Pirates lose privacy rights under new ICANN rules

People operating piracy web sites would have a harder time keeping their personal information private under new ICANN rules.
ICANN’s GNSO Council last night approved a set of recommendations that lay down the rules of engagement for when trademark and copyright owners try to unmask Whois privacy users.
Among other things, the new rules would make it clear that privacy services are not permitted to reject requests to reveal a domain’s true owner just because the IP-based request relates to the content of a web site rather than just its domain name.
The recommendations also contain safeguards that would allow registrants to retain their privacy if, for example, their safety would be at risk if their identities were revealed.
The 93-page document (pdf) approved unanimously by the Council carries a “Illustrative Disclosure Framework” appendix that lays out the procedures in some depth.
The framework only covers requests from IP owners to proxy/privacy services. The GNSO was unable to come up with a similar framework for dealing with, for example, requests from law enforcement agencies.
It states flatly:

Disclosure [of the registrant’s true Whois details] cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the Request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

This fairly explicitly prevents privacy services (which in most cases are registrars) using the “we don’t regulate content” argument to shoot down disclosure requests from IP owners.
Some registrars were not happy about this paragraph in early drafts, yet it remains.
Count that as a win for the IP lobby.
However, the new recommendations spend a lot more time giving IP owners a quite strict set of guidelines for how to file such requests in the first place.
If they persistently spam the registrar with automated disclosure requests, the registrar is free to ignore them. They can even share details of spammy IP owners with other registrars.
The registrar is also free to ignore requests that, for example, don’t give the exact or representative URL of an alleged copyright infringement, or if the requester has not first attempted to contact the registrant via an email relay service, should one be in place.
The registrant also gets a 15-day warning that somebody has requested their private details, during which, if they value their privacy more than their web site, they’re able to relinquish their domain and remain anonymous.
If the registrant instead uses that time to provide a good reason why they’re not infringing the requester’s rights, and the privacy service agrees, the request can also be denied.
The guidelines would make it easier for privacy service operators to understand what their obligations are. By formalizing the request format, it should make it easier to separate legit requests from the spurious requests.
They’re even allowed to charge IP owners a nominal fee to streamline the processing of their requests.
While these recommendations have been approved by the GNSO Council, they need to be approved by the ICANN board before becoming the law of the ‘net.
They also need to pass through an implementation process (conducted by ICANN staff and GNSO members) that turns the recommendations into written procedures and contracts which, due to their complexity, I have a hunch will take some time.
The idea is that the rules will form part of an accreditation program for privacy/proxy services, administered by ICANN.
Registrars would only be able to use P/P services that agree to follow these rules and that have been accredited by ICANN.
It seems to me that the new rules may be quite effective at cracking down on rogue, “bulletproof” registrars that automatically dismiss piracy-based disclosure requests by saying they’re not qualified to adjudicate copyright disputes.

ICANN confirms domain privacy is for all

Commercial entities will not be excluded from buying domain privacy services, ICANN’s GNSO Council has confirmed.
The Council last night voted unanimously to approve a set of recommendations that would make it compulsory for privacy and proxy services to be accredited by ICANN for the first time.
The recommendations govern among other things how privacy services are expected to behave when they receive notices of trademark or copyright infringement.
But missing is a proposal that would have prevented the use of privacy for “transactional” web sites, something which caused a great deal of controversy last year.
The newly adopted recommendations clearly state that nobody is to be excluded from privacy on these grounds.
The Council voted to adopt the final, 93-page report of the Privacy and Proxy Services Accreditation Issues (pdf) working group, which states:

Fundamentally, P/P services should remain available to registrants irrespective of their status as commercial or non-commercial organizations or as individuals. Further, P/P registrations should not be limited to private individuals who use their domains for non-commercial purposes.

