KnujOn scores a win as BizCN gets first breach notice

The Chinese registrar BizCN has received its first breach notice from ICANN’s compliance department, following a sustained campaign by anti-abuse activist KnujOn.
The notice concerns Whois accuracy, specifically for the domain names rapetube.org and onlinepharmacy4.org, and a bunch of other peripheral breaches of the Registrar Accreditation Agreement.
The “porn” site rapetube.org was the subject of a Washington Post article last December, in which KnujOn’s Garth Bruen said he feared the site might contain footage of actual crimes.
Bruen has been chasing BizCN about Whois inaccuracy, and specifically the rapetube.org domain, since 2011.
He said in a September 2013 CircleID post that he’s filed Whois inaccuracy complaints about the domain with ICANN “multiple times”.
His campaign against ICANN Compliance led to an Ombudsman complaint (which was rejected) last year.
Now Compliance appears to be taking the case more seriously. ICANN, according to the breach notice, has been on BizCN’s case about rapetube.org’s Whois since March 24 this year.
At that time, the name was registered to a Vietnamese name with a French address and phone number and a contact email address at privacy-protect.cn.
According to Bruen’s interview with the Post, this email address bounced and nobody answered the phone number. The privacy-protect.cn domain does not appear to currently resolve.
ICANN evidently has some unspecified “information” that shows the email “does not appear to be a valid functioning email address”.
But BizCN told ICANN April 2 that it had verified the registrant’s contact information with the registrant, and provided ICANN with correspondence it said demonstrated that.
ICANN says the correspondence it provided actually predated KnujOn’s latest complaint by six months.
In addition, when BizCN forwarded a scanned copy of the registrant’s ID card, ICANN suspected it to be a fake. The notice says:

Registrar provided copies of correspondence between the reseller and registrant. The response included the same email address that was still invalid according to information available to ICANN, and included a copy of a government identification card to confirm the registrant’s address. According to information available to ICANN, the identification card did not conform to any current or previous form of government identification for that jurisdiction.

Despite repeated follow-up calls, ICANN said it still has not received an adequate response from BizCN, so its accreditation is now in jeopardy.
BizCN has something like 450,000 gTLD names under management and is in the top 50 registrars by volume.
As for rapetube.org, it’s still registered with BizCN, but its Whois changed to a Russian company “Privat Line LLP”, at privatlinellp.me, on or about April 17.
That change is not going to help BizCN, however, which is being asked to provide evidence that it took “reasonable steps to investigate and reasonable steps to correct the Whois inaccuracy claims”.
It has until May 29 to sort out the breaches or face termination. Read the breach notice here.

GNSO says dot-brand rules “inconsistent” with policy

The ability of dot-brand gTLDs to limit how many registrars they work with is “inconsistent” with the GNSO’s longstanding policy on new gTLDs, ICANN’s GNSO Council has found.
At the end of March, ICANN approved a set of Registry Agreement opt-outs, such as the ability to avoid sunrise periods and approve just three hand-picked registrars, for dot-brands.
They’re designed to make life easy for single-registrant zones where the gTLD is also a famous, trademarked brand and it would be silly to enforce open access to all accredited registrars.
But the GNSO Council resolved last week that the registrar exception is inconsistent with the GNSO policy that first kicked off the new gTLD program in 2007, which called for non-discriminatory access.
It had been asked specifically by the ICANN board’s New gTLD Program Committee to comment on whether there was a conflict. The Council said:

the language of this recommendation of the final report of the GNSO does not stipulate any exceptions from the requirements to treat registrars in a non-discriminatory fashion and (ii) the GNSO new gTLDs Committee discussed potential exceptions at the time, but did not include them in its recommendations, which is why the lack of an exception cannot be seen as an unintended omission, but a deliberate policy statement

However, the Council also decided that it has no objection to ICANN going ahead with the so-called Specification 13 exceptions, saying it “does not object to the implementation of Specification 13 as a whole”.
No GNSO members bothered to object when Spec 13 was open to public comment.
While it’s certainly a pragmatic, reasonable decision by the GNSO, it does highlight a situation where ICANN seems to have overridden a hard-fought community consensus policy.
That’s likely why its resolution also warns the ICANN board that its decision “may not be taken as a precedent”. Which of course it now is, regardless.

