ICANN just came thiiis close to breaking the internet

ICANN has decided to postpone an unprecedented change at the DNS root after discovering it could break internet for potentially millions of users.
The so-called KSK Rollover was due to go ahead on October 11, but it’s now been pushed back to — tentatively — some time in the first quarter 2018.
The delay was decided after ICANN realized that there were still plenty of ISPs and network operators that weren’t ready for the change.
Had ICANN gone ahead anyway with the change anyway, it could have seen subscribers of affected ISPs lose access to millions of DNSSEC-supporting domain names.
So the postponement is a good thing.
A KSK or Key Signing Key is a public-private cryptographic key pair used to sign other keys called Zone Signing Keys. The root KSK signs the root ZSK and is in effect the apex of the DNSSEC hierarchy.
The same KSK has been in operation at the root since 2010, when the root was first signed, but it’s considered good practice to change it every so often to mitigate the risk of brute-force attacks against the public key.
While it’s important enough to get dramatized in US spy shows, in practice it only affects ISPs and domain names that voluntarily support DNSSEC.
ICANN estimates that 750 million people use DNSSEC, which is designed to prevent problems such as man-in-the-middle attacks against domain names.
That’s a hell of a lot of people, but it’s still a minority of the world’s internet-using population. It’s not been revealed how many of those would have been affected by a premature rollover.
When DNSSEC fails, people whose DNS resolvers have DNSSEC turned on (Comcast and Google are two of the largest such providers) can’t access domain names that have DNSSEC turned on (such as domainincite.com).
Preventing the internet breaking is pretty much ICANN’s only job, so it first flagged up its intention to roll the root KSK back in July last year.
In July this year, the new public KSK was uploaded as part of a transition phase that is seeing the 2010 keys and 2017 keys online simultaneously.
Last year, CTO David Conrad told us the long lead time and cautious approach was necessary to get the word out that ISPs needed to test their resolvers to make sure they would work with the new keys.
In June, ICANN CEO Goran Marby spammed the telecommunications regulators in every country in the world with a letter (pdf) asking them to coordinate their home ISPs to be ready for the change.
The organization’s comms teams has also been doing a pretty good job getting word of the rollover into the tech press over the last few months.
But, with a flashback to the new gTLD program, that outreach doesn’t seem to have reached out as far as it needed to.
ICANN said last night that a “significant number” of ISPs are still not ready for the rollover.
It seems ICANN only became aware of this problem due to a new feature of DNS that reports back to the root which keys it is configured to use.
Without being able to collate that data, it’s possible it could have been assumed that the situation was hunky-dory and the rollover might have gone ahead.
ICANN still isn’t sure why so many resolvers are not yet ready for the 2017 KSK. It said in a statement:

There may be multiple reasons why operators do not have the new key installed in their systems: some may not have their resolver software properly configured and a recently discovered issue in one widely used resolver program appears to not be automatically updating the key as it should, for reasons that are still being explored.

It’s not clear why the broken resolver software has not been named — one would assume that getting the word out would be a priority unless issues of responsible disclosure were in play.
ICANN said it is “reaching out to its community, including its Security and Stability Advisory Committee, the Regional Internet Registries, Network Operator Groups and others to help explore and resolve the issues.”
The organization is hopeful that it will be able to go ahead with the rollover in Q1 2018, but noted that would be dependent on “more fully understanding the new information and mitigating as many potential failures as possible.”
While it’s excellent news that ICANN is on top of the situation, the delay is unlikely to do anything to help the perception that DNSSEC is mainly just an administrative ball-ache and far more trouble than it’s worth.

