The slow crawl to closed generics at ICANN 74

Last Monday saw the 10th anniversary of Reveal Day, the event in London where ICANN officially revealed the 1,930 new gTLD applications submitted earlier in 2012 to a crowd of excited applicants and media.

Dozens of those applications were for closed generics — where the registry operator is the sole registrant, but the string isn’t a trademark — but now, a decade later, the ICANN community still hasn’t decided what to do about that type of gTLD.

At ICANN 74 last week, the Generic Names Supporting Organization and Governmental Advisory Committee inched closer to agreeing the rules of engagement for forthcoming talks on how closed generics should be regulated.

The GNSO’s working group on new gTLDs — known as SubPro — had failed to come to a consensus on whether closed generics should even be allowed, failing even to agree on whether the status quo was the thousand-year-old earlier GNSO policy recommendations that permitted them or the later GAC-influenced ICANN retconning that banned them.

But ever since SubPro delivered its final report, the GAC has been reminding ICANN of its 2013 Beijing communique advice, which stated: “For strings representing generic terms, exclusive registry access should serve a public interest goal.”

At the time, this amounted to an effective ban, but today it’s become an enabler.

ICANN has for the last several months been coaxing the GNSO and the GAC to the negotiating table to help bring the SubPro stalemate into line with the Beijing communique, and the rules of engagement pretty much guarantee that closed generics will be permitted, as least in principle, in the next application round.

GAC chair Manal Ismail told ICANN (pdf) back in April:

discussion should focus on a compromise to allow closed generics only if they serve a public interest goal and that the two “edge outcomes” (i.e. allowing closed generics without restrictions/limitations, and prohibiting closed generics under any circumstance) are unlikely to achieve consensus, and should therefore be considered out of scope for this dialogue.

Remarkably, the GNSO agreed to these terms with little complaint, essentially allowing the GAC to set at least the fundamentals of the policy.

Last week, talks centered on how these bilateral negotiations — or trilateral, as the At-Large Advisory Committee is now also getting a seat at the table — will be proceed.

The rules of engagement were framed by ICANN (pdf) back in March, with the idea that talks would begin before ICANN 74, a deadline that has clearly been missed.

The GNSO convened a small team of members to consider ICANN’s proposals and issued its report (pdf) last week, which now seems to have been agreed upon by the Council.

Both GNSO and GAC are keen that the talks will be facilitated by an independent, non-conflicted, knowledgeable expert, and have conceded that they may have to hire a professional facilitator from outside the community.

That person hasn’t been picked yet, and until he/she has taken their seat no talks are going to happen.

ICANN said a few months ago that it did not expect the closed generics issue to delay the SubPro Operational Design Phase, which is scheduled to wind up in October, but the longer the GAC, GNSO and ICANN dawdle, the more likely that becomes.

All that has to happen is for a group of 14-16 community members to agree on what “public interest” means, and that should be easy, right? Right?

ICANN highlights “not getting things done” risk

ICANN’s board of directors addressed a number of existential threats at its latest workshop, including the perception that it’s simply “not getting things done.”

Chair Maarten Botterman disclosed the discussions, which took place at the end of April, in a blog post Friday.

He described how the board broke up into four “brainstorming” groups, which returned with strikingly similar views on the risks ICANN faces.

There’s a worry that the lack of in-person meetings due to the pandemic is harming ICANN’s ability to work and that various unspecified “geopolitical initiatives” may get in the way of the mission. He added:

Moreover, we recognized the risk of ICANN being seen as “not getting things done.” On the opportunity side is the broad awareness within ICANN that we need to continue to deliver on our mission in the face of new challenges, as demonstrated by the prioritization efforts of the Board, Org, and Community, and our ability to adapt to changing circumstances.

The Org and the community have been faced with what I would call organizational inertia in recent months and years.

I wrote a few months ago about how ICANN hadn’t implemented a policy since December 2016 — more than five years previously.

Major issues facing the industry seem to be either stuck in endless feedback loops of community arguments or interminable Org preparatory work.

The SSAD, pitched as a solution to the problem of Whois access, appears doomed to be scrapped entirely or approved in a much-reduced form that many believe will not address the problem of identifying registrants in a post-GDPR world.

And even if the stripped-back SSAD Light gets approved, there’s a good chance this will add many months to the runway of the next round of new gTLDs, which itself is at an impasse because the Governmental Advisory Committee and the the GNSO cannot agree on whether to allow closed generics.

As it stands, 10 years after the last application round new gTLD policy is in the Operational Design Phase within Org, and not expected to come before the board until late this year. Much of what has been disclosed about the ODP to date looks a lot like wheel-spinning.

