GNSO faces off with governments over IGO cybersquatting

A defiant ICANN working group looking at cybersquatting rules for intergovernmental organizations is sticking to its guns in an ongoing face-off with the Governmental Advisory Committee.
In a report published for public comment this week, the GNSO working group recommended that IGOs should be given the right to use the UDRP and URS rights protection mechanisms, despite not being trademark owners.
But the recommendations conflict with the advice of the GAC, which wants ICANN to create entirely new mechanisms to deal with IGO rights.
I explored a lot of the back story of this argument in two posts a few months ago, which I will not rehash here.
The latest development is the publication of the proposed initial report of the GNSO IGO-INGO Access to Curative Rights Protection Mechanisms Initial Report (pdf) for comment.
The WG was tasked with deciding whether changes should be made to UDRP and URS to help protect the names and acronyms of IGOs and INGOs (international non-governmental organizations).
For INGOs, including the special cases of the International Olympic Committee and the Red Cross/Red Crescent, it decided no changes and no new mechanisms are required, concluding:

Many INGOs already have, and do, enforce their trademark rights. There is no perceivable barrier to other INGOs obtaining trademark rights in their names and/or acronyms and subsequently utilizing those rights as the basis for standing in the existing dispute resolution procedures (DRPs) created and offered by ICANN as a faster and lower cost alternative to litigation. For UDRP and URS purposes they have the same standing as any other private party.

The case with IGOs is different, because using UDRP and URS requires complainants to agree that the panel’s decisions can be challenge in court, and IGOs by their nature have a special legal status that allows them to claim jurisdictional immunity.
The WG recommends that these groups should be allowed access to UDRP and URS if they have protection under Article 6ter of the Paris Convention, a longstanding international intellectual property treaty.
This rule would actually extend UDRP and URS to hundreds more IGO names and acronyms than the GAC has requested protection for, which is just a few hundred. WIPO’s 6ter database by contrast currently lists 925 names and 399 abbreviations.
To deal with the jurisdictional immunity problem, the WG report recommends that IGOs should be allowed to file cybersquatting complaints via a third-party “assignee, agent or licensee”.
It further recommends that if an IGO manages to persuade a court it has special jurisdictional immunity, having been sued by a UDRP-losing registrant, that the UDRP decision be either disregarded or sent back to the arbitration for another decision.
The recommendations with regard IGOs are in conflict with the recommendations (pdf) of the so-called “small group” — a collection of governments, IGOs, INGOs and ICANN directors that worked quietly and controversially in parallel with the WG to come up with alternative solutions.
The small group wants ICANN to create separate but “functionally equivalent” copies of the UDRP and URS to deal with cybersquatting on IGO name and acronyms.
These copied processes would be free for IGOs to use and, to account for the immunity issue, would not be founded in trademark law.
The WG recommendations are now open for public comment and are expected to be the subject of some debate at the March ICANN meeting in Copenhagen.

ICANN joins anti-phishing group board

ICANN’s VP of security has joined the board of directors of the Anti-Phishing Working Group.
Dave Piscitello is one of three new APWG board members, arriving as the group expands its board from two people to five.
APWG said the expansion “is recognition of the growing complexity and scale of Internet crime today and the challenges in responding to this global threat.”
In a press release, it noted that targeted phishing attacks are said to be the root cause of the data thefts that may or may not have influenced the US presidential election last year.
The other two new directors are Brad Wardman of PayPal and Pat Cain of The Cooper Cain Group, a security consulting firm (a different bloke to the similarly named Pat Kane of Verisign).
APWG is an independent, public-private coalition that collects and publishes data about phishing attack trends and advice for how to defend against them.
Part of this work entails tracking how many domain names are involved in phishing, and in which TLDs.
The APWG board also includes chair David Jevans of Proofpoint and secretary-general Peter Cassidy.

Trump nominee open to retaking ICANN oversight role

The incoming head of the US Department of Commerce has indicated that it is unlikely he’ll try to reestablish the US government’s unique oversight of ICANN, at least in the short term.
But at his confirmation hearing in Congress yesterday, Trump nominee for secretary of commerce Wilbur Ross said he’d be open to ideas about how the US could increase its power over ICANN.
He was responding to a question from Ted Cruz, the Texas senator who made halting the IANA transition one of his key concerns last year.
Cruz, framing the question in such a way as to suggest ICANN is now in the hands of an intergovernmental consortium (which it is not) asked Ross whether he was committed to preventing censorious regimes using ICANN to hinder Americans’ freedom of speech.