Chalaby named next ICANN chair

Cherine Chalaby is to be the next chair of ICANN.
In a case of burying the lede extreme even by ICANN standards, current chair Steve Crocker announced the news in the 11th paragraph of a blog post entitled “Chairman’s Blog: The Montevideo Workshop Wrap-Up” this evening.
Crocker wrote: “the Board had an opportunity to participate in the discussion of the Board’s future leadership, and have indicated unanimous support for the future election of Cherine Chalaby as the next Chair of the ICANN Board.”
No formal election has happened yet, but the board decided to come to a consensus on which way they will vote anyway.
Chris Disspain has been selected future vice-chair using the same informal process, Crocker wrote.
The actual raising of hands will take place during the board’s Annual General Meeting in Abu Dhabi at ICANN 60 in early November.
Chalaby was born in Egypt, also holds British citizenship, and lives in ICANN’s home town of Los Angeles.
He’s the first ICANN chair to come from the financial services world, having served a career at Accenture before joining Rasmala Investments.
He’s been a member of the ICANN board since the Nominating Committee selected him in December 2010 and was elected vice-chair a few years back.
His stint as chair will not be long. I believe he’s term-limited and will have to step aside at the end of 2019.
Crocker, an early internet pioneer, has been chair since 2011. No doubt ICANN is planning a big send-off for him at ICANN 60.

Millions spent as three more new gTLDs auctioned

Two or three new gTLDs have been sold in a private auction that may well have seen over $20 million spent.
The not-yet-delegated strings .inc, .llc and (I think) .llp hit the block at some point this month.
They are the first new gTLDs to be auctioned since Verisign paid $135 million for .web a little over a year ago.
At this point, nobody wants to talk about which applicant(s) won which of the newly sold strings, but it seems that the proceeds ran into many millions.
MMX, which applied for .inc and .llc, said this morning that it has benefited from a $2.4 million windfall by losing both auctions.
The auctions evidently took place in September, but CEO Toby Hall declined to comment any further, citing non-disclosure agreements.
There were nine remaining applicants for .inc and eight for .llc.
I don’t think it’s possible to work out which sold for how much using just MMX’s disclosure.
But private auctions typically see the winning bid divided equally between the losers.
I believe .llp was probably sold off by auction at the same time.
The reason for this is that .llc, .inc and .llp were contention sets all being held up by one applicant’s dispute with ICANN.
Dot Registry LLC had applied for all three as “community” gTLDs, which meant it had to go through the Community Evaluation Process.
While it failed the CPE on all three counts, the company subsequently filed an Independent Review Process complaint against ICANN, which it won last August.
You may recall that this was the IRP that found disturbing levels of ICANN meddling in the drafting of the CPE panel’s findings.
Ever since then, ICANN has been conducting an internal review, assisted by outside experts, into how the CPE process worked (or didn’t).
Lawyers for Dot Registry and other affected applications (for .music and .gay) have been haranguing ICANN all year to get a move on and resolve the issue.
And yet, just as the end appeared to be in sight, Dot Registry seems to have decided to give up (or, possibly, cash out) and allow the strings to go to auction.
CEO Shaul Jolles declined to comment on the auctions today.
All I can currently tell you is that at least two of the Dot Registry holdout strings have been sold and that MMX did not win either of them.
The applicants for .inc were: Uniregistry, Dot Registry, Afilias, GMO, GTLD Limited, MMX, Nu Dot Co (now a known Verisign front), Donuts and Google.
The applicants for .llc were: MMX, Dot Registry, Nu Dot Co, Donuts, Afilias, Top Level Design, myLLC and Google.

More delay for Amazon as ICANN punts rejected gTLD

Amazon is going to have to wait a bit longer to discover whether its 2012 application for the gTLD .amazon will remain rejected.
ICANN’s board of directors at the weekend discussed whether to revive the application in light of the recent Independent Review Process panel ruling that the bid had been kicked out for no good reason.
Instead of making a firm decision, or punting it to the Government Advisory Committee (as I had predicted), the board instead referred the matter to a subcommittee for further thought.
The newly constituted Board Accountability Mechanisms Committee, which has taken over key functions of the Board Governance Committee, has been asked to:

review and consider the Panel’s recommendation that the Board “promptly re-evaluate Amazon’s applications” and “make an objective and independent judgment regarding whether there are, in fact, well-founded, merits-based public policy reasons for denying Amazon’s applications,” and to provide options for the Board to consider in addressing the Panel’s recommendation.