More friction over closed generics

ICANN’s Generic Names Supporting Organization and Governmental Advisory Committee seem to be headed to bilateral talks on the thorny issue of whether “closed generic” gTLDs should be allowed, but not without discontent.

The GNSO’s Non-Commercial Stakeholder Group last week opposed these talks, suggesting that the GAC is trying to acquire more policy-making power and take a second bite at the apple on a issue it has already advised on.

The NCSG wrote (pdf) to the GNSO Council last Thursday to oppose GAC talks, which are being encouraged by ICANN management and board.

Closed generics are dictionary-word gTLDs that do not match the registry’s trademarks but which nevertheless act as though they are a dot-brand, where only the registry may register domains.

There aren’t any right now, because ICANN, acting in 2014 in response to 2013 GAC advice, retroactively banned them from the 2012 application round, even though they were initially permitted.

It’s such a divisive issue that the GNSO working group (known as SubPro) that made the policy recommendations for the next round was, I believe uniquely, unable to come up with a even a fudged recommendation.

The GAC is sticking to its view that closed generics are potentially harmful, and since the GNSO couldn’t make its mind up, ICANN has suggested an informal dialogue between the two parties, to encourage a solution both deem acceptable that could then be thrown back at the GNSO for formal ratification.

The NCSG objected to this idea because it appears, NCSG said, that a new policy process is being created that increases the GAC’s powers to intervene in policy-making when it sees something it doesn’t like.

But the constituency appeared to stand alone during a GNSO Council meeting last Thursday, where the prevailing opinion seemed to be that dialogue is always a good thing and it would be bad optics to refuse to talk.

The Council has formed a small team of four to decide whether to talk to the GAC, which is in favor of the move.

African Union can’t register .africa domain

File this one under “ironic”. Also file it under “Maarten Botterman might be the worst pen-pal in history.”

It turns out that the African Union has been unable to register its domain of choice in the .africa gTLD — for which AU support was a crucial and divisive deal-breaker — because of rules insisted upon by governments.

The AU Commission’s vice chair, Kwesi Quartey, has asked ICANN to release the string “au” from the list that all contracted registries have to agree to reserve because they match the names or acronyms of intergovernmental organizations (IGOs).

The AU is an IGO, so its string is protected from being registered by anyone, including itself.

Quartey wrote, in a letter (pdf) to ICANN chair Botterman:

Unfortunately inclusion of the AU label within the IGO List had the unintended consequence of preventing any third party, including the African Union, from registering the acronym as a domain name (au.africa), yet there is an urgent need to change the African Union digital identifier on the internet from au.int to the .africa domain name.

“Urgent need”, you say? That’s ICANN’s specialty!

Botterman immediately sprang into action and sent his urgent reply (pdf), waiting just 21 short months from Quartey’s July 2020 urgent request to urgently pass the buck to the Governmental Advisory Committee.

Only the GAC can ask for a protected acronym to be removed from the list, he wrote. ICANN Org and board have their hands tied.

Also, removing “au” from the list will release it in all gTLDs, potentially allowing it to be registered by third parties in hundreds of other zones, so watch out for that, Botterman noted.

An additional wrinkle not noted in the letter, which may help or hinder the AU, is that Australia also has rights to the same string under an entirely different new gTLD program reserved list, because it matches the Aussie ccTLD.

You’ll recall that .africa was a contested gTLD in which AU support was the deciding factor.

The AU had originally offered to support a bid from DotConnectAfrica, but after the new gTLD program got underway it withdrew that support and conducted a registry tender that was won by ZA Central Registry, which now runs .africa.

DCA has been pursuing ICANN about this in arbitration and the courts ever since.

Closed generic gTLDs likely to be allowed, as governments clash with ICANN

So-called “closed generics” seem to be on a path to being permitted in the next new gTLD application round.

The issue reconfirmed itself at ICANN 73 last week as a major point of disagreement between governments and ICANN, and a major barrier to the next round of new gTLDs going ahead.

But a way forward was proposed that seems likely to to permit closed generics in some form in the next round, resolving an argument that has lasted the better part of a decade.

It seems ICANN now expects that closed generics WILL be permitted, but restricted in some yet-to-be-decided way.

A closed generic is a gTLD representing a dictionary word that is not also a brand, operated by a registry that declines to sell domains to anyone other than itself and its close affiliates.

Imagine McDonald’s operating .burgers, but no other fast food chain, cow-masher, or burger afficionado is allowed to register a .burgers domain.

