Yes, you are dangerous, arbitrator tells “cybersquatter” OpenTLD

Free domains provider OpenTLD has been dealt a crushing blow in its fight against the suspension of its Registrar Accreditation Agreement.
ICANN is now free to suspend OpenTLD’s RAA, due to the company’s “pattern of cybersquatting”, following a decision by an independent arbitrator.
The arbitrator ruled yesterday that OpenTLD’s suspension should go ahead, because “OpenTLD’s continued operation could potentially harm consumers and the public interest.”
The 90-day suspension was imposed by ICANN Compliance in June, after it became aware that OpenTLD had lost two UDRP cases filed by competing registrars.
WIPO panelists found in both cases that the company had infringed its competitors’ trademarks in order to entice resellers over to its platform.
The suspension was put on hold voluntarily by ICANN, pending the arbitrator’s ruling on OpenTLD’s request for emergency stay. That request was conclusively rejected yesterday.
The arbitrator wrote:

the Arbitrator has little doubt that the multiple abusive name registrations made by OpenTLD, each of which included the registered mark of a competing domain name registrar and OpenTLD’s subsequent use of those domains… formed part of a broad concerted effort by OpenTLD calculated to deliberately divert name registration business, otherwise destined for competing domain name registrars… away from those registrars to OpenTLD instead.

He wrote that OpenTLD needs to put a process in place to prevent similarly cybersquatty behavior in future, rather than just making a commitment to changing its ways.
It’s pretty harsh stuff.
OpenTLD said recently that a suspension would “devastate” and “decimate” its business, due to the intertwining of its massive ccTLD business and rather smaller gTLD platform, but the arbitrator thought a technology workaround would be rather simple to implement.
No RAA means no gTLD sales and no inbound transfers.
OpenTLD is part of Freenom, which runs .tk and other free-to-register ccTLDs.
The company’s only ray of sunlight in the ruling is that the arbitrator said the costs of the proceeding should be split equally, not all falling on OpenTLD’s shoulders.
ICANN has not yet re-instituted the suspension, but it could come soon.
The full ruling can be read here.

Panel throws out ludicrous .shop confusion ruling

The new gTLD strings .shop and .通販 are not too confusingly similar-looking to coexist on the internet.
While that may be blindingly obvious to anyone who is not already blind, it’s taken the ICANN process three years to arrive at this conclusion.
An August 18 ruling by a three-person International Centre for Dispute Resolution appeals panel has “reversed, replaced and superseded” a two-year-old decision by a lone String Confusion Objection panelist. The appeals panel found:

the [original] expert panel could not have reasonably come to the decision reached by it in connection with the underlying String Confusion Objection
…
The two strings indisputably have no visual or aural similarity, are in different languages, written in different scripts that look very different, and have different phonetic spellings and pronunciations.

.通販 is the Japanese for “.onlineshopping”, applied for by Amazon in the 2012 new gTLD round.
.shop is a contested string applied for by Commercial Connect and others.
The two strings were ruled dissimilar by the String Similarity Panel in February 2013, but Commercial Connect filed the SCO a few weeks later.
In an SCO, the complainant must show that it is “probable, not merely possible” that the two strings will get mixed up by internet users.
In August 2013, ICDR panelist Robert Nau ignored that burden of proof and inexplicably ruled that the two strings were too similar to coexist and should therefore be placed in a contention set.
Nau would later rule that .shop and .shopping are also confusingly similar.
The .通販 decision was widely criticized for being completely mad.
Amazon appealed the decision via the ICANN Request for Reconsideration, but predictably lost.
After much lobbying, last October ICANN’s board of directors created an appeals process for SCO decisions, but limited the appellant pool to Amazon with .通販 and applicants for .cam (which had been ruled similar to .com).
Now, 10 months later, we finally have a sane decision in the Amazon case. Its application will presumably now be removed from the .shop contention set.
Read the final ruling here.