.africa frozen by panel after ICANN screwup

ZA Central Registry’s bid for the .africa new gTLD has been put on ice by an arbitration panel which admonished ICANN for failing to follow its own bylaws.
An Independent Review Panel ruled yesterday that ICANN should not carry on processing .africa until it has ruled on a complaint filed by failed .africa applicant DotConnectAfrica.
If .africa were to be delegated, which could have happened as early as Thursday — ZACR and ICANN have already signed a Registry Agreement — it would render the IRP’s decision moot, the panel found.
This ruling doesn’t mean ICANN has lost the case, just that it’s temporarily enjoined from delegating .africa until the final decision has been made by the IRP panel.
However, the panel had some stern words for ICANN, saying that the matter could have been settled months ago had ICANN only followed its own bylaws.

In the Panel’s unanimous view, it would be unfair and unjust to deny DCA Trust’s request for interim relief when the need for such a relief by DCA Trust arises out of ICANN’s failure to follow its own bylaws.

ICANN’s board of directors passed a resolution in April 2013 calling for the creation of a “standing committee” of nine potential IRP panelists, from which each three-person IRP panel could be drawn.
But, over a year later, it has not created this committee, the current IRP panel said. This led to the delay that forced DCA to request the emergency injunction.
ICANN’s basically been told by one of its own accountability mechanisms that that accountability mechanism is inadequate, at a time when its accountability mechanisms are under the world’s spotlight.
Just last week, the organization launched an accountability review that it said it “interdependent and interrelated” to the process of transitioning IANA away from US government stewardship.
Yeah, it’s embarrassing for ICANN. Doubly so because it’s been beaten by a company so incompetent it accidentally applied for the wrong gTLD.
For ZACR, the panel reckons the delay in getting .africa delegated will likely last “a few months”.

Congress may block funding for IANA transition

A US House of Representatives committee has voted to de-fund the IANA transition process.
On Thursday, the House Appropriations Committee approved the fiscal year 2015 Commerce, Justice, Science Appropriations bill, which includes the $36.7 million budget for the NTIA’s running costs.
The National Telecommunications and Information Administration is the part of the Department of Commerce responsible for oversight of the IANA functions, which it plans to relinquish.
The committee noted its “concern” at this prospect, and said that no money would be made available to fund this process. Notes to the appropriations bill (pdf) include the following text:

The Committee is concerned by NTIA’s announcement of its intent to transition certain Internet domain name functions to the global multistakeholder community. Any such transition represents a significant public policy change and should be preceded by an open and transparent process. In order for this issue to be considered more fully by the Congress, the recommendation for NTIA does not include any funds to carry out a transition of these functions. The Committee expects that NTIA will maintain the existing no-cost contract with ICANN throughout fiscal year 2015.

Other bills currently up for discussion in Congress would delay the IANA transition pending further review by the Government Accountability Office.
The appropriations bill has passed a committee vote, but it still has other legislative stages to pass through before it becomes law.

Six ways ICANN is ballsing up the IANA transition

ICANN has been subjected to its first wave of criticism over its handling to date of the IANA transition process, which will see oversight of the DNS root leave US government hands.
Yesterday was the deadline for comments to be submitted on ICANN’s proposal for a way to handle what some are calling the “sunsetting” of the Department of Commerce’s stewardship of the IANA function.
As DI previously reported, it’s “a proposal for a process to develop a process to develop a proposal”.
ICANN basically proposed a 22-member “Steering Group”, comprised of members of the various ICANN constituencies, that would guide the bottom-up, multistakeholder IANA transition discussion.
The group would ultimately steer the community towards creating a proposal for replacing the US government as IANA’s overseer, which would then be checked and rubber-stamped by Commerce.
As part of ICANN’s initial proposal, a “scoping document” was provided, laying out what in ICANN’s view should and should not be open for discussion.
Dozens of comments were received covering a diverse range of issues related to the make-up of the Steering Group and the range of the scoping document.
Here I’m going to attempt to cover half a dozen key themes that seemed to emerge across multiple commenters.
Note: 1) it’s not a comprehensive overview, 2) I don’t necessarily agree with all of the comments cited below, 3) that most of the links throughout this article are to PDFs.
Registries are apparently not “affected parties”
Given that one of IANA’s key roles (for DI’s purposes, it’s its primary role) is assigning TLDs to registries, you might have expected registries to be classed as “affected parties”.
But they’re not. Bafflingly, only the IAB, IETF, ISOC and NRO — none of which primarily concern themselves with domain names — get that definition in ICANN’s proposal.