ICANN’s 2012 application round implicitly allowed applications for such gTLDs — at least, it did not disallow them — which prompted outrage from the governments.

The GAC’s Beijing communique (pdf), from April 2013, urged ICANN to retroactively ban these applications unless they “serve a public interest goal”.

The GAC identified 186 applications from the 2012 round that appeared to be for closed generics.

ICANN, taking the GAC’s lead, gave these applicants a choice to either convert their application to an open generic, withdraw for a refund, or maintain their closed generic status and defer their applications to the next round.

Most opted to switch to an open model. Some of those hacked their way around the problem by making registrations prohibitively restrictive or expensive, or simply sitting on their unlaunched gTLDs indefinitely.

The GNSO policy for the next round is inconclusive on whether closed generics should be permitted. The working group contained two or three competing camps, and nobody conceded enough ground for a consensus recommendation to be made.

It’s one of those wedge issues that highlights the limitations of the multistakeholder model.

The working group couldn’t even fall back on the status quo since they couldn’t agree, in light of ICANN’s specific request for a clear policy, what the status quo even was.

Policy-makers are often also those who stand to financially benefit from selling shovels to new gTLD applicants in the next round. The fewer restrictions, the wider the pool of potential clients and the more attractive the sales pitch.

The working group ended up recommending (big pdf) further policy work by disinterested economics and competition law experts, which hasn’t happened, and the GNSO Council asked the ICANN board for guidance, which it refused to provide.

The GAC has continued to press ICANN on the issue, reinforcing its Beijing advice, for the last year or so. It seems to see the disagreement on closed generics as a problem that highlights the ambiguity of its role within the multistakeholder process.

So ICANN, refusing to create policy in a top-down fashion, is forcing the GAC and the GNSO to the table in bilateral talks in an attempt to create community consensus, but the way the Org is framing the issue may prove instructive.

A framework for these discussions (pdf) prepared by ICANN last week suggests that, when it comes to closed generics, an outright-ban policy and an open-door policy would both be ruled out from the outset.

The paper says:

It is evident from the PDP deliberations and the community’s discussions and feedback that either of the two “edge outcomes” are unlikely to achieve consensus; i.e.:

• 1. allowing closed generics without restrictions or limitations OR
• 2. prohibiting closed generics under any circumstance.

As such, the goal could be to focus the dialogue on how to achieve a balanced outcome that does not represent either of these two scenarios. The space to be explored in this dialogue is identifying circumstances where closed generics could be allowed (e.g., when they serve the public interest, as noted by the GAC Advice). This will likely require discussions as to the types of possible safeguards that could apply to closed generics, identifiable public interest goals for that gTLD and how that goal is to be served, with potential consequences if this turns out not to be the case.

It sounds quite prescriptive, but does it amount to top-down policy making? Insert shrugging emoji here. It seems there’s still scope for the GAC and GNSO to set their own ground rules, even if that does mean relitigating entrenched positions.

The GAC, in its ICANN 73 communique (pdf) said yesterday that it welcomes these talks, and the GNSO Council has already started to put together a small team of councillors (so far also former PDP WG members) to review ICANN’s proposal.

ICANN expects the GNSO-GAC group to begin its work, under an ICANN-supplied facilitator, on one or more Zoom calls before ICANN 74 in June.

Ukraine’s emotional plea to ICANN 73

A Ukrainian government representative has delivered a powerful speech at ICANN 73, calling on ICANN, the community, and the domain name industry to do more to help the war-ravaged country.

Speaking at the opening plenary session of ICANN’s Governmental Advisory Committee, Ukraine representative Andrii Nabok gave his personal account of coming under Russian fire at his home near Kyiv, and praised the “heroic” efforts of ISPs and local ccTLD registry Hostmaster in keeping the internet functional for many Ukrainians.

He went on to condemn the invasion in the strongest terms, calling the Russian Federation “the empire of evil, the terrorist state number one, the fascist of the 21st century”.

Nabok welcomed ICANN’s offer of $1 million to aid with connectivity, saying that Ukraine is in need of satellite terminals, but questioned ICANN’s decision to refuse the country’s request to disconnect .ru from the DNS root.

He went on to call for the domain industry to contribute to anti-Russian sanctions, and questioned whether it is still appropriate for ICANN to have a Russian as one of its DNSSEC “trusted community representative” key-holders.

His speech was followed by prepared expressions of solidarity from the UK, France, the European Union, Switzerland, Australia, the US, Canada, Burkina Faso, Argentina, and Burundi.

Russia took the floor briefly to say that it does not believe ICANN is a suitable forum to discuss “political issues”.

