Coronavirus could cause “high risk of widespread outages”, ICANN says

There’s a “high risk of widespread outages” in the DNS if ICANN can’t get enough people in the same room for its next root DNSSEC ceremony because of the coronavirus pandemic.

That’s according to ICANN’s own board of directors, which yesterday published a contingency plan that — in the worst case scenario — could see parts of the internet come to a screeching halt in July.

The problem is with the elaborate “ceremonies” that ICANN and its IANA/PTI unit uses to make sure the internet can support DNSSEC — the secure version of the DNS protocol — all the way from the root servers down.

Every quarter, ICANN, Verisign and a select few “Trusted Community Representatives” from all over the world meet in person at one of two secure US-based facilities to generate the public Zone Signing Keys for the root.

In addition to the complex cryptographic stuff happening in the computers, there’s a shedload of physical security, such as retinal scans, PIN-based locks, and reinforced walls.

And the “secret key-holders”, memorably fictionalized in a US spy drama a few years ago, actually have physical keys that they must bring to these ceremonies.

The events are broadcast live and archived on YouTube, where they typically get anything from a few hundred to a few thousand views.

Obviously, with the key-holders dotted all over the globe and most under some form of coronavirus-related lockdown, getting a quorum into the same facility at the same time — originally, Culpeper, Virginia on April 23 — isn’t going to be possible.

So IANA has made the decision to instead move the ceremony to the facility in El Segundo, California, within easy driving distance of ICANN’s headquarters, and have it carried out almost entirely by ICANN staff, wrapped in personal protective equipment and keeping their distance from each other.

The TCRs for El Segundo live in Mauritius, Spain, Russia, Tanzania, Uruguay and on the east-coast of the US, according to ICANN.

Four of these key-holders have mailed their keys to different IANA staff “wrapped in opaque material” and sealed in “tamper-evident bags”. These IANA employees will stand in for the TCRs, who will be watching remotely to verify that nothing fishy is going on.

Verisign and the independent auditors will also be watching remotely.

That’s the current plan, anyway, and I’ve no reason to believe it won’t go ahead, but ICANN’s new contingency plans do provide four alternatives.

It’s already discarded the first two options, so if the current, third, plan for the ceremony can’t go ahead before June 19 for some reason, all that would be left is the nuclear option.

Option D: Suspend signing of the DNS root zone

This is the final option if there is no conceivable way to activate the KSK and perform signing operations. There would need to be a massive education campaign at short notice to have resolver operators disable DNSSEC validation. There is a high risk of widespread outages as it is not possible to ensure global implementation, and high risk this will fatally compromise trust in DNSSEC in general as a technology.

This is considered highly unlikely, but nonetheless the final option. Without exercising the option, in the absence of a successful key signing ceremony, DNSSEC validation would be unsuccessful starting in July 2020.

The reason for this scenario is that DNSSEC keys have a finite time-to-live and after that period expires they stop functioning, which means anyone validating DNSSEC on their network may well stop resolving the signed zones.

ICANN typically generates the keys one quarter in advance, so the current key expires at the start of July.

However, the planned April 23 ceremony will generate three quarters worth of keys in advance, so the root should be good until the end of March 2021, assuming everything goes according to plan.

Clearly, the idea that half the planet might be on the verge of lockdown wasn’t taken into consideration on February 12, the last ceremony, when ICANN’s biggest problem was that it couldn’t get into one of its safes.

If you’re interested in more about the ceremony and the coronavirus-related changes, info can be found here.

GoDaddy signs up 30 partners to lockdown-era marketing scheme

GoDaddy has signed up 30 companies to a new marketing program that it says is designed to help small business keep afloat during the coronavirus lockdown.

It’s called #OpenWeStand, and the company is doing its level best to cast it as a community “movement” rather than a way to shift product as the world stands on the precipice of pandemic-induced recession.

The companies signed up so far are: Acronis, American Express, Association for Enterprise Opportunity, Avetta, BrandCrowd, Brex, ChowNow, Digital Air Strike, Evite, Gift Up!, GoFundMe, Hello Alice, Inc. Media, Kabbage, Keap, Keysight Technologies, Moneypenny, Next Insurance, Next Street, Nextdoor, PayPal, Rocket Lawyer, Ruby, Salesforce, Seed Spot, ServiceTitan, Shaw Academy, Slack, SurveyMonkey, and Zenefits.