Ross replied:

As such a big market and really as the inventors of the Internet, I’m a little surprised that we seem to be essentially voiceless in the governance of that activity. That strikes me as an intellectually incorrect solution. But I’m not aware of what it is that we actually can do right now to deal with that. If it exists, if some realistic alternative comes up, I’d be very interested.

His response also mischaracterizes the power balance post-transition.
The US is not “essentially voiceless”. Rather, it has the same voice as every other government as a member of the Governmental Advisory Committee.
Its role is arguably still a lot more powerful than other nations, given that ICANN is now bylaws-bound to remain headquartered in California and under US jurisdiction.
As head of Commerce, Ross will have authority over the National Telecommunications and Information Administration, the agency most directly responsible for dealing with ICANN and domain name issues in general.
NTIA itself will to the best of my knowledge still be headed by assistant secretary Larry Strickling, who handled the IANA transition from the US government side. (UPDATE: this may not be correct)
Ross, 79, is a billionaire investor who made most of his estimated $2.5 billion fortune restructuring bankrupt companies in the coal and steel industries.

DCA files for ANOTHER .africa injunction

DotConnectAfrica is continuing its legal attempt to prevent the .africa gTLD from being delegated to a competitor supported by African governments.
The recalcitrant applicant has filed for another temporary restraining order and preliminary injunction that would prevent ICANN handing .africa to the successful applicant, ZA Central Registry, according to ZACR.
DCA’s last application for an injunction was refused by a California judge in December, but last week it renewed its efforts to stymie the long-delayed geo.
ZACR said on its web site yesterday:

On January 4, 2017, DCA filed an ex parte (emergency) temporary restraining order (“TRO”) asking the Court to prevent ICANN from delegating .Africa to ZACR. The Court denied DCA’s ex parte request for a TRO on the grounds that there was no exigency that required an immediate ruling. The Court further clarified that the prior order denying DCA’s preliminary injunction motion was based upon all arguments submitted by ICANN and DCA (thereby rejecting DCA’s contention in its ex parte papers that the ruling did not include ZACR’s arguments). However, the Court agreed to consider DCA’s new arguments as grounds for a new motion for a preliminary injunction. DCA was given until January 6, 2017 to file its motion. ICANN and ZACR shall file opposition papers by January 18, 2017. DCA will then be given an opportunity to file a reply.

The court is scheduled to hear arguments for and against the injunction January 31, ZACR said.
In the meantime, .africa remains in limbo.

ICANN retires Affirmation of Commitments with US gov

ICANN has terminated its last formal oversight link with the US government.
Late last week, ICANN chair Steve Crocker and Larry Strickling, assistant secretary at the US National Telecommunications and Information Administration mutually agreed to retire the seven-year-old Affirmation of Commitments.
The AoC, negotiated during the tail end of Paul Twomey’s leadership of ICANN and signed by successor Rod Beckstrom, laid out ICANN’s responsibilities to the US government and, to a lesser extent, vice versa.
It included, for example, ICANN’s commitments to openness and transparency, its promise to remain headquartered in California, and its agreement to ongoing reviews of the impact of its actions.
Ongoing projects such as the Competition and Consumer Trust Review originate in the AoC.
The rationale for concluding the deal now is that most of significant provisions of the AoC have been grandfathered into ICANN’s revised bylaws and other foundational documents following the IANA transition, which concluded in October.
Reviews such as the CCT and the lock on its California HQ are now in the bylaws and elsewhere, ICANN said in a blog post.
It’s worth mentioning that the US gets a new administration led by Donald Trump in a little over a week, so it probably made sense to get the AoC out of the way now, lest the new president do something insane with it.
The letters from Crocker and Strickling terminating the deal can be read together here (pdf).