The minority view that web sites that process financial transactions should not be able to use privacy came from intellectual property, anti-abuse and law enforcement community members.
However, opponents said it would infringe the privacy rights of home business owners, bloggers, political activists and others.
It could even lead to vicious “doxing”-related crimes, such as “swatting”, where idiots call in fake violent crime reports against rivals’ home addresses, some said.
It also turned out, as we revealed last November, that 55% of US presidential candidates operate transactional web sites that use privacy on their domains.
Two separate registrar initiatives, one backed by the Electronic Frontier Foundation, started letter-writing campaigns that resulted in over 20,000 comments being received on the the PPSAI’s initial report last July.
Those comments are acknowledged in the PPSAI final report that the GNSO Council just approved.
The adopted recommendations (which I’ll get into in a separate article) still have to be approved by the ICANN board of directors and have to undergo an implementation process that puts the rather broad policies into concrete processes and procedures.

Bladel romps home in ICANN election re-run

Go Daddy VP of policy James Bladel has been elected chair of ICANN’s Generic Names Supporting Organization Council.
The result came a month after the GNSO Council embarrassingly failed to elect a chair to replace outgoing Jonathan Robinson.
This time Bladel ran unopposed, securing the unanimous support of both his own Contracted Parties House and the Non-Contracted Parties House, which did not field a candidate.
In the October vote, the NCPH had nominated academic Heather Forrest.
Due to personal friction between commercial and non-commercial NCPH Council members, Bladel lost that election to “none of the above” by a single vote.
Forrest has been elected vice-chair, along with Neustar’s Donna Austin.
Volker Greimann and David Cake, who had been running the Council on an interim basis for the last month, have stepped aside.

Why did the GNSO fail to pick a new leader?

Political infighting between sections of the Generic Names Supporting Organization seems to be responsible for the GNSO Council’s failure to elect a new chair yesterday.
Rumor has it that Contracted Parties House pick James Bladel, a VP at Go Daddy, only lost because of ructions in the Non-Contracted Parties House.
I stress these are just rumors — nobody with any first-hand knowledge of the situation was prepared to go on-record with me today — but they come from multiple sources.
As I reported earlier today, Bladel failed to secure the support of over 60% of the NCPH — the threshold to be elected chair — despite having the unanimous support of the CPH.
Roughly 47% of the NCPH chose to vote for “none of the above” instead, resulting in the GNSO Council now lacking a chair.
But I gather that this was not a diss against Bladel, his employer, or the CPH per se.
Rather, the story I’m hearing is that some councilors gave an empty chair their votes as a result of disagreements between the commercial and non-commercial sides of the NCPH.
Some say a deal had been made under which NCPH candidate Heather Forrest would receive at least 60% of the vote in round one, but some voters reneged on the deal, meaning she was knocked out of the running.
I don’t know if that’s true or not, but what it implies is that some votes that would have otherwise gone to Bladel in round two of voting were withheld, essentially out of spite.
Bladel only needed one additional NCPH vote to hit his 60%.
If this sounds like childish bickering, you may be right, but it wouldn’t be the first time a GNSO constituency has disrupted the council in order to make a point.
The last time that happened to a significant degree was over three years ago, when non-commercial users exploited a timing issue to protest new rights protection mechanisms for the Olympics, risking the new gTLD program timeline.
That led some at the time to predict the “death” of the GNSO.
That’s not happening this time. If anything, the wagons are circling.
Hastily reappointed council vice chair Volker Greimann, who became de facto chair at least for today, described the current situation as “business as usual” today, pointing out that ICANN bylaws envisaged and accounted for this kind of power vacuum.
The next vote on the chair’s position will take place at least a month from now.