The notion of a “prompt” resolution appears to be subjective, but Amazon might not have much longer to wait for a firmer decision.
While the BAMC’s charter requires it to have meetings at least quarterly, if it follows the practice of its predecessor they will be far more frequent.
It’s possible Amazon could get an answer by the time of the public meeting in Abu Dhabi at the end of next month.
ICANN’s board did also resolve to immediately pay Amazon the $163,045.51 in fees the IRP panel said was owed.
The .amazon gTLD application, along with its Chinese and Japanese versions, was rejected by ICANN a few years ago purely on the basis of consensus GAC advice, led by the geographic name collisions concerns of Peru and Brazil.
However, the IRP panel found that the GAC advice appeared to based on not a great deal more than whim, and that the ICANN board should have at least checked whether there was a sound rationale to reject the bids before doing so.

L’Oreal is using “closed generic” .makeup in an interesting way

What do you call a registry that defensively registers names on behalf of the very people that would be its most likely customers if the TLD weren’t so hideously overpriced?
L’Oreal, apparently.
About half of its .makeup new gTLD comprises the names or nicknames of social media “influencers” in the make-up scene, and they all seem to belong to the registry.
Ironically, these are precisely the kind of people you’d expect to actually go out and register .makeup domains, if they didn’t cost close to $7,000 a pop.
L’Oreal put a $5,500 wholesale price-tag on .makeup domains, evidently as a Plan B to avoid actually having to sell names to people, after its original plan to keep the string as a “closed generic” failed due to ICANN politicking.
As you might expect, uptake has been minimal. The zone file currently has about 266 domains in it.
Beyond L’Oreal itself, there are defensive registrations by companies not remotely related to the make-up industry, such as BMW and Intuit, and registrations by competing companies in the cosmetics industry, such as Christian Dior and Estee Lauder.
But there are also something like 150 .makeup domains that were all registered at the same time, this April, representing the names and social media handles of young women who post YouTube videos about makeup for their often thousands of subscribers.
It turns out these women are all participants (willing, it seems) in WeLove.Makeup, a web site created by L’Oreal to promote its products.
The site is basically a social media aggregator. Each “influencer” has their own page, populated by their posts from YouTube, Instagram, Twitter, and such. It’s maintained by Findie, which specializes in that kind of thing.
The domains matching the participants names do not resolve to the site, however. They’re all registered to L’Oreal’s registry management partner Fairwinds and resolve to ad-free registrar parking pages.
The names were registered via 101Domain, which prices .makeup names at $6,999, but I’ve no idea what payment arrangement Fairwinds/L’Oreal has for this kind of thing.
This is what a wannabe closed generic can look like, it seems — the registry pricing its customers out of the market then registering their names on their behalf anyway.
Is this “innovation”?

Will ICANN punt on .amazon again?

Amazon is piling pressure onto ICANN to finally approve its five-year-old gTLD applications for .amazon, but it seems to me the e-commerce giant will have a while to wait yet.
The company sent a letter to ICANN leadership this week calling on it to act quickly on the July ruling of an Independent Review Process panel that found ICANN had breached its own bylaws when it rejected the .amazon and and Chinese and Japanese transliterations.
Amazon’s letter said:

Such action is necessary because there is no sovereign right under international or national law to the name “Amazon,” because there are no well-founded and substantiated public policy reasons to block our Applications, because we are committed to using the TLDs in a respectful manner, and because the Board should respect the IRP accountability mechanism.

