Ombudsman steps in after harassment claims in Whois group

ICANN Ombudsman Herb Waye has started monitoring an ICANN mailing list after multiple complaints of disrespectful behavior.
Waye this week told participants in the Registration Data Services working group that he is to trawl through their list archives and proactively monitor the group following “multiple complaints regarding behavior that contravenes the ICANN Expected Standards of Behavior and possibly the Community Anti-Harassment Policy”.
The RDS working group is exploring the possibility of replacing the current Whois system, in which all data is completely open, with something “gated”, restricting access to authenticated individuals based on their role.
Law enforcement agencies, for example, may be able to get a greater level of access to personal contact information than schmucks like me and you.
Privacy advocates are in favor of giving registrants more control over their data, while anti-abuse researchers hate anything that will limit their ability to stop spam, phishing and the like.
It’s controversial stuff, and arguments on the RDS WG list have been been very heated recently, sometimes spilling over into ad hominem attacks.
The Expected Standards of Behavior requires all ICANN community members to treat each other with civility.
I haven’t seen anything especially egregious, but apparently the disrespect on display has been sufficiently upsetting that the Ombudsman has had to step in.
It’s the first time, that I’m aware of, that the ICANN Ombudsman has proactively monitored a list rather than simply responding to complaints.
Waye said that he plans to deliver his verdict before ICANN 59, which kicks off in a little over a week.

US “threatens” Costa Rica over Pirate Bay domains

The US government has been threatening to “close down” Costa Rica’s .cr registry over its refusal to take down a Pirate Bay domain name, according to the registry.
Representatives of the US embassy in Costa Rica have been badgering NIC.cr to take down thepiratebay.cr since 2015, according to a letter from Pedro León Azofeifa, president of Academia Nacional de Ciencias, which runs the registry.
The letter claims:

These interactions with the United States Embassy have escalated with time and include great pressure since 2016 that is exemplified by several phone calls, emails and meetings urging our ccTLD to take down the domain, even though this would go against our domain name policies

According to the letter, a US official “has mentioned threats to close our registry, with repeated harassment regarding our practices and operation policies and even personal negative comments directed to our Executive Director”.
The letter was sent to the chair of ICANN’s Governmental Advisory Committee 10 days ago, CC’d to senior ICANN, Costa Rican and US governmental figures, and has been circulated this week in the Latin American domain name community.
The form of the alleged threats to close the registry is not clear, but it should be noted that prior to October 1 last year the US Department of Commerce, via its now-relinquished oversight of ICANN, played a key role in the administration of the DNS root zone.
The Pirate Bay is of course a popular directory of BitTorrent links largely used to disseminate pirated copies of movies and music, much of it American-made.
The site has been TLD-hopping for years, as registries around the world shut down its domains for violations of their own local rules. It has been live on thepiratebay.cr since December 2014, when its Swedish operation was shut down by authorities.
The NIC.cr letter says that its own policies follow international “best practices” and allow it to take down domains when presented with a Costa Rican court order, but that “the pressure and harassment [from the US] to take down the domain name without its proper process and local court order persists”.
The US Department of Commerce even pressured its Costa Rican counterpart to investigate NIC.cr, but that probe concluded that the registry was acting within its procedures, according to the letter.
It’s not the first attempt to get rid of the Pirate Bay this year.
Public Interest Registry in February announced a “UDRP for copyright” proposal that would allow copyright holders to have piracy disputes heard by independent arbitrators. It looked like a way to get unloved thepiratebay.org domain taken down without PIR having to take unilateral action.
That proposal was shelved after an outcry from the industry and civil rights watchdogs.
In April, one of the Pirate Bay’s founders launched a piracy-friendly domain registration service.
Just this week, the European Court of Justice ruled, after seven years of legal fights, that the Pirate Bay infringes copyright, raising the possibility of the site being blocked in more European countries.
The NIC.cr letter is dated June 6. It has not yet been published by ICANN or the GAC.

