that did not resolve to live sites) transparent.
The registry had a number of unusual launch programs, which I outlined in December 2015 but which were apparently not adequately communicated to registrars and registrants.
The panel also found that Free.Feedback had failed to verify the email addresses of registrants and had failed to make it easy for trademark owners to cancel domains registered in their names without their consent.
Finally, it also found that TLS had registered a bunch of trademark-match domain names to itself during the .feedback sunrise period:

self-allocating or reserving domains that correspond to the trademark owners’ marks during the Sunrise period constitutes a failure by the Respondent to adhere to Clause 6 of its Registration and Launch policies, versions 1 and 2. According to the policies, Sunrise period is exclusively reserved for trademark owners

TLS, in its defense, denied that it had self-allocated these names and told the panel it had “accidentally” released them into the zone file temporarily.
As a result of the PIC breaches found by the panel, ICANN Compliance has issued a breach notice (pdf) against the company.
To cure the breach, and avoid having its Registry Agreement taken away, TLD has to, by April 15:

Provide ICANN with corrective and preventative action(s), including implementation dates and milestones, to ensure that Top Level Spectrum will operate the TLD feedback in a transparent manner consistent with general principles of openness and nondiscrimination by establishing, publishing and adhering to clear registration policies;

That seems to me like it’s probably vague enough to go either way, but I’d be surprised if TLS doesn’t manage to comply.

Complaints about registrars dip in 2016

There were slightly fewer complaints about domain name registrars in 2016, compared to 2015, according to newly published ICANN data, but complaints still run into the tens of thousands.
There were 43,156 complaints about registrars to ICANN Compliance in 2016, compared to 45,926 in 2015, according to the data (pdf). That’s a dip of about 6%.
The overall volume of complaints, and the dip, can be attributed to Whois.
About three quarters of the complaints directed at registrars in 2016 were for Whois inaccuracy — 32,292 complaints in total, down from 34,740 in 2015.
The number of complaints about gTLD registries was pretty much flat at 2,230, despite hundreds of new gTLDs being delegated during the year.
The vast majority of those gTLDs were dot-brands, however, with nowhere near the same kind of potential for abuse as generally available gTLDs.
The biggest cause for complaint against registries, representing about half the total, was the Zone File Access program. I’ve filed a few of these myself, against dot-brands that decide the ZFA policy doesn’t apply to them.
Formal, published breach notices were also down on the year, with 25 breaches, four suspensions and four terminations, compared to 32 breaches, six suspensions and eight terminations in 2015.
That’s the second consecutive year the number of breach notices was down.

ICANN’s top DC lobbyist gets consumer safeguards role

ICANN has named veteran staffer Jamie Hedlund as its new senior VP for contractual compliance and consumer safeguards.
It’s a new executive team role, created by the departure of chief contract compliance officer Allen Grogan. Grogan announced his intention to leave ICANN last May, and has been working there part-time since August.
The “consumer safeguards” part of the job description is new.
ICANN first said it planned to hire such a person in late 2014, but the position was never filled, despite frequent poking by anti-spam activists.
Now it appears that the two roles — compliance and consumer safeguards — have been combined.
This makes sense, give that ICANN has no power to safeguard consumers other than the enforcement of its contracts with registries and registrars.
From the outside, it does not immediately strike me as an obvious move for Hedlund.
While his job title has changed regularly during his six or so years at ICANN, he’s mainly known as the organization’s only in-house Washington DC government lobbyist.
He played a key role in the recent IANA transition, which saw the US government sever its formal oversight ties with ICANN.
His bio shows no obvious experience in consumer protection roles.
His replacement in the government relations role is arguably just as surprising — Duncan Burns, a veteran PR man who will keep his current job title of senior VP of global communications.
The appointments seem to indicate that lobbying the US government is not as critical to ICANN in the post-transition world, and that institutional experience in the rarefied world of ICANN is a key qualifier for senior positions.

ICANN terminates penis pill pimp registrar

ICANN is to terminate the contract of a Chinese registrar linked to dodgy pharmaceuticals web sites and other malfeasance.
Nanjing Imperiosus Technology Co, which does business as DomainersChoice.com, has been told it will lose its registrar accreditation February 3.
ICANN said in the termination notice that the company had failed to keep records related to abuse reports, failed to validate Whois records, and failed to provide ICANN with registration records, all in breach of the Registrar Accreditation Agreement.
The breaches related to complaints filed by illegal pharmacy watchdog LegitScript last September, I believe.
DomainersChoice and its CEO Stefan Hansmann were listed in Whois as the owners of potentially hundreds of domains that were being used to sell medicines for conditions ranging from heart disease to erectile dysfunction.
The domains 5mg-cialis20mg.com, acheterdutadalafil.com, viagra-100mgbestprice.net and 100mgviagralowestprice.net were among those apparently owned by the registrar.
According to LegitScript, thousands of DomainersChoice domains were “rogue internet pharmacies”.
The registrar has also been linked by security researchers to mass typosquatting campaigns.
The company’s web site even has a typo generator. While one could argue such tools are also useful to brand owners, DomainersChoice’s name suggests it’s geared towards domainers, not brands.
DomainersChoice had about 27,000 domains under management at the last count, which ICANN will now migrate to another registrar.
It’s not known how many of those were self-registered domains and how many were being used nefariously, but LegitScript CEO John Horton estimated (pdf) at least 2,300 dodgy pharma sites used the registrar.