ICANN had denied the three applications based on nothing more than the consensus advice of its Governmental Advisory Committee, which had been swayed by the arguments of primarily Brazil and Peru that there were public policy reasons to keep the gTLD available for possible future use by its own peoples.
The string “Amazon”, among its many uses, is of course the name of a river and a rain forest that covers much of the South American continent.
But the IRP panel decided that the ICANN board should have at least required the GAC to explain its public policy arguments, rather than just accepting its advice as a mandate from on-high.
Global Domains Division chief Akram Atallah had testified before the panel that consensus GAC advice sets a bar “too high for the Board to say no.”
But the governmental objections “do not appear to be based on well-founded public policy concerns that justify the denial of the applications” the IRP panelists wrote.
The panel, in a 2-to-1 ruling, instructed ICANN to reopen Amazon’s applications.
Since the July ruling, ICANN’s board has not discussed how to proceed, but it seems likely that the matter will come up at its Montevideo, Uruguay retreat later this month.
No agenda for this meeting has yet been published, but there will be an unprecedented public webcast of the full formal board meeting, September 23.
The Amazon letter specifically asks the ICANN board of directors to not refer the .amazon matter back to the GAC for further advice, but I think that’s probably the most likely outcome.
I say this largely because while ICANN’s bylaws specifically allow it to reject GAC advice, it has cravenly avoided such a confrontation for most of its history.
It has on occasion even willfully misinterpreted GAC advice in order to appear that it has accepted it when it has not.
The GAC, compliantly, regularly provides pieces of advice that its leaders have acknowledged are deliberately vague and open to interpretation (for a reason best known to the politicians themselves).
It seems to me the most likely next step in the .amazon case is for the board to ask the GAC to reaffirm or reconsider its objection, giving the committee the chance to save face — and avoid a lengthy mediation process — by providing the board with something less than a consensus objection.
If ICANN were to do this, my feeling is that the GAC at large would probably be minded to stick to its guns.
But it only takes one government to voice opposition to advice for it to lose its “consensus” status, making it politically much easier for ICANN to ignore.
Hypothetically, the US government could return to its somewhat protectionist pre-2014 position of blocking consensus on .amazon, but that might risk fanning the flames of anti-US sentiment.
While the US no longer has its unique role in overseeing ICANN’s IANA function, it still acts as the jurisdictional overlord for the legal organization, which some other governments still hate.
A less confrontational approach might be to abstain and to allow friendly third-party governments to roadblock consensus, perhaps by emphasizing the importance of ICANN being seen to accountable in the post-transition world.
Anyway, this is just my gut premonition on how this could play out, based on the track records of ICANN and the GAC.
If ICANN can be relied on for anything, it’s to never make a decision on something today if it can be put off until tomorrow.

Pilot program for Whois killer launches

ICANN is to oversee a set of pilot programs for RDAP, the protocol expected to eventually replace Whois.
Registration Data Access Protocol, an IETF standard since 2015, fills the same function as Whois, but it is more structured and enables access control rules.
ICANN said this week that it has launched the pilot in response to a request last month from the Registries Stakeholder Group and Registrars Stakeholder Group. It said on its web site:

The goal of this pilot program is to develop a baseline profile (or profiles) to guide implementation, establish an implementation target date, and develop a plan for the implementation of a production RDAP service.

Participation will be voluntary by registries and registrars. It appears that ICANN is merely coordinating the program, which will see registrars and registrars offer their own individual pilots.
So far, no registries or registrars have notified ICANN of their own pilots, but the program is just a few days old.
It is expected that the pilots will allow registrars and registries to experiment with different types of profiles (how the data is presented) and extensions before ICANN settles on a standard, contractually enforced format.
Under RDAP, ICANN/IANA acts as a “bootstrapping” service, maintaining a list of RDAP servers and making it easier to discover which entity is authoritative for which domain name.
RDAP is basically Whois, but it’s based on HTTP/S and JSON, making it easier to for software to parse and easier to compare records between TLDs and registrars.
It also allows non-Latin scripts to be more easily used, allowing internationalized registration data.
Perhaps most controversially, it is also expected to allow differentiated access control.
This means in future, depending on what policies the ICANN community puts in place, millions of current Whois users could find themselves with access to fewer data elements than they do today.
The ICANN pilot will run until July 31, 2018.