No government echoed Ukraine’s call for ICANN to use its DNS root management powers to sanction Russia, with most expressing support for the Org’s neutrality and the multi-stakeholder model.

I’m going to publish Nabok’s entire speech here, taken from the official transcript with only minor formatting edits. Recordings of the session can be found on its web page (registration required).

“One world, one Internet.” This slogan in our opinion is wonderful. Multistakeholder model, a community-based, consensus-driven approach to policymaking, this model is great. Ukraine admires both the slogan and this model. Ukraine believes both in this slogan and this model. The Ukrainian government showed its support for them in its numerous actions and statements before.

On February 24th at 5:00 am, my family woke up from explosions. We saw a little fire and smoke in the window. Our city near Kyiv was shelled by rockets. I cannot put into words the feeling when you have to explain to your seven-year-old daughter that we urgently need to leave home to save our lives. In a few minutes, my friends from all parts of Ukraine confirmed that there had been missile strikes in the whole country. At once, all the values you lived with yesterday cease to exist, and now the main task is to save our families, relatives, and friends.

So Russian missiles attacked Ukraine. Putin said it is a special military operation in the territory of independent country. Putin said the goal is demilitarization and denazification to ensure the security of Russia. Security of the largest country in the world with the most enormous nuclear potential seems to be defending itself against [inaudible] without nuclear weapons.

Logic has left our chat. Today is the 12th day of the war. Not some operation, but a war. A war in Europe, undeclared Russian war on Ukraine. It is the 12th day of Russian bombing in our peaceful Ukrainian cities and even villages, schools, kindergartens, maternity clinics, even nuclear stations. But Putin’s blitzkrieg became blitz failure. The whole world admires the courage of Ukrainian soldiers and civilians, on social media, in private messages, on TV. Unfortunately, thousand Ukrainians have been killed, including 38 children.

Millions of Ukrainians have been forced to leave their homes. Many of you sent us many words of support, sheltered us, and helped our army. Many thanks to you. Many of you understood that the real goal of Kremlin and Russian dictatorship is to destroy freedom, peace and human rights, right to life, right to dignity, right to freedom, and right to Internet.

Last year our team carried out a large state infrastructure project for deploying fiber optics networks in the most remote villages of our country. According to our last data, we had the highest level of coverage of high-capacity networks among all the European countries. About 97% of the Ukrainian population had the opportunity to connect to Internet based on fiber optic technologies.

Those settlements where the Russian army enters are cut off from the Internet. For example, in one of the villages where my relatives live, there are currently several thousand Russians. As soon as they captured the village, they immediately cut the optical cable and shot at the mobile operator’s base station with a machine gun. People are now cut off from the world.

Today is the 12th day of destroying Ukrainian Internet infrastructure by Russian bombs. Our heroic ISPs rebuild it under fire, risking their lives to save communications for people. Thanks to our heroic ISPs and Elon Musk’s support, people in bomb shelters still have a chance to know whether their relatives are safe or not, whether they are alive, or unfortunately, no more.

Our cybersecurity is also under threat. Thanks to heroic efforts, the .UA domain is stable. All services have been moved to backup positions and function independently from the Ukrainian infrastructure. Hostmaster LLC strengthened Anycast secondaries to prevent possible attacks on domain service.

“ICANN has been built to ensure that the Internet works, not for its coordination role to be used to stop it from working.”

I fully support these words of Göran Marby, ICANN CEO. But I would like to ask you, will it be okay for you if Internet is working for all except Ukrainians? Just because Russian assassins will kill Ukrainians. Of course, this is an apocalyptic scenario that will not be implemented. Ukrainians will not allow this. Ukraine has already received invaluable support from nearly all ICANN constituencies and at individual level. We are grateful for your help in strengthening the cybersecurity of .UA as well as other items of our critical infrastructure. We welcome the decision of ICANN Board to allocate an initial sum of 1 million US dollars to be used to provide financial assistance to support access to Internet infrastructure in emergency situations.

It will be great to spend a part of this sum to buy more Starlinks for Ukrainian Internet users. Of course, ICANN cannot close the sky over Ukraine, but I would like to ask all of you to appeal to your governments to protect Ukraine, and the infrastructure of the Internet for that matter, from the barbaric actions of Putin’s Russia. We fully support ICANN’s commitment to ensure a single and global Internet. Moreover, we have already asked to limit the Kremlin’s influence on our common free digital space since the national Russian peculiarities of Internet governance are known worldwide. Kremlin wants and will be happy to get the sovereign Internet, and they will get it by destroying “one world, one Internet” if we do not unite against such threats.