Bladel quits as Council chair as GoDaddy ruled “ineligible” for election

GNSO Council Chair James Bladel has resigned, after it emerged that GoDaddy, his employer, is not eligible for office under registrar rules.
He will continue to occupy the post on an interim basis until a new election is held.
Bladel was elected to represent the Registrars Stakeholder Group on the Council back in 2013 and was elected by the Council as chair in late 2015.
However, the RrSG has just discovered that he’s actually ineligible for elected office under its charter because GoDaddy is also a dot-brand registry.
The RrSG charter states that in order to avoid conflicts of interest, a registrar that also has a Specification 9 exemption from the registry Code of Conduct in an ICANN registry conduct may not hold office.
GoDaddy signed its .godaddy registry agreement, which includes the Spec 9 exemption, in July 2015. The gTLD is not currently being used.
GoDaddy is of course the largest registrar in the industry, but it appears its ability to wield power in ICANN’s policy-making bodies now appears to be hamstrung by its foray into new gTLDs.
Bladel’s resignation is not expected to have any significant impact on GNSO Council work.
He’s been reappointed by the RrSG executive committee on an interim basis until elections can be held for a replacement. His term is due to expire in November anyway.

Should ICANN get breastfeeding areas? Have your say!

ICANN has launched a survey of community members’ views on gender, apparently trying to figure out whether it has a sexism problem.
The short, anonymous quiz, published today, asks a bunch of reasonable questions about gender diversity at ICANN’s physical meetings and online interactions.
The organization wants to know if you think your gender has had any influence on your participation at ICANN, and whether you think it could in your future in the community.
It wants to know if you think ICANN is too male-dominated, whether gender is a barrier to progression, and whether you feel represented by current leadership.
The survey also throws up a few questions I found a little surprising.
Should ICANN be holding “educational” sessions on gender diversity? Should it have “mandatory” diversity “quotas”? Should its meetings have breastfeeding areas? Would people who don’t identify as either gender have difficulty ascending to leadership positions?
Founded in 1998, ICANN is the organization tasked with coordinating certain of the internet’s unique technical identifiers.

DENIC gets approved for registry escrow

DENIC is now able to offer data escrow services to gTLD registries, in addition to registrars.
The non-profit company, which runs Germany’s .de, said it gained ICANN approval for the registry escrow function June 6.
Back in March, ICANN approved it for the registrar escrow services.
All ICANN-accredited registries and registrars are contractually obliged to deposit their registrant data with escrow agents in case they go out of business, go rogue, suffer catastrophic data loss, or otherwise screw up.
Nine companies have been approved by ICANN for registry data escrow so far.
Two of others are based in Europe, but DENIC claims to be the only one that offers full compliance with the more stringent German and European Union data protection regulations.

ICANN scraps remote meeting hubs

ICANN is doing away with remote participation hubs for its thrice-yearly public meetings.
The organization said yesterday that the hubs were barely used and often hit technical barriers.
For avoidance of doubt, we’re not talking about remote participation here, we’re just talking about the “hubs” that various community members would set up in their home nations for locals who for whatever reason could not attend meetings in person.
Basically, they were a bunch of guys in a room somewhere in the southern hemisphere, watching the live meeting video stream and occasionally streaming their own wonky video and crackly audio into the primary meeting location in order to say, ask a question.
The first ones I’m aware of were in 2010 for the Nairobi meeting, when some Europeans and North Americans didn’t want to travel due to terrorism concerns, but ICANN formally started financially supporting them a couple years ago.
Two of the meetings since then did not have hubs. The mid-year Policy Forum in Helsinki didn’t have one last year, and the Hyderabad meeting couldn’t have them due to the ship fire that destroyed ICANN kit.
In January this year, ICANN said it would only pay for remote participation if the remote hubs could rustle up more than 25 participants each. There were also technical requirements that had to be met.
That seems to have been a tall order, so it looks like Copenhagen will be the last meeting ICANN will pay for these hubs.
There’s nothing stopping bunches of guys gathering together around Adobe Connect screens and participating that way, of course.