Naturally enough, the ccTLD and gTLD operators are not happy about this state of affairs.
The ccNSO, proposing that gTLDs and ccTLDs get two seats each on the Steering Group, wrote:

These organizations, which also participate directly in ICANN’s multistakeholder process, are appropriate and important participants in this transition planning process, but they are not adequate substitutes for registry stakeholders with respect to processing root zone change requests and other functions that uniquely affect TLD registry operators… It is imperative that registry operators sit at the table on equal footing with those organizations and without ICANN intermediation.

The Registries Stakeholder Group of the GNSO concurred, stating:

we feel this list is incomplete as it does not include direct customers of the IANA functions, such as gTLD, nTLD and ccTLD registries, which is incomprehensible and appears to be self-serving of the convener

The GNSO is under-represented
If the registries feel badly treated, they’re not alone.
The Generic Names Supporting Organization comprises seven distinct stakeholder groups: registries, registrars, non-commercial users, non-profits, businesses, ISPs and intellectual property owners.
While there is overlap (registries and registrars often vote en bloc, as do businesses and IP owners), there are at least three camps that rarely fully agree with each other.
The ICANN proposal would provide two seats on the Steering Group between them.
The Intellectual Property Constituency, in its comments, said that each GNSO constituency should get one seat each.
The US Chamber of Commerce asked for at least one seat to be set aside for business interests.
A group of registrars, including most of the big ones, agreed, and put forward a rather more expansive proposal:

Several members of the Registrar Stakeholder Group believe that having two Steering Group representatives for the GNSO will not be sufficient in ensuring that the interests of all GNSO stakeholders are properly reflected. As the GNSO is the largest and most diverse structure within ICANN, we find that a “one size fits all” approach to delegation is not appropriate. Instead, we propose that each SO/AC submit a number of representatives that it believes to be sufficiently representative, but be encouraged to keep the number as small as possible.

The selection process is top-down
Given that this is supposed to be a community-driven process, you’d expect the community to be tasked with picking their representatives on the Steering Group. But that’s not what ICANN proposes.
ICANN instead reckons that membership should be selected by ICANN chair Steve Crocker and GAC chair Heather Dryden from the pool of people who volunteer themselves.
Unsurprisingly, there’s lots of opposition to this. Most groups commenting on this aspect of the proposal said that committee members should be selected by the groups they represent.
The Business Constituency stated:

Appointments to the Steering/Convening Committee should come from constituency groups — not as appointments made by ICANN chair and GAC chair. Nor should any stakeholder group be excluded as a result of consolidating within stakeholder organizations such as the GNSO.

The Center for Democracy and Technology agreed, saying:

The Chairs of ICANN and the GAC should not be the ones to select the Supporting Organization and Advisory Committee representatives; the SO/AC representatives should be selected within their own communities.

Inappropriate framing of the discussion
Many commenters took issue with the way ICANN has configured the discussion, accusing it of acting in the interests of its own self-preservation rather than the stability of the IANA function.
Chiefly, there’s concern that the discussion has been framed in such a way that it assumes ICANN will continue in its role as performer of the IANA functions in more or less the same way as today.
This concern appears to be extremely broad.
The RySG said it was “suspicious” of what appeared to be a “self-interested” framing of the debate:

we feel that it is premature for ICANN staff to assert that ICANN’s role is out of scope. This sentiment is not included in the NTIA announcement and we believe ICANN’s role is an issue that should be left to the bottom-up, multistakeholder process to decide. In particular, we believe whether “structural review of ICANN or its functions” should be included in the scope should be a matter for the community.