Whois privacy reforms incoming

Whois privacy services will become regulated by ICANN under proposals published today, but there’s a big disagreement about whether all companies should be allowed to use them.
A working group has released the first draft of its recommendations covering privacy and proxy services, which mask the identity and contact details of domain registrants.
The report says that P/P services should be accredited by ICANN much like registrars are today.
Registrars should be obliged to disclose which such services they operate or are affilated with, presumably at the risk of their Registrar Accreditation Agreement if they do not comply, the report recommends.
A highlight of the paper is a set of proposed rules governing the release of private Whois data when it is requested by intellectual property interests.
Under the proposed rules, privacy services would not be allowed to reject such requests purely because the alleged infringement deals with the content of a web site rather than just the domain.
So the identity of a private registrant of a non-infringing domain would be vulnerable to disclosure if, for example, the domain hosted bootleg content.
Registrars would be able to charge IP owners a nominal “cost recovery” fee in order to process requests and would be able to ignore spammy automated requests that did not appear to have been manually vetted.
There’d be a new arbitration process that would kick in to resolve disputes between IP interests and P/P service providers.
The 98 pages of recommendations (pdf) were drafted by the Generic Names Supporting Organization’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) and opened for public comment today.
There are a lot of gaps in the report. Work, it seems, still needs to be done.
For example, it acknowledges that the working group didn’t reach any conclusions about what should happen when law enforcement agencies ask for private data.
The group was dominated by registrars and IP interests. There was only one LEA representative and only one governmental representative, and they participated in a very small number of teleconferences.
There was also a sharp division on the issue of who should be able to use privacy services, with two dissenting opinions attached to the report.
One faction, led by MarkMonitor and including Facebook, Domain Tools and fake pharmacy watchdog LegitScript, said that any company that engages in e-commerce transactions should be ineligible for privacy, saying: “Transparent information helps prevent malicious activity”.
Another group, comprising a handful of non-commercial stakeholders, said that no kind of activity should prevent you from registering a domain privately, pointing to the example of persecuted political groups using web sites to raise funds.
There was a general consensus, however, than merely being a commercial entity should not alone exclude you from using a P/P service.
Currently, registrar signatories to the 2013 RAA are bound by a temporary P/P policy that is set to expire January 2017 or whenever the P/P accreditation process starts.
There are a lot of recommendations in the report, and I’ve only touched on a handful here. The public comment period closes July 7.

For only the second time, ICANN tells the GAC to get stuffed

ICANN’s board of directors has decided to formally disagree with its Governmental Advisory Committee for what I believe is only the second time in the organization’s history.
In a letter to new GAC chair Thomas Schneider today, ICANN chair Steve Crocker took issue with the fact that the GAC recently advised the board to cut the GNSO from a policy-making decision.
The letter kick-starts a formal “Consultation Procedure” in which the board and GAC try to reconcile their differences.
It’s only the second time, I believe, that this kind of procedure — which has been alluded to in the ICANN bylaws since the early days of the organization — has been invoked by the board.
The first time was in 2010, when the board initiated a consultation with the GAC when they disagreed about approval of the .xxx gTLD.
It was all a bit slapdash back then, but the procedure has since been formalized somewhat into a seven-step process that Crocker outlined in an attachment to his letter (pdf) today.
The actual substance of the disagreement is a bit “inside baseball”, relating to the long-running (embarrassing, time-wasting) saga over protection for Red Cross/Red Crescent names in new gTLDs.
Back in June at the ICANN 50 public meeting in London, the GAC issued advice stating:

the protections due to the Red Cross and Red Crescent terms and names should not be subjected to, or conditioned upon, a policy development process

A Policy Development Process is the mechanism through which the multi-stakeholder GNSO creates new ICANN policies. Generally, a PDP takes a really long time.
The GNSO had already finished a PDP that granted protection to the names of the Red Cross and Red Crescent in multiple scripts across all new gTLDs, but the GAC suddenly decided earlier this year that it wanted the names of 189 national Red Cross organizations protected too.
And it wasn’t prepared to wait for another PDP to get it.
So, in its haste to get its changing RC/RC demands met by ICANN, the GAC basically told ICANN’s board to ignore the GNSO.
That was obviously totally uncool — a slap in the face for the rest of the ICANN community and a bit of an admission that the GAC doesn’t like to play nicely in a multi-stakeholder context.
But it would also be, Crocker told Schneider today, a violation of ICANN’s bylaws:

The Board has concerns about the advice in the London Communiqué because it appears to be inconsistent with the framework established in the Bylaws granting the GNSO authority to recommend consensus policies to the Board, and the Board to appropriately act upon policies developed through the bottom-up consensus policy developed by the GNSO.