On March 11th, Russia will completely disconnect from the global Internet but the Russian representative will retain his role as one of the 12 holders of the DNSSEC root key. Are you serious? That is why we call on ICANN community, IANA, registrars and registries and the vendors who make the Internet free and available for everyone on the Earth to join the enforcement to the sanctions of the civilized world recently imposed on Kremlin, Russian companies and individuals. Do not allow them to use the Internet as a cyber battlefield against fundamental human rights and do not allow them to attack critical infrastructure for bloody warfare.

We also call on public and private entities to make steps in technological exodus from the Russian Federation, the empire of evil, the terrorist state number one, the fascist of 21st century. Last person out turns off the lights. I hope it will not be ICANN.

Thank you, dear community, for your support. We believe that you are also on the side of freedom and light.

ICANN trying to strangle SSAD in the crib?

ICANN is trying to kill off or severely cripple Whois reform because it thinks the project stands to be too expensive, too time-consuming, and not fit for purpose.

That’s what many long-time community members are inferring from recent discussions with ICANN management about the Standardized System for Access and Disclosure (SSAD), a proposed method of normalizing how people request access to private, redacted Whois data.

The community has been left trying to read the tea leaves following a December 20 briefing in which ICANN staff admitted they have failed to even approximately estimate how well-used SSAD, which has been criticized by potential users as pointless, might be.

During the briefing, staff gave a broad range of implementation times and cost estimates, saying SSAD could take up to four years and $27 million to build and over $100 million a year to operate, depending on adoption.

The SSAD idea was thrown together in, by ICANN standards, super-fast time with a super-tenuous degree of eventual consensus by a cross-community Expedited Policy Development Process working group.

One of the EPDP’s three former chairs, Kurt Pritz, a former senior ICANN staffer who’s been heavily involved in community work since his departure from the Org in 2012, provided his read of the December webinar on a GNSO Council discussion this week.

“I’ve sat through a number of cost justification or cost benefit analyses in my life and got a lot of reports, and I’ve never sat through one that more clearly said ‘Don’t do this’,” Pritz said.

GNSO liaison to the Governmental Advisory Committee Jeff Neuman concurred moments later: “It seemed that we could imply from the presentation that that staff was saying ‘Don’t do it’… we should require them to put that in writing.”

“It was pretty clear from the meeting that ICANN Org does not want to build the SSAD. Many people in the community think its estimates are absurdly inflated in order to justify that conclusion,” Milton Mueller of the Internet Governance Project recently wrote of the same webinar.

These assessments seem fair, to the extent that ICANN appears seriously averse to implementing SSAD as the recommendations are currently written.

ICANN repeated the December 20 cost-benefit analysis in a meeting with the GAC this week, during which CEO Göran Marby described the limitations of SSAD, and how it cannot override privacy laws such as the GDPR:

It’s not a bug, it’s a feature of GDPR to limit access to data…

The SSAD is a recommended system to streamline the process of requesting data access. It cannot itself increase access to the data, as this is actually determined by the law. And so, in practice, the SSAD is expected to have little to no impact on the contracted parties’ ultimate disclosure or nondisclosure response to requests… it’s a ticketing system with added functionality.

While Marby stressed he was not criticizing the EPDP working group, that’s still a pretty damning assessment of its output.

Marby went on to reiterate that even if SSAD came into existence, people wanting private Whois data could still request it directly from registries and registrars, entirely bypassing SSAD and its potentially expensive (estimated at up to $45) per-query fees.

It seems pretty clear that ICANN staff is not enthused about SSAD in its current form and there’s a strong possibility the board of directors will concur.

So what does the policy-making community do?

There seems to be an emerging general acceptance among members of the GNSO Council that the SSAD proposals are going to have to be modified in some way in order for them to be approved by the board.

The question is whether these modifications are made preemptively, or whether the GNSO waits for more concrete feedback from Org and board before breaking out the blue pen.

Today, all the GNSO has seen is a few PowerPoint pages outlining the top-line findings of ICANN’s Operational Design Assessment, which is not due to be published in full until the board sees it next month.

Some Council members believe they should at least wait until the full report is out, and for the board to put something on the record detailing its reservations about SSAD, before any changes are made.

The next update on SSAD is an open community session, likely to cover much of the same ground as the GAC and GNSO meetings, scheduled for 1500 UTC on January 18. Details here.

The GNSO Council is then scheduled to meet January 20 for its regular monthly meeting, during which next steps will be discussed. It will also meet with the ICANN board later in the month to discuss its concerns.