The Non-Commercial Stakeholders Group agreed that this should be open for discussion:

ICANN-controlled entities both develop and approve DNS policies and also implements the IANA functions. Only a requirement of the NTIA contract guarantees separation of policy and DNS root zone implementation activities. Because of this, we cannot currently support language in ICANN’s proposed Scoping Document which explicitly rules out any discussion of separating the IANA functions from ICANN. How or whether to separate those activities in lieu of the NTIA contract should be openly discussed.

Google said in its comments:

The role of ICANN’s Board is to oversee all of ICANN’s business and operational actions and to ensure its continued solvency as an organization. As such, the Board has a vested interest in ensuring ICANN’s continued relevancy within the Internet governance ecosystem and arguably has an interest in scoping the process to preserve ICANN’s existing role. While we are confident that ICANN’s Board would not act in a way that would harm the Internet or the IANA functions transition, the presence of a conflict of interest — even if perceived — could impact the overall integrity of the process

The Business Constituency said:

this transition should not presume that the only possible outcome is to award IANA functions to ICANN. It is possible that some other third party could replace the US government role as counterparty.

Accountability is being handled in a separate track
ICANN was initially of the view that its own accountability mechanisms — things designed to prevent capture, allow appeals of decisions etc — were out of scope for the IANA transition discussion.
It’s since backtracked, this week launching a new “Enhancing ICANN Accountability” process that will run in parallel — and be “interdependent and interrelated” — to the IANA transition debate.
If these two discussions are so interdependent, why not just lump them together in the same policy track? It’s surely a recipe for mass confusion to keep them separate.
The NCSG stated in its comments:

We do not support ICANN’s efforts to discuss the IANA transition and accountability mechanisms on separate tracks. Specifically, ICANN’s draft proposal and scoping document might prevent any discussion of options for structurally separating IANA function operations from DNS policy making activities.

The ccNSO seemed resigned to the separation, but noted:

To the extent that ICANN continues to insist on maintaining separate tracks to address each of these issues, it must ensure that the two tracks come together in advance of the transition itself.

The IPC said that the discussions need to be more closely synchronized:

The resolution of these two issues is inextricably intertwined and the processes and mechanism for doing so need to be tightly coordinated; this is impossible if the processes and mechanisms are not being developed at the same time.

There’s far from consensus on this issue, however.
The BC and Google both explicitly support the continued separation of the two tracks, while the International Trademark Association implicitly supported the parallel moves, noting:

We generally would be opposed to any approval of an IANA functions transition plan unless it is accompanied by an acceptable globalization and accountability plan that assures continued ICANN accountability at optimal levels.

Everyone only had 30 days to comment
Given that we’re talking about management of the DNS root here, you’d imagine that ICANN would take it just as if not more seriously than, I dunno, its “Future Meetings Strategy” or how much its directors are paid.
But while these and most other comment periods get 45 too 60 days of public comment, the IANA transition proposal only got 30.
ICANN is evidently in a rush to get things finalized before its next public meeting, scheduled for next month in London, rather than wait until the Los Angeles meeting in October.
Some groups, such as the Governmental Advisory Committee, couldn’t get their act together in time to provide a meaningful response given the tight deadline.
Many others, such as the Registries Stakeholder Group, complained:

it is unacceptable that an issue as critical as the transition of the IANA functions would be allowed only a short public comment period

The IPC stated that the whole timetable is out of whack:

The group is supposed to convene for the first time in London in approximately 6 weeks, yet the concept of a Steering Group is not finalized, much less its composition or how it would be chosen… The Steering Group is also supposed to “finalize the group’s charter” “in the London 50 timeframe.” Charters are critical documents, and they take a number of hours over a number of weeks to be created, much less finalized. How would the group have a draft charter before London that could be finalized in London?