Now that Crocker has formally initiated the Consultation Procedure, the process now calls for a series of written and face-to-face interactions that could last as long as six months.
While the GAC may not be getting the speedy resolution it so wanted, the ICANN board’s New gTLD Program Committee has nevertheless already voted to give the Red Cross and Red Crescent the additional protections the GAC wanted, albeit only on a temporary basis.

Oops! Cock-up reveals ICANN survey respondent emails

An ICANN contractor accidentally revealed the email addresses of almost 100 people who responded to a survey related to a review of the Generic Names Supporting Organization.
An invitation to participate in a follow-up survey was sent out to respondents today with all the email addresses in the To:, rather than BCC:, field.
Westlake Governance, which is conducting the survey for ICANN, quickly sent an apology:

We have been sending invitations in batches, and regret that we included your address in the only set of invitations that was copied inadvertently in the “To” line as addressee, rather than as a “Bcc.”
We sincerely apologise for this breach of our internal protocols and potentially of your privacy.

The misfire revealed that 15 out of the 98 listed respondents have @icann.org email addresses, suggesting roughly 15% of the responses came from ICANN staffers.
While the survey certainly anticipated responses from within the organization — one question gives “staff” as an option for the respondent to state their affiliation — some are not happy anyway.
Neustar vice president Jeff Neuman tweeted:

Should #ICANN staff be providing feedback on GNSO review? I see value in that; but results should not be grouped in with other responses.

— Jeff Neuman (@jintlaw) November 1, 2014

The massive, 93-question survey (pdf) was designed to kick-start the next cycle in ICANN’s interminable reviews of its policy-making bodies, in this case the GNSO.
The results of the survey will be used to inform a review of the GNSO’s structure, which could potentially re-balance power within the organization.

Unanimous support for new ICANN appeals process

The Generic Names Supporting Organization has issued an “unprecedented” statement of “unanimous” support for a new way for ICANN community members to appeal ICANN decisions.
All seven constituency groups signed onto a statement that was read by representatives of registries, non-commercial users and intellectual property interests at the ICANN 50 public forum last week.
“It only took us 50 meetings, but I think the rarity of what you’re witnessing this afternoon sends a very strong message about our views,” the Registries Stakeholder Group’s Keith Drazek said.
This is the meat of the demand:

The entire GNSO joins together today calling for the Board to support community creation of an independent accountability mechanism that provides meaningful review and adequate redress for those harmed by ICANN action or inaction in contravention of an agreed upon compact with the community.

Rafik Dammak of the Non-Commercial Users Constituency added that the creation of such a mechanism is “a necessary and integral element of the IANA stewardship transition.”
“The Board’s decisions must be open to challenge and the Board cannot be in a position of reviewing and certifying its own decisions,” he said.
“We need an independent accountability structure that holds the ICANN Board, Staff, and various stakeholder groups accountable under ICANN’s governing documents, serves as an ultimate review of Board/Staff decisions,” said Kristina Rosette of the Intellectual Property Constituency.
What they’re basically looking for is a third way to appeal ICANN decisions beyond the existing Independent Review Process and Request for Reconsideration mechanisms.
IRP is considered too time-consuming and expensive for anyone other than well-funded commercial stakeholders. It cost ICM Registry millions in legal fees to win its IRP in 2010.
RfR, meanwhile, sees the ICANN board review its own decisions, and is only successful (in 15 years it’s only happened once, a week ago) when a requester can bring new evidence to the table.
What the GNSO seems to be looking for is a third way — independent review of ICANN decisions that doesn’t cost a bomb and can be used to reexamine decisions on the merits.
In many ways the demand represents the low-hanging fruit of the amorphous “accountability” discussion that took place at length at the London meeting last week.
ICANN accountability is being examined simultaneously with the proposed transition of the IANA stewardship functions from the US Department of Commerce to a yet-undefined mechanism.
There seems to be broad community consensus that the transition should be linked to improvements in accountability.
During the “constituency day” sessions on Tuesday, during which the ICANN board visits in turn with each GNSO constituency, accountability was the theme common to each and every session.
Time and again, CEO Fadi Chehade pushed the constituency he was addressing to provide some specifics.
“What is accountability and how accountable are we today?” he asked the RySG. “Who are we accountable to for what? We need to get precise before you ask us to answer a question that says when you finish accountability, then you can move to the transition.”
The GNSO statement two days later, which still needs fleshing out with details, appears to be the first step toward providing the precision Chehade wants.
Chehade said multiple times that the accountability review and the IANA transition discussions are “interrelated” but not “interdependent.”
If one were dependent on the other, it would be easier for opponents to stonewall the IANA transition by delaying the accountability review, he said.
“There are people in this community would like the transition from the US government to never happen,” he told the RySG. “They won’t admit it, but there are several, in this room even, who want this to never happen.”
He later told the NCUC that these bogeymen were “not in this room”, highlighting perhaps his belief that one or more gTLD registries is preparing to throw a spanner in the works.
Suspicion immediately fell on Verisign, forcing Drazek to issue a separate statement at the public forum on Thursday denying that the company (his employer) opposes the transition:

VeriSign supports NTIA’s March 14th, 2014 announcement. VeriSign supports NTIA’s four key principles. VeriSign Supports the bottom-up multistakeholder process that is now under way and that we have already been very much engaged. VeriSign supports the target date of September 2015 for transition. We support these things provided the multistakeholder community recommendations for ICANN’s accountability reforms are accepted by NTIA before the final transition, and sufficiently implemented by ICANN subject to measurable deliverables.

It’s not much of a denial, really, more of a clarification of where Verisign stands and confirmation that it wants, as Chehade alluded to, accountability reform prior to the IANA transition.
In my view, accountability is the more important of these two threads.
The Department of Commerce doesn’t actually do much in terms of its hands-on role as steward of the IANA functions as they related to domain names. It merely checks that ICANN’s proper procedures have been followed before signing off on DNS root zone changes.
If sanity prevails in the ICANN community’s transition discussions (and I have no reason to believe it will) whatever replaces the US should be similarly mute and invisible.
However, Commerce’s arguably more important role has been to act as a constant Sword of Damocles, a threat that ICANN could lose its IANA powers if it goes rogue and starts acting (in the US government’s view) against the best interests of the internet community.
That’s a very crude accountability mechanism.
What ICANN needs in future is not a direct replacement of that existential threat, but a mechanism of accessible, independent third-party review that will give the ICANN community and internet users everywhere confidence that ICANN isn’t a loose cannon with its hand on the internet’s tiller.

GAC rejects multistakeholderism, tells ICANN to ignore the GNSO

The Governmental Advisory Committee has advised ICANN to do as it’s told and stop listening to the views of other stakeholders, on the issue of protection mechanisms for the Red Cross.
In a barely believable piece of formal advice to the ICANN board this morning, part of its London communique (pdf), the GAC said:

the protections due to the Red Cross and Red Crescent terms and names should not be subjected to, or conditioned upon, a policy development process

That’s the GAC telling the ICANN board to do what the GAC says without involving the rest of the ICANN community, specifically the multi-stakeholder Generic Names Supporting Organization.
Some in the GNSO have already informally expressed their anger about this. More, and more formal, responses are expected to follow.
It’s a baffling GAC move given that most governments have spent much of the ICANN 50 meeting this week professing how much they support the multi-stakeholder model of internet governance.
Now the GAC is explicitly telling ICANN to ignore anyone that isn’t the GAC, on this particular issue.
That’s unprecedented, though many would say that GAC statements often sound like the existence of other advisory committees and supporting organizations is little more than an annoyance to members.
During a meeting between the ICANN board and the GAC on Tuesday, UK GAC member Mark Carvell expressed some of that frustration, saying ICANN’s approach to the issue has been “completely unacceptable”.
Carvell said:

we’re talking about names that are protected under international law and implemented in national legislation
So, for example, if you go down Pride Street around the corner, you won’t find Red Cross Burgers. You won’t find Patisserie Croix Rouge in Paris anywhere, or in London, indeed, because it’s against the law to use those names.
So the response that we’ve had from the Board is equating these names to trademarks by referring to the GNSO response, saying that this is a matter for incorporation of policy development that would use the trademark clearinghouse.
So I just wanted to make the point here that this is completely unacceptable to us. We’re in a position as governments and administrations in implementing national law. So our advice continues to be that these names need to be protected and not subject to some policy development process that equates these names to trademarks
and brands.