What are all these companies offering worried business owners? It’s not entirely clear yet, but the answer so far appears to be primarily: discounts.

Evite, for example, is offering customers a free year of its premium service, which usually goes for $249, according to the OpenWeStand web site.

Customers of GoDaddy that are also customers of collaboration tool Slack will get a 25% discount on any Slack upgrade they buy.

Food delivery aggregator ChowNow says it’s designed a loyalty scheme product designed to put uo-front fees in restaurants’ pockets at a time when delivery is basically their only option.

Inc magazine’s contribution appears to be limited to a pledge to continue publishing.

GoDaddy itself is offering free social media makeovers and marketing services.

There’s not a whole lot more in the way of offers right now, but the site has placeholders for the likes of PayPal, American Express and Salesforce to promote their offerings soon.

In terms of offering advice to small business owners, we’re looking at a collection of GoDaddy blog posts and a LinkedIn group with about 200 members.

It’s obviously far too early to say whether any of this will ultimately be useful or attractive enough to help small businesses survive the lockdown, but I also think it would be churlish to dismiss it as a cynical marketing ploy at this stage.

A slick GoDaddy video promoting #OpenWeStand, which appears to have been voiced by the soothing, avuncular gravel of Donald Sutherland, has received over 12 million views since it was published March 25, so their may be an appetite for this kind of “movement”.

Kuala Lumpur meeting cancelled and ICANN 68 could be even trickier online

ICANN has as expected cancelled its in-person ICANN 68 meeting, which had been due to take place in Kuala Lumpur in June, due to the coronavirus pandemic.

The decision, which was never really in any doubt, was taken by its board of directors yesterday. The board considered:

Globally, a high number of people are under some form of a “stay at home” or lock-down order, directed to avoid contact with others except to receive essential services such as medical care or to purchase supplies. Schools and offices are closed, gatherings are prohibited, and international travel is largely on pause. We do not know when travel or in-person meetings will be authorized or possible. As it relates to Kuala Lumpur, Malaysia has a Movement Control Order in force at least until 14 April 2020 that prohibits meetings such as ICANN68. The duration of the Movement Control Order has already been extended once.

It appears that the four-day meeting, which will instead go ahead virtually (presumably on the Zoom conferencing service) might be even more disjointed than ICANN 67.

ICANN 67, which took place online in March, did have a centralized component — a bunch of ICANN staffers on location at its headquarters in Los Angeles — but that may not be possible this time around.

The board said that “due to current social distancing requirements, ICANN org is unable to execute a virtual meeting from a single location, and that a decentralized execution model might necessitate changes to the format.”

It added that there is support for “a flexible, modified virtual meeting format that focuses on cross-community dialogues on key policy topics, supplemented by a program of topical webinars and regular online working meetings scheduled around the key sessions.”

While there has been a lot of criticism of the Zoom platform in recent weeks due to security and privacy concerns, ICANN indicated this week that it’s not particularly concerned and will carry on using the service.

No ICANN tax relief for Chinese registrars

ICANN has declined a request from dozens Chinese registrars for a fee waiver due to the impact of coronavirus.

In February, almost 50 China-based accredited registries and registrars said they were suffering financially as a result of the outbreak and asked ICANN for an “immediate fee waiver” to “greatly help stabilize our business in the difficult time”.

ICANN has denied this request. In a letter (pdf), senior director of gTLD accounts and services Russ Weinstein wrote:

While we sympathize with the potential financial impact this unprecedented event may have on contracted parties, we are not prepared to provide a waiver at this time. We are closely monitoring the situation and its impact on the domain industry. We are interested in hearing more from representatives from the contracted parties to better understand the problems both the contracted parties and the registrants are facing and ideas for potential solutions.

As I said back in February, what was then largely a Chinese problem looked likely to quickly become a global problem, which unfortunately seems to be the course we’re on. Just six weeks later, China isn’t even the worst-affected country any more.

Even without fee waivers, ICANN has noted that it expects a “significant” impact on it is 2020-21 budget due to the pandemic.

ICANN declares coronavirus a “natural disaster” to protect expired domains

Registrants unable to renew their domain names when they expire may not lose them, following a decree from ICANN today.