Whois rule changes that nobody likes get approved anyway

ICANN’s Generic Names Supporting Organization Council has approved a handful of changes to Whois policy, despite the fact that pretty much nobody was fully on-board with the proposals and how they were made.

The new recommendations call for a new field in Whois records to flag up whether the registrant is a private individual, whose privacy is protected by law, or a legal entity like a company, which have no privacy rights.

But the field will be optional, with no obligation for registries or registrars to use it in their Whois services, which has angered intellectual property interests, governments and others.

The working group that came up with the recommendations also declined to find that Whois records should come with an anonymized registrant email address as standard. This absence of change was also adopted by the Council, causing more disappointment.

In short, nothing much is happening to Whois records for the foreseeable future as a result of these policy changes.

But the process to arrive at this conclusion has highlighted not just the deep divisions in the ICANN community but also, some argue, deficiencies in the ICANN process itself.

The Expedited Policy Development Process working group that has since 2018 been looking at the interaction between Whois and privacy protection law, primarily the European Union’s General Data Protection Regulation, had been asked two final questions earlier this year, to wrap up its long-running work.

First, should registrars and registries be forced to distinguish between legal and natural persons when deciding what data to publish in Whois?

Second, should there be a registrant-based or registration-based anonymized email published in Whois to help people contact domain owners and/or correlate ownership across records?

The answer on both counts was that it’s up to the registry or registrar to decide.

On legal versus natural, the EPDP decided that ICANN should work with the technical community to create a new field in the Whois standard (RDAP), but that there should be no obligation for the industry to use it.

On anonymized email addresses, the working group recommendations were even hand-wavier — they merely refer the industry to some legal advice on how to implement such a system in a GDPR-compliant way.

While this phase of the EPDP’s work was super-fast by ICANN standards (taking about nine months) and piss-weak with its output, it nevertheless attracted a whole lot of dissent.

While its tasks appeared straightforward to outsiders, it nevertheless appears to have inherited the simmering tensions and entrenched positions of earlier phases and turned out to be one of the most divisive and fractious working groups in the modern ICANN period.

Almost every group involved in the work submitted a minority statement expressing either their displeasure with the outcome, or with the process used to arrive at it, or both. Even some of the largely positive statements reek of sarcasm and resentment.

EPDP chair Keith Drazek went to the extent of saying that the minority statements should be read as part and parcel of the group’s Final Report, saying “some groups felt that the work did not go as far as needed, or did not include sufficient detail, while other groups felt that certain recommendations were not appropriate or necessary”.

This Final Report constitutes a compromise that is the maximum that could be achieved by the group at this time under our currently allocated time and scope, and it should not be read as delivering results that were fully satisfactory to everyone.

The appears to be an understatement.

The Intellectual Property Constituency and Business Constituency were both the angriest, as you might expect. They wanted to be able to get more data on legal persons, and to be able to reverse-engineer domain portfolios using anonymous registrant-baed email addresses, and they won’t be able to do either.

The Governmental Advisory Committee and Security and Stability Advisory Committee both expressed positions in line with the IPC/BC, dismayed that no enforceable contract language will emerge from this process.

Councilor Marie Pattullo of the BC said during the GNSO Council vote last Wednesday that the work “exceeds what is necessary to protect registrant data” and that the EPDP failed to “preserve the WHOIS database to the greatest extent possible”.

The “optional differentiation between legal and natural persons is inadequate”, she said, resulting in “a significant number of records being needlessly redacted or otherwise being made unavailable”. The approved policies contain “no real policy and places no enforceable obligations on contracted parties”, she said.

IPC councilor John McElwaine called the EPDP “unfinished work” because the working group failed to reach a consensus on the legal/natural question. The IPC minority statement had said:

Requiring ICANN to coordinate the technical community in the creation of a data element which contracted parties are free to ignore altogether falls far short of “resolving” the legal vs. natural issue. And failing to require differentiation of personal and non-personal data fails to meet the overarching goal of the EPDP to “preserve the WHOIS database to the greatest extent possible” while complying with privacy law.

But McElwaine conceded that “a minority of IPC members did favor these outputs as being minor, incremental changes that are better than nothing”.

The BC and IPC both voted against the proposals, but that was not enough to kill them. They would have needed support from at least one councilor on the the other side of the GNSO’s Non-Contracted Parties House, the Non-Commercial Stakeholders Group, and that hand was not raised.