ICANN finds no conflict of interest in .sport decision

ICANN has rejected claims that the .sport gTLD contention set was settled by an arbitrator who had undisclosed conflicts of interest with the winning applicant.
Its Board Governance Committee last week decided that Community Objection arbitrator Guido Tawil had no duty to disclose his law firm’s ties to major sports broadcasters when he effectively eliminated Famous Four Media from its fight with SportAccord.
Back in 2013, SportAccord — an applicant backed by pretty much all of the world’s major sporting organizations — won the objection when Tawil ruled that FFM’s fully commercial, open-registration bid could harms its members interests.
FFM complained with Requests for Reconsideration, Ombudsman complaints and then an Independent Review Process complaint.
It discovered, among other things, that Tawil’s law firm was helping broadcaster DirecTV negotiate with the International Olympic Committee (one of SportAccord’s backers) for Olympics broadcasting rights at the time of the Community Objection.
The IRP panel ruled in February this year that the BGC had failed to take FFM’s allegations of Tawil’s “apparent bias” into account when it processed Reconsideration requests back in 2013 and 2014.
So the BGC reopened the two Reconsideration decisions, looking at whether Tawil was required by International Bar Association guidelines to disclosed his firm’s client’s interests.
In a single decision (pdf) late last week, the BGC said that he was not required to make these disclosures.
In each of the three claims of bias, the BGC found that the connections between Tawil and the alleged conflict were too tenuous to have required disclosure under the IBA rules.
It found that the IOC and SportAccord are not “affiliates” under the IBA definition, which requires some kind of cross-ownership interests, even though the IOC is, judging by the .sport application, SportAccord’s most valued supporter.
The BGC also found that because Tawil’s firm was representing DirecTV, rather than the IOC, the relationship did not technically fall within the disclosure guidelines.
For these and other reasons, the BGC rejected FFM’s Reconsideration requests for a second time.
The decision, and the fact that FFM seems to have exhausted ICANN’s appeals mechanisms, means it is now more likely that SportAccord’s application will be allowed to continue negotiating its .sport Registry Agreement with ICANN, where it has been frozen for years.

.music and .gay CPE probe could end this month

An ICANN-commissioned investigation into the fairness of its Community Priority Evaluation process for new gTLDs could wind up before the end of June.
In an update Friday, ICANN also finally revealed who is actually conducting the probe, which has been slammed by affected applicants for being secretive.
A tentative timeline sketched out in the update means applicants for gTLDs including .gay and .music could find their applications closer to release from limbo in just a few weeks.
ICANN revealed that FTI Consulting’s Global Risk and Investigations Practice and Technology Practice have been looking into claims ICANN staff meddled in the Economist Intelligence Unit’s supposedly independent CPE reviews for the last several months.
FTI is reviewing how ICANN staff interacted with the EIU during the CPE processes, how the EIU conducted its research and whether the EIU applied the CPE criteria uniformly across different gTLDs.
ICANN said that FTI finished collected material from ICANN in March and hopes to have all the information it has asked the EIU for by the end of this week.
It could deliver its findings to ICANN two weeks after that, ICANN said.
Presumably, there would be little to prevent ICANN publishing these findings very shortly thereafter.
ICANN has been harangued by some of the applicants for .music, .gay, hotel, .cpa, .llc, .inc, .llp and .merck, all of which have been affected by controversial CPE decisions and have been delayed by the investigation, for months.

Time to show ICANN who’s boss!