The organization has declared the coronavirus a “natural disaster” and invoked part of the Registrar Accreditation Agreement that permits registrars to keep hold of domains that have come to the end of their post-expiration renewal period.

Under the RAA, registrars have to delete domains a maximum of 45 days after the reg period expires, unless there are “extenuating circumstances” such as an ongoing UDRP case, lawsuit or technical stability dangers.

There’s no accounting for natural disasters in the contract, but ICANN has the discretion to name any “other circumstance as approved specifically by ICANN” an extenuating circumstance. That’s what it’s done here.

It’s invoked this provision once before, following Hurricane Maria in late 2017.

ICANN said that policies to specifically protect domains in the event of natural disasters should be considered.

The new coronavirus exception applies to all registrars in all gTLDs, although implementation will vary by registrar.

The announcement follows Verisign’s announcement last week that it is waiving its registry-level restore fee for .com and .net domains until June 1.

ICANN to consider cancelling ICANN 68 tomorrow

ICANN is to consider whether to cancel its in-person ICANN 68 gathering at a meeting of its board of directors tomorrow.

The agenda for its meeting tomorrow has one line item: “Impact of COVID-19 on ICANN68”.

The four-day Policy Forum is currently scheduled to take place from June 22 in Kuala Lumpur, Malaysia.

I think the chances of this event going ahead in the midst of the coronavirus pandemic are zero point zero.

March’s ICANN 67 meeting was replaced with a series of virtual Zoom rooms on February 19, when cases of Covid-19 had been reported in just 26 countries and it was still widely thought of as a Chinese problem.

According to today’s data from the European Centre For Disease Prevention and Control, coronavirus cases have been reported in 204 countries and territories. That’s pretty much all of them.

Even if some currently hard-hit countries in North America and Europe are over the hump by June, you can guarantee that somewhere in the world there’ll be a horrific Biblical epidemic going on. I can’t see ICANN taking the risk of opening its doors to the world at a time like that.

Frankly, I think ICANN 69, the annual general meeting slated for Hamburg in October, has a big question mark hanging over it as well.

Germany may have been handling its crisis relatively well compared to other nations, but ICANN has participants from 150 countries and it may well have to make its call based not on the strongest national response but the weakest.

Coronavirus: more delay and free domains for .gay

Top Level Design is delaying its general-availability launch of .gay domains for an indeterminate period due to the coronavirus pandemic.

The company said that the new gTLD, which had been slated to go GA May 20, will instead carry on in its trademark holders’ sunrise period indefinitely, until it’s figured out a new launch date.

But in the meantime it’s going to offer a “limited” number of .gay domains for free to any “LGBTQ organization, community group, individual, or small business looking for ways to foster digital Pride”.

These will presumably come from the pool of 100 domains that ICANN permits new gTLD registries to allocate prior to launch, so it certainly will not be a free-for-all.

It’s not the first time Top Level Design has rescheduled its launch. It had originally planned to come out to coincide with National Coming Out Day last October, but delayed to give it more time to get its marketing ducks in a row.

It looks like prospective .gay registrants are going to have to wait until the world’s attention is not so obsessively focused on coronavirus and life has somewhat returned to normal before they nab their names.

CentralNic seeing no impact from coronavirus

CentralNic, the triple-play domain company, has told the markets that the coronavirus pandemic is not having an impact on its financial health.

In a statement yesterday, the company said:

To date, CentralNic has not experienced interruptions in its services to customers or in its supply chain, and the Company confirms that its current trading is in line with market expectations.

CentralNic’s business is expected to remain resilient. Its services are procured and delivered over the internet, and the majority of CentralNic’s revenues are payments from existing subscribers and customers on rolling contracts. The Company’s core product is the sale of domain names, which are core infrastructure that enable the functioning of email and websites — the most important communication tools used between work colleagues working remotely and between companies and their customers.

The company makes most of its money from the retail side of the industry nowadays, largely via a network of thousands of resellers, but it also runs its own TLD registries and acts as a back-end for some high-volume TLDs such as .xyz.

It expects to report its 2019 financial results and a summary of its Q1 performance a few weeks from now.