While the NCSG voted “aye”, and seemed generally fine with the outcome, it wasn’t happy with the process, and had some stern words for its opponents. It said in its minority statement:

The process for this EPDP has been unnecessarily long and painful, however, and does not reflect an appreciation for ICANN’s responsibility to comply with data protection law but rather the difficulty in getting many stakeholders to embrace the concept of respect for registrants’ rights…

With respect to the precise issues addressed in this report, we have stressed throughout this EPDP, and in a previous PDP on privacy proxy services, that the distinction between legal and natural is not a useful distinction to make, when deciding about the need to protect data in the RDS. It was, as we have reiterated many times, the wrong question to ask, because many workers employed by a legal person or company have privacy rights with respect to the disclosure of their personal information and contact data. The legal person does not have privacy rights, but people do.

While welcoming the result, the Registrars Stakeholder Group had similar concerns about the process, accusing its opponents of trying to impose additional legal risks on contracted parties. Its minority statement says:

it is disappointing that achieving this result was the product of significant struggle. Throughout the work on this Phase, the WG revisited issues repeatedly without adding anything substantially new to the discussion, and discussed topics which were out of scope. Perhaps most importantly, the WG was on many occasions uninterested in or unconcerned with the legal and financial risks that some proposed obligations would create for contracted parties in varying jurisdictions or of differing business models, or the risks to registrants themselves.

The Registries Stakeholder Group drilled down even more on the “out of scope” issue, saying the recommendation to create a new legal vs natural field in Whois went beyond what the working group had been tasked with.

They disagreed with, and indeed challenged, Drazek’s decision that the discussion was in-scope, but reluctantly went ahead and voted on the proposals in Council in order to finally draw a line under the whole issue.

The question of whether the legal vs natural question has been in fact been resolved seems to be an ongoing point of conflict, with the RySG, RrSG and NCSG saying it’s finally time to put the matter to bed and the IPC and BC insisting that consensus has not yet been reached.

The RySG wrote that it is “well past time to consider the issue closed” and that the EPDP had produced a “valuable and acceptable outcome”, adding:

The RySG is concerned that some have suggested this issue is not resolved. This question has been discussed in three separate phases of the EPDP and the result each time has been that Contracted Parties may differentiate but are not required to do so. This clearly demonstrates that this matter has been addressed appropriately and consistently. A perception that this work is somehow unresolved could be detrimental to the ICANN community and seen as undermining the effectiveness of the multistakeholder model.

Conversely, the BC said the report “represents an unfortunate failure of the multistakeholder process” adding that “we believe the record should state that consensus opinion did not and still does not exist”.

The IPC noted “a troubling trend in multistakeholder policy development”, saying in a clear swipe at the contracted parties that “little success is possible when some stakeholders are only willing to act exclusively in their own interests with little regard for compromise in the interest of the greater good.”

So, depending on who you believe, either the multistakeholder process is captured and controlled by intransigent contracted parties, or it’s unduly influenced by those who want to go ultra vires to interfere with the business of selling domains in order to violate registrant privacy.

And in either case the multistakeholder model is at risk — either “agree to disagree” counts as a consensus position, or it’s an invitation for an infinite series of future policy debates.

Business as usual at the GNSO, in other words.

Island demands return of its “naked” ccTLD

The Pacific island nation of Niue is loudly demanding that ICANN hand over control of its ccTLD, .nu, after two decades of bitter argument.

The government has taken the highly unusual move of filing a redelegation request with ICANN’s IANA unit publicly, forwarding it to other governments and the media.

The request is backed by UNR, the former Uniregistry, which is being put forward as the proposed back-end provider.

Niue claims, as it has since at least 2000, that the string was misappropriated by an American entrepreneur in the 1990s and has been used to generate tens of millions of dollars in revenue, with almost no benefit to the country.

The word “nu” is Swedish for “now”. It’s also the masculine form of “naked” in French, which enables lazy reporters to write click-baity headlines.

The Swedish meaning was first spotted by Massachusetts-based Bill Semich in 1997. Together with Niue-based Kiwi ex-pat Stafford Guest, he obtained the delegation for .nu from pre-ICANN root zone supremo Jon Postel.

They used the name Internet Users Society Niue (IUSN) and started selling .nu names to Swedes as a meaningful alternative to .se and .com.

As of today, there are about 264,000 registered .nu names, retailing for about $30 a year. Pre-2018 data is not available, but a couple of years ago, it had over 500,000 names under management.

That kind of money would be incredibly useful to Niue, which has a population of under 2,000 and few other natural resources to speak of. The country relies on hand-outs from New Zealand and, historically, dubious offshore banking schemes and the sale of postage stamps to collectors.

The government has said in the past that .nu cash would enable it to boost its internet infrastructure, thereby boosting its attractiveness as a tourist destination.