Herding cats
In my opinion, this may be “a proposal for a process to develop a process to develop a proposal”, but it’s also a process to demonstrate the effectiveness and inclusiveness of the process.
Given the parallel focus on internet governance in the non-ICANN world (eg NetMundial), the multistakeholder model itself is under intense scrutiny.
How ICANN responds to this first wave of comments will be crucial.
While there are certainly divergent views (not half of which I’ve covered here) among the various parties, it seems to me that some clear areas of agreement have emerged, even among groups that don’t often see eye to eye.
Will ICANN bow to a clear call for its scoping document to be relaxed — putting its own neck on the chopping block in the process — because the multistakeholder community seems to be asking for it?

ICANN split between GNSO and GAC on IGO names

ICANN’s board of directors has refused to choose between the Generic Names Supporting Organization and the Governmental Advisory Committee on the issue of intergovernmental organization protections.
In a resolution last week, the board decided to approve only the parts of the GNSO’s unanimous consensus recommendations that the GAC does not disagree with.
The GNSO said last November that IGOs should not have their acronyms blocked forever at the second level in new gTLDs, going against the GAC consensus view that the acronyms should be “permanently protected”.
The GAC wants IGOs to enjoy a permanent version of the Trademark Claims notifications mechanism, whereas the GNSO thinks they should only get the 90 days enjoyed by trademark owners.
Instead of choosing a side, ICANN passed a resolution last Wednesday requesting “additional time” to reach a decision on these points of difference and said it wants to:

facilitate discussions among the relevant parties to reconcile any remaining differences between the policy recommendations and the GAC advice

The decision is not unexpected. Board member Bruce Tonkin basically revealed the board’s intention to go this way during the Singapore meeting a couple of months ago.
The differences between the GAC and the GNSO are relatively minor now, and the board did approve a large part of the GNSO’s recommendations in its resolution.
IGOs, the Olympics, Red Cross and Red Crescent will all get permanent blocks for their full names (but not acronyms) at the top level and second level in the new gTLD program.
International nongovernmental organizations (INGOs) will also get top-level blocks for their full names and protection in the style of the Trademark Claims service at the second level.
The dispute over acronyms was important because many obscure IGOs, which arguably don’t need protection from cybersquatters, have useful or potentially valuable acronyms that new gTLD registries want to keep.

Wikipedia to get single-letter .wiki domain

Top Level Design has scored a bit of a coup for its forthcoming .wiki gTLD — Wikimedia Foundation, which runs Wikipedia, has signed up as an anchor tenant.
According to the registry, Wikimedia will use w.wiki as a URL shortener and they’re in talks about other domains.
The company has also applied to ICANN to release hundreds of two-letter language codes that the foundation wants to use for language-specific short links.
The deal is reminiscent of .CO Internet’s launch, when it allocated the now-ubiquitous t.co for Twitter’s in-house URL shortener, giving it a much-needed marketing boost.
The deal for two-letter domains stands only a slim chance of of being ready in time for .wiki’s general availability, scheduled for May 26, in my view.
Under ICANN’s standard Registry Agreement, all two-character strings are blocked, in order to avoid clashes with country codes used in the ccTLD naming schema.
Top Level Design has now used the Registry Services Evaluation Process to try to get 179 two-letter strings, each of which represents a language code, unblocked.
Wikimedia explicitly endorses the proposal, in a letter attached to the March 11 RSEP (pdf)
The organization plans to use domains such as fr.wiki to redirect to French-language Wikipedia pages and so forth.
It remains to be seen whether ICANN will approve the request. It’s previously been envisaged that registries would approach each country individually to have its ccTLD’s matching string released.
Top Level Design points out that the strings it wants unblocked are from the ISO 639-1 language codes list, not the ISO 3166-1 lists from which ccTLD names are drawn.
But it’s a bit of an argument to nowhere — the strings are identical in most cases.
Under the RSEP policy, Top Level Design really should have been given a preliminary determination by now. It filed its request March 11 but it was only posted last week.
The clock, which gives ICANN 15 days to give the nod or not, may have only just started.
After the preliminary determination, there would be a public comment period and a board of directors decision. The timetable for this would not allow .wiki to launch with the two-letter names active.
But even with the delay, it seems that the registry will be coming out of the door with at least one strong anchor tenant, which is something most new gTLDs have so far failed to manage.