Registrants guilty until proven innocent, say UK cops

UK police have stated an eyebrow-raising “guilty until proven innocent” point of view when it comes to domain name registrations, in comments filed recently with ICANN.
In a Governmental Advisory Committee submission (pdf) to a review of the Whois accuracy rules in the Registrar Accreditation Agreement, unspecified “UK law enforcement” wrote:

Internet governance efforts by Industry, most notably the ICANN 2013 RAA agreement have seen a paradigm shift in Industry in the way a domain name is viewed as “suspicious” before being validated as “good” within the 15 day period of review.
UK law enforcement’s view is that a 45 day period would revert Industry back to a culture of viewing domains “good” until they are proven “bad” therefore allowing crime to propagate and increase harm online.

The GAC submission was made August 13 to a public comment period that closed July 3.
The Whois Accuracy Program Specification Review had proposed a number of measures to bring more clarity to registrars under the 2013 RAA.
One such measure, proposed by the registrars, was to change the rules so that registrars have an extra 30 days — 45 instead of 15 — to validate registrants’ contact information before suspending the domain.
That’s what the UK cops — and the GAC as a whole — don’t like.
They have a point, of course. Criminals often register domains with bogus contact information with the expectation that the domains will not have a long shelf life. Fifteen days is actually quite generous if you want to stop phishing attacks, say.
The Anti-Phishing Working Group says phishing attacks have an average up-time of 29 hours.
Clearly, ICANN’s Whois accuracy program is doing little to prevent phishing as it is; a switch to 45 days would presumably have little impact.
But the number of domains suspended for lack of accuracy at any given time is estimated to be in the hundreds of thousands, and registrars say it’s mostly innocent registrants who are affected.
Verisign said this March that .com domains “on hold” grew from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.
In June 2014, registrars claimed that over 800,000 domains had been suspended for want of Whois accuracy in the first six months the policy was in place.

US gives ICANN an extra year to complete transition

US government oversight of ICANN and the domain name system will end a year later than originally expected.
The National Telecommunications and Information Administration said last night that it has extended ICANN’s IANA contract until September 30, 2016, giving the community and others more time to complete and review the transition proposals.
NTIA assistant secretary Larry Strickling wrote that “it has become increasingly apparent over the last few months that the community needs time to complete its work, have the plan reviewed by the U.S. Government and then implement it if it is approved.”
Simultaneously, NTIA has finally published a proposal — written by ICANN and Verisign — for how management of the DNS root will move away from hands-on US involvement.
The extension of the IANA contract from its September 30, 2015 end date was not unexpected. The current contract allows for such extensions.
As we recently reported, outgoing ICANN CEO Fadi Chehade had guessed a mid-2016 finalization of the transition.
Regardless, expect op-eds in the coming days to claim this as some kind of political victory against the Obama administration.
Part of the reason for the extension, beyond the fact that the ICANN community hasn’t finished its work yet, is legislation proposed in the US.
The inappropriately named DOTCOM Act, passed by the House but frozen for political reasons in the Senate by Tea Party presidential hopeful Sen Ted Cruz, would give Congress 30 legislative days (which could equal months of real time) to review the IANA transition proposals.
There are basically three prongs to the transition, each with very long names.
The “Proposal to Transition the Stewardship of the Internet Assigned Numbers Authority (IANA) Functions from the U.S. Commerce Department’s National Telecommunications and Information Administration (NTIA) to the Global Multistakeholder Community” is the first.
That was created by the multistakeholder IANA Stewardship Transition Coordination Group (ICG) and deals with how the IANA contract will be managed after the US government goes away.
The second prong comes from the Cross Community Working Group on Enhancing ICANN Accountability, which deals with how ICANN itself can improve its accountability to the internet community without the Damoclean sword of US intervention hanging over it.
The CCWG’s latest draft report would strengthen the ICANN board against capture by, for example, making certain bylaws harder to amend and giving the community the right to fire directors.
Both of these proposals are currently open for public comment here.
The third prong, which only appears to have been published this week, deals with the nuts and bolts of how changes to the DNS root zone are made.
The current system is a tripartite arrangement between IANA, NTIA and Verisign.
When a TLD operator needs a change to the DNS root — for example adding a name server for its TLD — the request is submitted to and processed by IANA, sent to NTIA for authorization, then actually implemented on the primary root server by Verisign.
Under the new proposal (pdf) to phase the NTIA out of this arrangement, the NTIA’s “authorization” role would be temporarily complemented by a parallel “authentication” role.
The proposal is not written in the clearest English, even by ICANN standards, but it seems that the current Root Zone Management System would be duplicated in its entirety and every change request would have to be processed by both systems.
The output of both would be compared for discrepancies before Verisign actually made the changes to the root.
It seems that this model is only being proposed as a temporary measure, almost like a proof of concept to demonstrate that the NTIA’s current authorization role isn’t actually required and won’t be replaced in this brave new world.