Termination on the .orientexpress

The dot-brand .orientexpress has derailed. That’s a train pun, expect more.
The gTLD operator has become the latest to signal (like a railway signal) to ICANN that it no longer wishes to run its dot-brand, this week asking for a contract cancellation (like a train cancellation).
Despite having left the station (like a train station) in February 2015, it only ever registered its mandatory nic.orientexpress domain, and that doesn’t even resolve any more, according to DI PRO tracking (like a train track).
While the Orient Express brand is familiar to many due to the famous Agatha Christie murder mystery novel, it’s been applied to multiple train companies and journeys over the years.
The gTLD was originally applied for, unopposed, in 2012 by Orient-Express Hotels. However, that company renamed itself to Belmond in 2014.
Belmond still runs a luxury train route bearing the Orient Express name, but apparently its devotion to the brand has run out of steam (like a steam train) and its gTLD was no longer just the ticket (like a train ticket).
It’s the 20th dot-brand to change its mind about owning a gTLD after its ICANN Registry Agreement was already signed.
According to DI PRO stats, almost 100 dot-brands are actively using their domains currently, so it’s not as if the concept has been a complete train wreck (like a train train wreck).

ICA worried ICANN will force URS on .net

The Internet Commerce Association has called for a “moratorium” on the Uniform Rapid Suspension policy being added to legacy gTLD contracts, months before Verisign’s .net contract is up for renewal.
In a blog post, ICA counsel Phil Corwin accused ICANN staff of making policy by the back door by compelling pre-2012 registries to adopt URS, despite a lack of ICANN community consensus policy.
In the last few years the registries for .jobs, .travel, .cat, .pro, .xxx and most recently .mobi have agreed to adopt many aspects of the 2012 Registry Agreement, which includes the URS, often in exchange for lower ICANN fees.
Corwin wrote:

the real test of [ICANN’s Global Domains Division’s] illicit strategy of incremental de facto policymaking will come later this year, when the .Net RA comes up for renewal. We have no idea whether Verisign will be seeking any substantial revisions to that RA that would provide GDD staff with substantial leverage to impose URS, nor do we know whether Verisign would be amenable to that tradeoff.

The .net RA is due to expire July 1 this year.
Verisign pays ICANN $0.75 for each .net domain registration, renewal and transfer. If that were to be reduced to the 2012 standard of $0.25, it would save Verisign at least $7.5 million a year.
The URS provides brand owners with a way to suspend trademark-infringing domains in clear-cut cases. It’s based on UDRP but is faster and cheaper and does not allow the brand owner to seize ownership of the domains.
ICA represents large domain speculators, most of which have their investments tied up in .com and .net domains. It’s complained about the addition of URS to other gTLDs but the complaints have largely fallen on deaf ears.
ICANN has said that it does not force URS on anyone, but that it takes the base new gTLD program RA as its starting point for bilateral negotiations with registries whose contracts are up for renewal.

ICANN’s top DC lobbyist gets consumer safeguards role

ICANN has named veteran staffer Jamie Hedlund as its new senior VP for contractual compliance and consumer safeguards.
It’s a new executive team role, created by the departure of chief contract compliance officer Allen Grogan. Grogan announced his intention to leave ICANN last May, and has been working there part-time since August.
The “consumer safeguards” part of the job description is new.
ICANN first said it planned to hire such a person in late 2014, but the position was never filled, despite frequent poking by anti-spam activists.
Now it appears that the two roles — compliance and consumer safeguards — have been combined.
This makes sense, give that ICANN has no power to safeguard consumers other than the enforcement of its contracts with registries and registrars.
From the outside, it does not immediately strike me as an obvious move for Hedlund.
While his job title has changed regularly during his six or so years at ICANN, he’s mainly known as the organization’s only in-house Washington DC government lobbyist.
He played a key role in the recent IANA transition, which saw the US government sever its formal oversight ties with ICANN.
His bio shows no obvious experience in consumer protection roles.
His replacement in the government relations role is arguably just as surprising — Duncan Burns, a veteran PR man who will keep his current job title of senior VP of global communications.
The appointments seem to indicate that lobbying the US government is not as critical to ICANN in the post-transition world, and that institutional experience in the rarefied world of ICANN is a key qualifier for senior positions.