NameCheap gets contract breach notice

ICANN has sent a formal breach notice to top ten registrar NameCheap, saying the company failed to comply with a mandatory audit.
ICANN also claims in the notice (pdf) that the company has failed to keep its web site up to date with pricing information required by policies.
NameCheap, which says it has over three million domains under management, may be the largest registrar to get to the formal, published breach notice stage of the ICANN compliance process.
But it should be noted that while the company is accredited and must comply with its Registrar Accreditation Agreement, it does almost all of its business as an eNom reseller.
Just a handful of domain names are registered under NameCheap’s own IANA number.

Glitch takes out ICANN’s zone file service

A bug which gave elevated privileges to new gTLD registries has taken out ICANN’s Centralized Zone Data Service for the best part of a day.
CZDS is the central clearinghouse for zone file data access requests. All new gTLD registries must participate. DI uses the data provided via the service to calculate registration numbers.
The service was turned off yesterday after registries noticed that they were able to view and approve pending requests made to rival registries and informed ICANN.
The site has been “currently undergoing maintenance” since at least 0200 UTC today. The bug was present from at least 2100 on Monday night, which was when I first heard about it.
ICANN tells me the move to take down the site yesterday was made out of “an abundance of caution” and that its techies are looking at the issue right now.
Talking to a few registries, it seems they were given super-user privileges.
They were able to review requests for zone file access made by users like DI to any new gTLD registry. They would have been able to approve such requests, registries tell me.
The contact information of the requesting party was also visible, they tell me.
I think in most cases this isn’t a big deal. I assume most CZDS users just blanket-request every file from every gTLD registry, but there could hypothetically be edge cases where a sensitive request was exposed.
For the avoidance of confusion, the bug would not have given anyone the ability to edit any zone files. CZDS is just a publishing clearinghouse, it has no functional role in the DNS.
Two other ICANN sites, the Global Domains Division portal and parts of MyICANN, both of which run on the Force.com platform, also currently appear to be down for maintenance, but it’s not currently clear if these issues are related.

Registrant complains to ICANN over Uniregistry’s premium names

A would-be new gTLD registrant has appealed to ICANN over the domain name moviestar.photo, which she was unable to register because Uniregistry had reserved it as a premium name.
Danielle Watson filed a formal Request for Reconsideration (pdf) with ICANN last week, in the mistaken belief that ICANN had placed the domain she wanted on one of its block-lists.
She described her predicament thus:

a. Website Name Registration: I purchased one of the new gTLD domain names ending in .photo from 101domain.com on April 2, 2014. Moviestar.photo
b. I received an email on April 14, 2014 stating that ICANN kept this name from being registered in my name, and I would receive a refund in which I did.
c. I cannot understand why this name is being withheld, and being put into your reserve list.
d. I take very old Movie Stars photos and colorize them and put old fashioned frames around them and sell them at craft fairs locally. This name would have been a perfect fit for my use and sales. Please reconsider my request to be reconsidered and the name moviestar.photo reinstated/registered in my name with 101domain.com

Correspondence from 101domain provided by Watson (pdf) does not mention ICANN, so I’m not sure how she came to the conclusion that ICANN was to blame.
I fear she has targeted ICANN incorrectly.
The DI PRO name collisions database shows that the string “moviestar” has been blocked by ICANN’s policy on collisions in 15 new gTLDs, but Uniregistry’s .photo is not one of them.
Whois records show that moviestar.photo is in fact registered to North Sound Names. That’s the name of the Uniregistry affiliate currently in control of tens of thousands of Uniregistry premium names.
The RfR is not the venue for this kind of complaint and it’s likely to be dismissed for that reason. There’s not much ICANN can do about it.
Perhaps Watson would have better luck writing a begging letter to Uniregistry CEO Frank Schilling, who has indicated his willingness to allocate premium names to deserving users.