ICANN expects “significant” budget impact from coronavirus

The ongoing coronavirus pandemic is expected to have a “significant” impact on ICANN’s budget, according to an update from the organization.

The organization published its expectations of a $140.4 million budget for the fiscal year that begins this July last December, and opened it up for public comments.

In its summary of those comments (pdf), which had a February 25 deadline and therefore were not focused on the pandemic’s potential impact, ICANN said:

the COVID-19 pandemic is affecting significantly the entire world. ICANN expects that its activities and financial position will be significantly impacted as well. The ICANN org is working with the Board to assess and monitor the potential impact to ICANN’s funding, and planned work such as face-to-face meetings, travel, etc.

Any pandemic-related changes to the budget will be published prior to board approval, ICANN said.

So where is ICANN expecting the impact? It’s not entirely clear. I would expect to see some minor gains from slashing its travel budget in the wake of social distance rules, but it’s less obvious where a “significant” shortfall could occur.

ICANN had operational revenue — the money it gets from billing registries and registrars — of $136.8 million in the fiscal year ending June 30, 2019, its most recently reported year (pdf).

Of that total, roughly $56 million came from the market leaders in both segments, Verisign and GoDaddy, both of which have been given glowing analyst coverage since the outbreak began.

One commentator recently wrote that Verisign is “immune” from coronavirus and GoDaddy’s CFO told analysts just last week that he expects the impact of coronavirus to be “minimal” in the first quarter. That could of course change in future.

Almost half of ICANN’s revenue, some $65.7 million, comes from the top 10 registries and registrars.

So is ICANN expecting to see weakness in the long tail, the few thousand accredited registrars and gTLD registries that account for under $1 million in ICANN contributions per year? Is it expecting reduced voluntary contributions from the ccTLDs and Regional Internet Registries?

Will coronavirus cause huge numbers of small businesses to abandon their domains as they go out of business? Will it inspire large numbers of the recently unemployed and quarantined to start up web-based businesses in an attempt to put food on the table? Will it cause large portfolio owners to downsize to save costs?

All of these outcomes seem possible, but these are unprecedented times, and I couldn’t being to guess how it will play out.

Namecheap and others banning coronavirus domains

Anyone wanting to buy a coronavirus-related domain for scamming purposes won’t be able to do it via Namecheap, which has preemptively banned keyword domains on its storefront.

For the last several days, the registrar has rejiggered its web site to prevent customers adding domains containing certain keywords — such as “coronavirus” or “covid” or “vaccine” — to their shopping carts.

The company said today that customers wishing to register such domains for legitimate purposes can continue to do so by calling up Namecheap customer service and having the name registered manually.

CEO Richard Kirkendall said in an email to customers that Namecheap is also “actively working with authorities to both proactively prevent, and take down, any fraudulent or abusive domains or websites related to COVID19”.

A GoDaddy spokesperson told DI this week that it has also taken down domains when alerted to their usage as coronavirus scams.

Meanwhile, .uk registry Nominet said that it has added keywords such as “coronavirus” and “covid” to its Domain Watch initiative, the same semi-automated system it uses to flag and suspend phishing and “rape” domains preemptively at point of registration. Nominet said:

Those that look suspicious — based on our algorithm and then a manual check — are suspended until we see evidence of good intentions from the registrants.

So far, we have suspended over 180 domains while we conduct this extra due diligence. A small proportion responded to our satisfaction and had their domain names reactivated. It’s highly likely that those who did not respond were intending to use their domains to manipulate a public in need of information.

Another domain company taking action is aftermarket site Dan.com, which today said on Twitter that it will remove all coronavirus related domains from its marketplace.

Starting from today, we will be removing all Corona Virus related domains from https://t.co/vpmKVzih2D.

We're seeing astronomical high prices being asked for these domains and find that unethical and unacceptable.

— DAN.COM (@Undeveloped) March 26, 2020

Namecheap is also offering some customers payment flexibility when it comes to some products — largely non-domain products such as hosting — if they can convince customer service reps of their coronavirus-related financial hardship.

“I urge you not to abuse this offer, please allow it to be used by those who need it most, who are otherwise unable to pay,” Kirkendall wrote.

Verisign, the .com registry, yesterday hinted that it will be offering its registrars some similar flexibility, which one assumes could be passed on to registrants.