ICANN terminates penis pill pimp registrar

ICANN is to terminate the contract of a Chinese registrar linked to dodgy pharmaceuticals web sites and other malfeasance.
Nanjing Imperiosus Technology Co, which does business as DomainersChoice.com, has been told it will lose its registrar accreditation February 3.
ICANN said in the termination notice that the company had failed to keep records related to abuse reports, failed to validate Whois records, and failed to provide ICANN with registration records, all in breach of the Registrar Accreditation Agreement.
The breaches related to complaints filed by illegal pharmacy watchdog LegitScript last September, I believe.
DomainersChoice and its CEO Stefan Hansmann were listed in Whois as the owners of potentially hundreds of domains that were being used to sell medicines for conditions ranging from heart disease to erectile dysfunction.
The domains 5mg-cialis20mg.com, acheterdutadalafil.com, viagra-100mgbestprice.net and 100mgviagralowestprice.net were among those apparently owned by the registrar.
According to LegitScript, thousands of DomainersChoice domains were “rogue internet pharmacies”.
The registrar has also been linked by security researchers to mass typosquatting campaigns.
The company’s web site even has a typo generator. While one could argue such tools are also useful to brand owners, DomainersChoice’s name suggests it’s geared towards domainers, not brands.
DomainersChoice had about 27,000 domains under management at the last count, which ICANN will now migrate to another registrar.
It’s not known how many of those were self-registered domains and how many were being used nefariously, but LegitScript CEO John Horton estimated (pdf) at least 2,300 dodgy pharma sites used the registrar.

Security experts say ICANN should address collisions before approving more new TLDs

ICANN’s Security and Stability Advisory Committee has told ICANN it needs to do more to address the problem of name collisions before it approves any more new gTLDs.
In its latest advisory (pdf), published just before Christmas, SSAC says ICANN is not doing enough to coordinate with other technical bodies that are asserting authority over “special use” TlDs.
The SAC090 paper appears to be an attempt to get ICANN to further formalize its relationship with the Internet Engineering Task Force as it pertains to reserved TLDs:

The SSAC recommends that the ICANN Board of Directors take appropriate steps to establish definitive and unambiguous criteria for determining whether or not a syntactically valid domain name label could be a top-level domain name in the global DNS.
…
Pursuant to its finding that lack of adequate coordination among the activities of different groups contributes to domain namespace instability, the SSAC recommends that the ICANN Board of Directors establish effective means of collaboration on these issues with relevant groups outside of ICANN, including the IETF.

The paper speaks to at least two ongoing debates.
First, should ICANN approve .home and .corp?
These two would-be gTLDs were applied for by multiple parties in 2012 but have been on hold since August 2013 following an independent report into name collisions.
Names collisions are generally cases in which ICANN delegates a TLD to the public DNS that is already broadly used on private networks. This clash can result in the leakage of private data.
.home and .corp are by a considerable margin the two strings most likely to be affected by this problem, with .mail also seeing substantial volume.
But in recent months .home and .corp applicants have started to put pressure on ICANN to resolve the issue and release their applications from limbo.
The second incident the SSAC paper speaks to is the reservation in 2015 of .onion
If you’re using a browser on the privacy-enhancing Tor network, .onion domains appear to you to work exactly the same as domains in any other gTLDs, but under the hood they don’t use the public ICANN-overseen DNS.
The IETF gave .onion status as a “Special Use Domain“, in order to prevent future collisions, which caused ICANN to give it the same restricted status as .example, .localhost and .test.
But there was quite a lot of hand-wringing within the IETF before this status was granted, with some worrying that the organization was stepping on ICANN’s authority.
The SSAC paper appears to be designed at least partially to encourage ICANN to figure out how much it should take its lead from the IETF in this respect. It asks:

The IETF is an example of a group outside of ICANN that maintains a list of “special use” names. What should ICANN’s response be to groups outside of ICANN that assert standing for their list of special names?

For members of the new gTLD industry, the SSAC paper may be of particular importance because it raises the possibility of delays to subsequent rounds of the program if ICANN does not spell out more formally how it handles special use TLDs.
“The SSAC recommends that ICANN complete this work before making any decision to add new TLD names to the global DNS,” it says.