Registrar accused of pimping prescription penis pills

ICANN has implicated a Chinese domain name registrar in the online selling of medications, including Viagra and Cialis, without the required prescription.
The organization’s Compliance department filed a contract breach notice with Nanjing Imperiosus, which does business as DomainersChoice.com, today.
The move follows an allegation from pharmacy watchdog LegitScript in the US Congress that DomainersChoice is “rogue internet pharmacy operator”.
Because ICANN has no authority to police online pharmacies, it’s gone after the registrar based on an obscure part of the Registrar Accreditation Agreement.
Section 3.7.7 of the 2013 RAA says that domains must be registered to a third party, unless they’re used by the registrar in the course of providing its registrar services.
According to ICANN, DomainersChoice has refused to provide evidence that many of its domains are not in fact registered to itself and CEO Stefan Hansmann, in violation of this clause.
It cites 5mg-cialis20mg.com, acheterdutadalafil.com, viagra-100mgbestprice.net and 100mgviagralowestprice.net as examples of domains apparently registered to Hansmann and his company.
Historical Whois records show Hansmann and Nanjing Imperiosus as the registrant of these names until recently.
The domains all refer to erectile dysfunction medicines, which are usually only available in the US with a prescription.
A reverse Whois lookup reveals Hansmann’s name in the records for many more pharmaceuticals-related domains, some of which are for more serious medical conditions.
Several of the domains contain the words “without prescription” or similar, where the drug in question requires a prescription in the US.
Some of the domains do not currently resolve or no longer provide current Whois records and others have been recently transferred, but some resolve to apparently active e-commerce sites.
ICANN’s breach notice (pdf) doesn’t allege any illegal activity.
The same cannot be said for LegitScript CEO John Horton, who lumped DomainersChoice in with a few other registrars he believes are operating “illegal online pharmacies”.
Horton testified (pdf) before Congress last month that the registrar was playing host to 2,300 such sites.
The testimony was filed September 14, the same day ICANN began its compliance investigation.
ICANN’s notice, which alleges a handful of other relatively trivial breaches, asks that Hansmann provide a full list of domains registered in his and his company’s name via DomainersChoice.
It also demands evidence that the domains were either used to provide registrar services or were registered to a third party.
It wants all that by November 2, after which it may start to terminate the company’s RAA.

ICANN slaps first deadbeat dot-brand with breach notice

The world’s third-largest mobile phone company, worth some $14 billion a year, is the first new gTLD registry operator to refuse to pay ICANN fees.
That’s according to ICANN’s compliance department, which last night slapped Bharti Airtel with the new gTLD program’s first public contract breach notices.
The notices, which apply to .bharti and .airtel, claim that the Indian company has been ignoring demands to pay past due fees since February.
The ICANN quarterly fee for registries is $6,250. Given .airtel and .bharti were delegated 11 months ago, the company, which has assets of $33 billion, can’t owe any more than $37,500.
Bharti Airtel is, according to Wikipedia, the third largest mobile network operator in the world and the largest in India, with 325 million subscribers.
Yet ICANN also claims it has had terrible difficulty getting in touch with staff there, saying:

ICANN notes that Bharti Airtel exhibits a pattern of non-response to ICANN Contractual Compliance matters and, when responses are provided to ICANN, they are often untimely and incomplete.

The compliance notices show that ICANN has also communicated with Verisign, the registry back-end operator for both gTLDs, to try to get the matters resolved.
According to ICANN, the registry is also in breach of terms that require it to publish links to its Whois service, abuse contacts and DNSSEC practice statements on its web site.
The sites nic.airtel and nic.bharti don’t resolve (for me at least) with or without a www., but the Whois services at whois.nic.airtel and whois.nic.bharti appear to work.
These are the first two registries of any flavor emerging from the 2012 application round to receive public breach notices. Only one pre-2012 gTLD, .jobs, has the same honor.
ICANN has given Bharti Airtel 30 days from yesterday to come back into compliance or risk losing its Registry Agreements.
Given that both gTLDS are almost a year old and the nic. sites still don’t resolve, one wonders if the company will bother.

First registrar “breached” UDRP lock rule

ICANN has charged a registrar with failing to abide by “cyberflight” rules for the first time.
Visesh Infotecnics did not lock down e-campaigner.com within two days of it being hit by a UDRP a couple of weeks ago, ICANN said in a compliance notice (pdf) on Thursday.
Visesh is based in India and does business as Signdomains.com. It has roughly 5,000 gTLD domains under management.
The transfer lock rule became ICANN consensus policy binding on all registrars last July, following four years of policy and implementation work.
It’s designed to prevent cybersquatters switching registrars when a UDRP lands in their inbox, a practice known as cyberflight.
The registrant of e-campaigner.com did not in fact change registrars, judging by Whois records.
The UDRP appears to have been filed in late January by a currently undisclosed entity. Signdomains put the domain on client-hold status February 8, according to Whois records.
This is the first time ICANN has publicly accused a registrar of failing to abide by the policy.
ICANN also says that the registrar does not display Whois data in the correct format on its web site, and that it owes some accreditation fees.
It has until March 3 to rectify these alleged breaches.