Deutsch and Doria to join ICANN board

Veteran ICANN community members Avri Doria and Sarah Deutsch are to join ICANN’s board of directors in November.
Both have been selected by ICANN’s Nominating Committee to serve three-year terms starting at the end of the public meeting in Abu Dhabi, which wraps up November 3.
They replace current chair Steve Crocker, who is leaving after his maximum three terms on the board, and Asha Hemrajani, who is leaving after one term. Both take seats reserved for North Americans.
Doria, an independent consultant, is a 12-year member of the community and tireless working group volunteer, most closely associated with the Non-Commercial Users Constituency. Her clients include Public Interest Registry.
Deutsch is an intellectual property attorney perhaps best known as a 23-year employee of Verizon. She currently works at Mayer Brown in Washington DC.
Both new directors have been knocking about ICANN for ages in various leadership positions.
This contrasts with previous years, in which NomCom has gone outside of the community for board expertise.
NomCom also selected new members of the ccNSO, GNSO and ALAC, listed here.

After slow launch, .africa looks to add hundreds of resellers

ZA Central Registry is opening up .africa and its South African city gTLDs to potentially hundreds of new registrars via a new proxy program.
The company today announced that its new registrar AF Proxy Services has received ICANN accreditation, which should open up .africa, .joburg, .capetown and .durban to its existing .za channel.
ZACR is the ccTLD registry for South Africa and as such it already has almost 500 partners accredited to sell .za names. But most of these resellers are not also ICANN accredited, so they cannot sell gTLD domains.
The AF Proxy service is intended to give these existing resellers the ability to sell ZACR’s four gTLDs without having to seek out an ICANN accreditation themselves.
“Effectively, all users of the AF Proxy service become resellers of the Proxy Registrar which is an elegant technical solution aimed at boosting new gTLD domain name registrations,” ZACR CEO Lucky Masilela said in a press release.
While reseller networks are of course a staple of the industry and registries acting as retail registrars is fairly common nowadays, this new ZACR business model is unusual.
According to ZACR’s web site, it has 489 accredited .za registrars active today, with 52 more in testing and a whopping 792 more in the application process.
Depending on uptake of the proxy service, that could bring the number of potential .africa resellers to over 1,300.
And they’re probably needed.
The .africa gTLD went into general availability in July — after five years of expensive legal and quasi-legal challenges from rival applicant DotConnectAfrica — but has so far managed to put just 8,600 names in its zone file.
That’s no doubt disappointing for TLD serving a population of 1.2 billion and which had been expected to see substantial domain investor activity from overseas, particularly China.

No $17 million rebate for struggling new gTLDs

ICANN has turned down a request for about $17 million to be refunded to under-performing new gTLD registries.
The organization cannot spare the cash from its $96 million new gTLD program war chest because it does not yet know how much it will need to spend in future, Global Domains Division president Akram Atallah told registries this week.
The Registries Stakeholder Group made the request for fee relief back in March, arguing that the $25,000 per-TLD fixed annual fee each registry must pay amounts to an unfair “burden” that has “hampered their success and put them at a competitive disadvantage”.
The RySG proposed that this $6,250 per quarter fee should be reduced by $4,687.50 per quarter for a year, a 75% reduction, at a cost to ICANN of $16.87 million.
The money, they said, should be drawn from the $96.1 million in new gTLD application fees that were still unspent at the time.
The new gTLD program charged each applicant $185,000 per application. About third of the fee was to cover unforeseen events, and is often sniggeringly referred to as its legal defense fund.
Because the program was meant to work only on a cost-recovery basis, there are question marks hanging over what ICANN should ultimately do with whatever cash is left over.
(It should be noted that this cash is separate from and does not include the quarter-billion dollars ICANN has squirreled away from its new gTLD last-resort auctions).
Now that the vast majority of the 2012 round’s 1,930 applications have been fully processed, it must have seemed like a good time for the RySG to ask for some cashback, but ICANN has declined.
Atallah said in a August 29 letter (pdf) to the group that ICANN has had to spent lots of its program reserve on unanticipated projects such as name collisions, universal acceptance, the EBERO program and the Trademark Clearinghouse. He wrote:

We do not yet know how much of the New gTLD Program remaining funds will be required to address future unanticipated expenses, and by when. As such, at this time, ICANN is not in a position to commit to the dispensation of any potential remaining funds from the New gTLD Program applications fees.

It seems for now the hundreds of new gTLDs with far fewer than 10,000 registrations in their zones are going to keep having to fork over $25,000 a year for the privilege.