That point of view seems to have translated directly into the GAC’s communique today.
The GAC statement is doubly baffling because the Red Cross and Red Crescent already enjoy protections in the new gTLD program, and the GNSO has voted to make these protections permanent.
The GAC has been pushing for protections for the Red Cross for years.
It’s a noble effort in principle, designed to help thwart fraudsters who would use the Red Cross brand to bilk money out of well-meaning internet users in the wake of human tragedies such as earthquakes and tsunamis.
The ICANN board of directors first agreed to adopt such protections in 2011, when it approved the new gTLD program.
Red Cross protections were added to the program rules then on a temporary basis, pending a formal GNSO policy on the matter.
The GNSO took a while to get there, but it formally passed a resolution in November last year that would protect a list of Red Cross organizations at both the top and second levels in the new gTLD program.
So what’s the GAC’s problem?
ICANN director Chris Disspain asked Carvell during the Tuesday GAC-board session. Carvell responded:

I’m talking about our advice with regard to protection of national entities at the second level. So, for example, British Red Cross dot whatever. That protection does not exist, and is not agreed as we understand it.

The original list of Red Cross/Red Crescent strings for which the GAC demanded protection includes strings like “redcross” and “croissant-rouge”, but it does not include strings such as “americanredcross”.
There are 189 national Red Cross organizations that are not currently protected, according to the GAC.
Why are these strings not on the list?
It appears to be because the GAC didn’t ask for such protections until March this year, six months after the GNSO concluded its PDP and close to three years after the temporary protections were originally implemented.
The GAC communique from the latest Singapore meeting (pdf) contains a request for national Red Cross organizations to be protected, but I can’t find any matching GAC advice that predates March 2014.
The GAC seems to have screwed up, in other words, by not asking for all the protections it wanted three years ago.
And now it’s apparently demanding that its new, very late demands for protection get implemented by ICANN without a PDP and with no input from any other area of the ICANN community.
The GAC spent a lot of time this week talking up the multistakeholder process, but now it seems prepared to throw the concept under a bus either in the name of expediency or to cover up the fact that it seriously dropped the ball.
Nobody can deny that its heart is in the right place, but is abandoning support for multistakeholderism really the best way to go about getting what it wants, at a time when everyone is claiming governments won’t control the newly liberated ICANN?

GNSO says dot-brand rules “inconsistent” with policy

The ability of dot-brand gTLDs to limit how many registrars they work with is “inconsistent” with the GNSO’s longstanding policy on new gTLDs, ICANN’s GNSO Council has found.
At the end of March, ICANN approved a set of Registry Agreement opt-outs, such as the ability to avoid sunrise periods and approve just three hand-picked registrars, for dot-brands.
They’re designed to make life easy for single-registrant zones where the gTLD is also a famous, trademarked brand and it would be silly to enforce open access to all accredited registrars.
But the GNSO Council resolved last week that the registrar exception is inconsistent with the GNSO policy that first kicked off the new gTLD program in 2007, which called for non-discriminatory access.
It had been asked specifically by the ICANN board’s New gTLD Program Committee to comment on whether there was a conflict. The Council said:

the language of this recommendation of the final report of the GNSO does not stipulate any exceptions from the requirements to treat registrars in a non-discriminatory fashion and (ii) the GNSO new gTLDs Committee discussed potential exceptions at the time, but did not include them in its recommendations, which is why the lack of an exception cannot be seen as an unintended omission, but a deliberate policy statement

However, the Council also decided that it has no objection to ICANN going ahead with the so-called Specification 13 exceptions, saying it “does not object to the implementation of Specification 13 as a whole”.
No GNSO members bothered to object when Spec 13 was open to public comment.
While it’s certainly a pragmatic, reasonable decision by the GNSO, it does highlight a situation where ICANN seems to have overridden a hard-fought community consensus policy.
That’s likely why its resolution also warns the ICANN board that its decision “may not be taken as a precedent”. Which of course it now is, regardless.