How one registrar allegedly dodges ICANN Compliance

A Chinese registrar has been accused by ICANN of playing games to avoid complying with Whois policy.
In a breach notice from ICANN Compliance last week, Beijing-based 35 Technology is told that it has failed to verify Whois records as required by its accreditation agreement.
The domain in question was shoesbbalweb.com, which DomainTools’ archived screenshots show was once used to sell branded running shoes.
I understand that 35 is believed to have suspended the domain when ICANN first referred a Whois accuracy complaint to it.
It is then said to have un-suspended the domain, without any change to the Whois record, as soon as ICANN closed the complaint.
The breach notice (pdf) instructs 35 to:

Provide records and information demonstrating that 35 Technology took steps to verify and validate the Whois information of the domain name since 23 March 2015, or provide ICANN with an explanation why the domain name suspension was removed without verifying and validation Whois information

The switcheroo appears to have been brief enough that its suspended state was not recorded by DomainTools.
ICANN has a monitoring program, however, that randomly spot-checks previously complained-about domains for ongoing compliance.
The registrar, which does business at 35.com, is not tiny. It had over 450,000 domains under management, in legacy gTLDs and a handful of Chinese-script new gTLDs, at the last count.
It has until the end of the month to explain itself or risk termination.

ICANN boss warns against “content policing” calls

ICANN should resist attempts to turn the organization into a content regulator responsible for fighting piracy, counterfeiting and terrorism.
That’s according to CEO Fadi Chehade, speaking in Dublin yesterday at the opening ceremony of ICANN’s 54th public meeting.
His remarks have already solicited grumbles from members of the intellectual property community, which are eager for ICANN to take a more assertive role against registries and registrars.
Speaking to a packed auditorium, Chehade devoted a surprisingly large chunk of his opening address to the matter of content policing, which he said was firmly outside of ICANN’s remit.
He presented this diagram, breaking up the internet into three layers. ICANN plays in the central “logical” section but has no place in the top “societal” segment, he said.

“Where does ICANN’s role start and where does ICANN’s role stop?” Chehade posed. “It’s very clear Our remit starts and stops in this logical yellow layer. We do not have any responsibility in the upper layer.”
“The community has spoken, and it is important to underline that in every possible way, ICANN’s remit is not in the blue layer, it is not in the economic/societal layer,” he said. This is a technical organization.”
That basically means that ICANN has no responsibility to determine which web sites are good and which are bad. That’s best left to others such as the courts and governments.
Chehade recounted an anecdote about a meeting with a national president who demanded that ICANN shut down a list of terrorism-supporting web sites.
“We have no responsibility to render judgement about which sites are terrorists,” he said, “which sites are the good pharmacies, which sites are the bad pharmacies, which sites are comitting crimes, which sites are infringing copyrights…”
“When people ask us to render judgement on matters in the upper layer, we can’t.”
With that all said, Chehade added that ICANN should not shirk its duties as part of the ecosystem, whether through voluntary measures at registries and registrars or via contractual enforcement.
“Once determinations are made, how do we respond the these?” he said. “I hope, voluntarily.”
He gave the example of credit card companies that voluntarily stop doing business with web sites that have been reported to be involved in crime or spam.
The notion of registrars adhering to a set of voluntary principles was first floated by ICANN’s chief compliance officer, Allen Grogan, in a blog post earlier this month.
It was the one bone he threw to IP interests in a determination that otherwise came down firmly on the side of registrars.
Grogan had laid out a minimum set of actions registrars must carry out when they receive abuse reports, none of which contained a requirement to suspend or delete domain names.
The Intellectual Property Constituency appeared to greet Chehade’s speech with cautious optimism, but members are still pushing for ICANN to take a stricter approach to contract compliance.
In a session between the IPC and the ICANN board in Dublin this morning, ICANN was asked to make these hypothetical voluntary measures enforceable.
Marc Trachtenberg disagreed with Chehade’s credit card company example.
“The have an incentive to take action, which is the avoidance of future potential costs,” he said. “That similar incentive does not exist with respect to registries and registrars.”
“In order for any sort of voluntary standards to be successful or useful, there have to be incentives for the parties to actually comply with those voluntary standards,” he said.
“One possibility among many is a situation where those registries and registrars that don’t comply with the voluntary standards are potentially subject to an ICANN compliance action,” he said.
It’s pretty clear that this issue is an ongoing one.
Chehade warned in his address yesterday that calls for ICANN to increase its policing powers will only increase when and if its IANA contract is finally divorced from US government oversight.
Grogan will host a roundtable tomorrow at 10am Dublin time to discuss possible voluntary mechanisms that could be created to govern abuse.