You are in charge of ICANN.
That statement may sound trite — it is trite — but it’s always been true to some extent.
Even if their individual voices are often lost, members of the ICANN community have always had the ability to influence policy, whether through sporadic responses to public comment periods or long term, soul-crushing working group volunteer work.
ICANN only really has power through community consent.
That’s another trite statement, but one which became more true on October 1 last year, when ICANN separated itself from US government oversight and implemented a new set of community-created bylaws.
The new bylaws created a new entity, the “Empowered Community”, which essentially replaced the USG and is able to wield more power than the ICANN board of directors itself.
Indeed, the Empowered Community can fire the entire board if it so chooses; a nuclear option for the exercise of community control that never existed before.
And the EC is, at the ICANN 59 public meeting in Johannesburg at the end of the month, about to get its first formal outing.
What the EC will discuss is pretty dull stuff. That’s why I had to trick you into reading this post with an outrageous, shameless, sensationalist headline.
Before getting into the substance of the Johannesburg meeting, I’m going to first bore you further for several paragraphs by attempting to answering the question: “What exactly is the Empowered Community?”
The EC exists an an “unincorporated association” under California law, ICANN deputy general counsel Sam Eisner told me.
It doesn’t have shareholders, directors, staff, offices… you wouldn’t find it by searching California state records. But it would have legal standing to take ICANN to court, should the need arise.
It was basically created by the new ICANN bylaws.
It comprises the five major constituencies of ICANN — the Generic Names Supporting Organization, the Country Code Names Supporting Organization, the Governmental Advisory Committee, the At-Large Advisory Committee and the Address Supporting Organization.
They’re called “Decisional Participants” and each is represented on a committee called the EC Administration by a single representative.
Right now, each group is represented on the Administration by its respective chair — GNSO Council chair James Bladel of GoDaddy represents the GNSO currently, for example — but I gather that doesn’t necessarily have to be the case; each group can decide how it appoints its rep.
Bladel tells me that each representative only takes action or casts a vote after being told to do so by their respective communities. As individuals, their power is extremely limited.
When the EC makes decisions, there must always be at least three votes in favor of the decision and no more than one vote against. A 3-1 vote would count as approval, a 3-2 vote would not.
This is to make sure that there is a fairly high degree of consensus among stakeholders while also preventing one community stonewalling the rest for strategic purposes.
The EC’s nine powers are enumerated in article 6.2 of the ICANN bylaws.
It can hire and fire an unlimited number of directors, reject the ICANN budget, file Requests for Reconsideration or Independent Review Process appeals, sue ICANN, and oversee changes to the ICANN bylaws.
Most of these powers are reactive — that is, if the ICANN board did something terrible the EC would have to consciously decide to act upon it in some way.
But one of them — approval of changes to Fundamental Bylaws — places the EC squarely in the legislative pathway. Think of it like the Queen of England’s Royal Assent or the US president’s ability to veto bills before they become law.
That’s the role the EC will adopt in Joburg this month.
The ICANN board recently passed a resolution calling for a new board committee to be created to focus on handling accountability mechanisms such as Reconsideration, removing the function from the overworked Board Governance Committee.
Because this requires a change to a Fundamental Bylaw — those bylaws considered so important they need more checks and balances — the EC has been called upon to give it the community’s formal consent.
To the best of my knowledge, the bylaws amendment is utterly uncontroversial. I haven’t heard of any objections or complaints about what essentially seems to be a probably beneficial tweak in how ICANN’s board functions.
But it will be the EC’s first formal exercise of executive power.
So there will be a session at ICANN 59 in which the EC convenes to discuss the board’s resolution and, probably, hear any input it has not already heard.
The exact format of the session seems to be up in the air at the moment, but I gather an open-mic “public forum” style meeting of about an hour is the most likely choice. It will of course be webcast, with remote participation, as almost all ICANN public meetings are.
No votes will be cast at the session — I’m told the bylaws actually forbid it — but the EC will have only 21 days afterwards to poll their communities and formally deliver their verdict. Assuming at least three of the communities consent to the board resolution and no more than one objects, it will automatically become ICANN law.
The next test of the EC, which would prove to be actually newsworthy enough to write about without a clickbait headline, may well be the ICANN budget. ICANN’s financial year ends at the end of June, and the EC has explicit powers to reject it.
The budget often raises concerns from those parties who actually pay into it, and given the difficulties the industry is in right now there may be more concerns than usual.
Anyway, this is the way ICANN works nowadays. It would make for more interesting reading if a triumvirate of Iran, China and Russia now ran the show, but they don’t. You lot do.
Just be glad Donald Trump isn’t holding the reins.
Sorry, that was also trite, wasn’t it.

Emoji domains get a 👎 from security panel

The use of emojis in domain names has been discouraged by ICANN’s Security and Stability Advisory Committee.
In a paper late last week, SSAC told ICANN that emojis — aka emoticons or smileys — lack standardization, are barred by the relevant domain name technical standards, and could cause user confusion.
Emoji domains, while technically possible, are not particularly prevalent on the internet right now.
They’re implicitly banned in gTLDs due to the contractual requirement to adhere to the IDNA2008 standard, which restricts internationalized domain names to actual spoken human languages, and the only ccTLD I’m aware of actively marketing the names is Samoa’s .ws.
There was a notable example of Coca Cola registering 😀.ws (xn--h28h.ws) for a billboard marketing campaign in Puerto Rico a couple of years ago, but that name has since expired and been registered by an Australian photographer.
The SSAC said that emoji use should be banned in TLDs and discouraged at the second level for several reasons.
Mainly, the problem is that while emojis are described in the Unicode standards, there’s no standardization across devices and applications as to how they are displayed.
A certain degree of creative flair is permitted, meaning a smiling face in one app may look unlike the technically same emoji in another app. On smaller screens and with smaller fonts, technically different emojis may look alike.
This could lead to confusion, which could lead to security problems, SSAC warns:

It is generally difficult for people to figure out how to specify exactly what happy face they are trying to produce, and different systems represent the same emoji with different code points. The shape and color of emoji can change while a user is viewing them, and the user has no way of knowing whether what they are seeing is what the sender intended. As a result, the user is less likely to reach the intended resource and may instead be tricked by a phishing site or other intentional misrepresentation.

SSAC added that it:

strongly discourages the registration of any domain name that includes emoji in any of its labels. The SSAC also advises registrants of domain names with emoji that such domains may not function consistently or may not be universally accessible as expected

The brief paper can be read here (pdf).