IUSN and Niue signed a memorandum of understanding in 1999, but a year later the government passed a law decreeing “.nu is a National resource for which the prime
authority is the Government of Niue”.

It’s been trying to get control of .nu ever since, but IUSN has consistently refused to recognize this law, Niue has always claimed, and has always refused to cooperate in a redelegation.

The company made headlines back in 2003 for claiming that it was rolling out free nationwide Wi-Fi in Niue, but there are serious questions about whether that ever actually happened.

Now, Niue claims:

The Wi-Fi has been continuously unstable and exceedingly limited. As of today, the ccTLD.NU administration and local presence of the IUSN in Niue consists of a motel with a PO Box and the Wi-Fi is covering a [n]egligible are[a] surrounding the motel. There is no operational management of the ccTLD.NU by the IUSN present in Niue.

I believe the motel in question is Coral Gardens, north of capital Alofi, which is or was run by Guest.

While IUSN is still the official ccTLD manager for .nu, according to IANA records, the business operations and technical back-end were transferred to Swedish ccTLD manager IIS in 2013.

IIS agreed to pay IUSN a minimum of $14.7 million over 15 years for the license to .nu, but the domain remains delegated to IUSN.

Niue, represented by its Swedish special envoy Pär Brumark (who until recently was also vice-chair of ICANN’s Governmental Advisory Committee, representing Niue) sued IIS in late 2018 in an attempt to gain control of the ccTLD.

The government argues that under Swedish control, profits from .nu can only be earmarked for the development of the Swedish internet, at the expense of Niue.

Brumark tells us the case is currently being delayed due to the coronavirus pandemic.

The problem Niue has now is pretty much the same as it always has been — IANA rules state that the losing party in a redelegation has to consent to the change of control, and IUSN really has no incentive to do so.

Niue’s best chance appears to be either the Swedish lawsuit or the possibility that it can get the GAC on board to support its request.

In-progress redelegation requests are also exempt by convention from ICANN’s transparency rules, so we’re not going to hear anything other than what Niue releases or the GAC can publicly squeeze out of ICANN leadership.

You can read the redelegation request (pdf) here.

Europe’s top dogs could decide the future of Whois

ICANN is pleading with the European Commission for legal clarity to help solve the two-year-old fight over the future of Whois in the age of GDPR.

CEO Göran Marby has written to three commissioners to ask for a definitive opinion on whether a centralized, mostly automated Whois system would free up registries and registrars from legal liability if their customers’ data is inappropriately disclosed.

It’s a question ICANN has been asking for years, but this time it comes after the ICANN community has come up with a set of policy recommendations that would create something called SSAD, for System for Standardized Access/Disclosure.

SSAD is supported by registries, registrars and non-commercial interests, but has been broadly criticized by governments, intellectual property interests, security experts and others as being not fit for purpose.

While it would create a centralized gateway for funneling Whois queries to contracted parties, and an accreditation system for those making the queries, the decision to accept or refuse the query would still lie with registries and registrars and be largely human-powered.

It’s been described as a glorified, $9 million-a-year ticketing system that will fail to provide better access to Whois to those who say they need it (largely the IP interests).

But registries and registrars say they cannot accept a solution that offloads decision-making to a centralized third party such as ICANN, unless that third party shoulders all the legal liability for mistakes, and whether that’s possible is far from clear this early in the life of GDPR.

As Marby told the commissioners:

Legal clarity could mean the difference between ICANN having a fragmented system that routes most requests for access to non-public registration data from requestors to thousands of individual registries and registrars for a decision, on the one hand, versus ultimately being able to implement a centralized, predictable solution in which decisions about whether or not to disclose non-public registration data in most or all cases could be made consistently, predictably, in a manner that is transparent and accountable to requestors and data subjects alike.

In GDPR lingo, the question is who becomes the “controller” of the data in a centralized system. The controller is the one that could get slapped with huge fines in the event of a privacy breach.

There’s a concept of “successive controllers”, where data is passed through a chain of handlers. ICANN wants clarity on whether, should a registrar send data to an ICANN central gateway, its liability ends there, before the final disclosure decision is made.

It’s asking the European Commission to exercise its authority under the GDPR to force the European Data Protection Board to issue a blanket opinion clarifying these issues, with the expectation that SSAD as currently envisaged could evolve over time to be something more like what the IP folk want.

For ICANN, such a ruling could help quell criticism from its influential advisory bodies, notably the Governmental Advisory Committee, which have come out strongly against the SSAD proposals.

If ICANN chooses to wait for the European Commission and EDPB responses to its new request, it’s highly unlikely we’re going to see the ICANN board fully approve SSAD at its annual general meeting later this month.