Did Chehade really quit ICANN for this?

ICANN CEO Fadi Chehade will become a senior adviser with a private equity firm after he leaves ICANN next March.
He blogged today that he will take the role with Boston-based ABRY Partners and “provide guidance to ABRY’s partners and their companies’ leaders on digital strategy”.
Chehade, back in June, had described the ICANN CEO role as a “better job that I’ve ever had, or will ever have”.
He had years left on his contract.
My first thought is: really? This is the gig you quit ICANN for?
I’m drawn down the path of thinking that rather than finding the job of his dreams elsewhere, the dude is just suffering from ICANN burnout.
Chehade suggests in his post that ABRY is not a full-time job, writing: “I expect to add other roles to my portfolio and will update you all as appropriate.”
ABRY, at first glance, does not appear to have any significant connection to the domain name industry or to ICANN itself.

OpenTLD says suspension would “devastate” its business

OpenTLD has fired off its newest salvo in its ongoing cybersquatting dispute with ICANN, saying the ICANN-imposed suspension would “devastate” its business.
The company has also addressed many of ICANN’s cybersquatting allegations, while failing to deny it squatted on two competitors’ trademarks.
In its latest arbitration filing (pdf), OpenTLD said: “Quite simply, the suspension of OpenTLD’s ability to offer gTLD registrations and inbound transfers would decimate its unique business model.”
ICANN had argued that the suspension of its registrar accreditation was no big deal because its gTLD domain base is measured in the low thousands, whereas the total domains under management of parent Freenom, which offers free domains in .tk and other ccTLDS, is in excess of 25 million.
But OpenTLD said the two businesses as “deeply intertwined” and separating the two would impair its ability to do business.
ICANN is pushing for the suspension because OpenTLD lost two UDRP cases earlier this year. Both were filed by competitors — Key-Systems and NetEarth — who accused the registrar of attempting to lure resellers to its platform by infringing rivals’ trademarks.
ICANN has since followed up by accusing OpenTLD of continuing to cybersquat famous brands, including Google and Facebook, even after the suspension notice was issued. These claims, as I noted last week, are very dubious, however.
In its latest filing, OpenTLD denies that any of those domains — all of which use its privacy service — were registered by itself. It goes so far as to name the actual registrants.
But it fails to deny that it was the true registrant of the Key-Systems and NetEarth domains lost in the UDRP cases.
Rather, it focuses on ICANN’s claims that it committed “cyberflight” by deleting the UDRP’d domains rather than allowing them to be transferred to the trademark owners.
It admits that the domains were deleted but said this was “inadvertent” and that it attempted to transfer them to its competitors later.
OpenTLD wants the threatened suspension stayed.
The case continues. A decision by the arbitration panel is expected August 24.

OpenTLD cybersquatting fight escalates

ICANN has accused OpenTLD, the registrar arm of Freenom, of cybersquatting famous brands even after it was threatened with suspension.
The claims may be worrying for some registrars as ICANN may in fact be holding the registrar responsible for the actions of its proxy service customers.
OpenTLD was suspended by ICANN in early July, after two UDRP rulings found the company had cybersquatted rival registrars’ brands in order to poach customers.
The suspension was lifted after just a few hours when OpenTLD took ICANN to arbitration under the terms of its Registrar Accreditation Agreement.
In ICANN’s latest arbitration filing, the organization’s lawyers argue that the suspension should not be stayed, because OpenTLD has been shown to engage in a pattern of cybersquatting.
Like the original suspension notice, the filing cites the two UDRP losses, along with footnotes indicating that as many as seven competing brands had been cybersquatted.
But ICANN has now also escalated its allegations to bring in non-registrar brands where it’s far from clear that OpenTLD is the actual registrant.
ICANN’s filing states:

even a brief review of the domain names in OpenTLD’s portfolio demonstrates that OpenTLD appears to be continuing to engage in bad faith and abusive registration practices. As of 3 August 2015, there were at least 73 gTLD domains registered to Stichting OpenTLD WHOIS Proxy (which is OpenTLD’s proxy service) that are identical to or contain the registered trademarks or trade names of third parties, including, by way of small example, the domain names barnesandnoble.link, sephora.bargains, at-facebook.com, ebaybh.com, googlefreeporn.com, global-paypal.com, hotmailtechnicalsupport.com, and secure-apple.com. ICANN is not aware of any legitimate interest or right that OpenTLD has to use these third-party trademarks and trade names.
Even more concerning is the fact that at least 14 gTLD domain names that contain the registered trademarks or trade names of third parties were registered by OpenTLD’s proxy service after the 23 June 2015 Suspension Notice was issued to OpenTLD, further demonstrating that OpenTLD’s overtures of “cooperation” ring hollow.

To be clear, that’s ICANN accusing OpenTLD of cybersquatting because some of the domains registered via its privacy service appear to be trademark infringements.
It’s basically equating infringing use of OpenTLD’s proxy service (such the registration of barnesandnoble.link) with the infringing behavior of OpenTLD itself (such as the registration of godaddy.cf, a February 2015 screenshot of which can be seen below.)

This may just be legal posturing, but I imagine many other registrars would be worried to know that they could have their accreditation suspended for cybersquatting simply because some of their privacy customers are cybersquatters.
I’d wager that every proxy/privacy service available has been used by blatant cybersquatters at one time or another.
Filings in the arbitration case can be found here.

ICANN gets hacked, again

ICANN has been hacked again and your user names and passwords may have been compromised.
The organization said tonight that it thinks “usernames/email addresses and encrypted passwords for profile accounts created on the ICANN.org public website were obtained by an unauthorized person.”
The stolen information includes “user preferences for the website, public bios, interests, newsletter subscriptions, etc”, ICANN said.
No critical systems seem to have been affected, ICANN said.
ICANN said that an “external service provider” was responsible for the hashed passwords that were nabbed.
It recommends an abundance of caution: changing passwords, or simply (and unrealistically) not using the same password across multiple sites.
ICANN gets hacked constantly. It’s barely even news any more. Many of the stories can be found with this search.

Dozens of dot-brands finally sign ICANN contracts

Dot-brand gTLD applicants that were playing wait-and-see with ICANN’s contracting process signed Registry Agreements in droves last week.
At least 67 new RAs were signed in the last three days of July, on or around the ICANN’s July 29 deadline, ICANN’s web site shows.
This means that there are still about 50 applicants that have not pulled the trigger and may have to apply for an 60-day last-chance extension.
A week before the deadline, roughly 170 brands had still not signed contracts.
The July 29 deadline was put in place for dot-brands last year due to delays creating Specification 13 of the RA, which gives brands special opt-out clauses dealing with things like sunrise periods.
Those that have still not obtained RAs are expected to be flagged as “Will Not Proceed” and will have to apply to ICANN for the extension under its Application Eligibility Reinstatement process.

African Union slams “dysfunctional” IRP as ICANN tries to fend off cover-up claims

The African Union Commission has criticized ICANN’s “dysfunctional accountability process” that has kept the proposed .africa gTLD in limbo for the last few years.
In a communique yesterday (pdf), the AUC also reiterated that .africa applicant ZA Central Registry has the support of both the AUC and its member states, and that governments used almost every avenue available to them to object to the rival DotConnectAfrica bid.
The letter reads:

The Africa region, African Internet stakeholders, the ZACR and AUC are the unfortunate victims of a dysfunctional accountability process and an independent review panel that did not delve more deeply to understand the new gTLD process, the role of governments in that process, and how the ICANN multistakeholder model functions in general.

A few weeks ago, an Independent Review Process panel controversially ruled that ICANN had treated DCA’s application unfairly, in violation of its bylaws, when it accepted Governmental Advisory Committee advice to reject it.
The panel said that ICANN should have at least asked the GAC for the rationale behind its advice, something that the new gTLD program’s rules did not require it to do.
One of the issues at the heart of the subsequent debate is whether ICANN inappropriately helped out ZACR’s bid by drafting an AUC letter of support and then tried to cover its actions up by inappropriately redacting information from the IRP ruling before publication.
On Friday, ICANN published a new version of the ruling that had these references restored, while retaining redactions related to the actions of Kenyan government officials.
We know what the still-redacted text says because Kieren McCarthy, writing for The Register, obtained a clean copy and published it a couple of weeks ago.
ICANN also promised to publish its reasoning if it makes redactions to any documents in future.
In a blog post on Friday, general counsel John Jeffrey said that ICANN helping the AUC draft its letter of support was not a unique case, nor was it inappropriate:

ICANN staff has helped many applicants and their supporters understand how to properly document support. Not only did we make a template support letter publicly available to all as part of the New gTLD Program Applicant Guidebook (see Appendix to Module 2), we have answered questions, received through our customer service channel, as to how interested parties can document support for a given gTLD application. In the case of ZA Central Registry, ICANN appropriately assisted the applicant in documenting support from the AUC.
Our actions surrounding the .AFRICA applications were not unique, since we assist any applicant who requests assistance, or who needs clarification in learning how best to document support or other matters. We have provided assistance to all applicants regarding their applications to the maximum extent possible.

On the claims that ICANN tried to “cover up” this assistance by redacting the IRP’s ruling and previous IRP filings, Jeffrey said that the information was covered by a confidentiality agreement agreed to by itself and DCA and endorsed by the IRP panel.
He said that ICANN was “motivated by our obligation to the community to post the document quickly and the competing, yet mandatory obligation, to respect confidential information while being as transparent as possible.”
He said ICANN attempted to reach out to those affected by the “confidential” parts of the ruling to seek permission to remove the redactions.
But McCarthy also seems to have seen emails exchanged between DCA and ICANN, and he says that ICANN redacted it over DCA’s objections.
McCarthy further says that ICANN only became interested in removing the redactions after he had already published the clean version of the ruling at The Reg — five days after the initial publication by ICANN.
Jeffrey’s post, which refers to “erroneous reporting” in an apparent allusion to McCarthy’s articles, nevertheless fails to address this claim, lending credibility to the cover-up allegations.
The .africa gTLD has been contracted to ZACR, but DCA’s rejected application has been returned to evaluation per the IRP’s ruling, where it is broadly expected to fail for want of governmental support.
Disclosure #1: I recently filed a Documentary Information Disclosure Policy request seeking the release of all the unredacted exhibits in DCA v ICANN. Given ICANN’s wont to usually respond to such requests only at the end of the full 30 days permitted by the policy, I should not expect to see an answer one way or the other until the last week of August.
Disclosure #2: As regular readers may already be aware, due to my long-held and never-disguised view that DCA was mad to apply for .africa without government support, I was once accused of being a part of a “racial conspiracy” against DCA on a blog I believe to be controlled by DCA. Naturally, after I stopped laughing, this libelous allegation pissed me off no end and enhanced my belief that DCA is nuts. Around the same time DCA also, under its own name, filed an “official complaint” (pdf) with ICANN, omitting the race card, alleging that I was part of a conspiracy against it.