Board confirms: ICANN seeks non-US HQ

ICANN’s board of directors has given the clearest indication yet that the organization wants to set up an HQ overseas, further loosening ties with the US government.
The board has formed six new “President’s Globalization Advisory Groups”, made up of half a dozen directors each, one of which has been tasked with advising ICANN on ways to:

Establish complimentary [sic] parallel international structure to enhance ICANN’s global legitimacy. Consider complementary parallel international structure within scope of ICANN’s mandate.

This indicates that ICANN’s reported plan to base itself in Geneva may not be so far-fetched after all, but it also indicates that ICANN currently does not anticipate doing away with its original HQ in Los Angeles.
ICANN already has several offices around the world, but recently there’s been talk of it embedding itself in Switzerland, as an “international organization”, more deeply.
As we’ve previously reported, ICANN may not relocate outside of the US due to its Affirmation of Commitments with the US Department of Commerce, which requires it to remain a US non-profit.
But another of the three panels set up by the board this week will advise ICANN on how to create an “enhanced Affirmation of Commitments.”
Other panels will explore the globalization of the IANA function — currently operated under a procurement contract with Commerce — and the root server system, which is independent operated but heavily US-based.
The ICANN board said in its resolution:

the continued globalization of ICANN must evolve in several ways, including: partnerships in the broader Internet eco-system to strengthen multistakeholder Internet governance frameworks; strengthening ICANN itself, including affirmations of commitments and relationships among the stakeholders; evolving the policy structures to serve and scale to the needs of the global community, and identify opportunities for the future legal structures and IANA globalization.

The plan is for these panels talk to the community at the Singapore meeting next month, before reporting back to the board before ICANN meets for its 50th public meeting in London this coming June.
This week’s move is the latest in a series of decisions made by the ICANN board following the spying revelations of former NSA contractor Edward Snowden and the subsequent consternation they caused in capitals around the world.
Brazil is set to host a meeting to discuss these kinds of internet governance matters with ICANN and its coalition of the willing in Sao Paulo this April.

NCC buys .trust new gTLD from Deutsche Post

NCC Group, owner of .secure applicant Artemis, has bought the rights to .trust from Deutsche Post, which has an uncontested bid for the new gTLD but decided it doesn’t want it.
The price tag of the deal was not disclosed.
NCC, which is also one of the two major data escrow providers supporting new gTLD applicants, said in a statement:

Deutsche Post originally obtained the gTLD through ICANN’s new gTLD allocation process during 2013 but has now chosen not to utilise it.
NCC Group will use .trust as the primary vehicle for launching its Artemis internet security service, which aims to create global internet safety through a secure and trusted environment for selected customers.
The Group remains in the contention stage with its application to ICANN for the .secure gTLD. It believes that there will be a benefit in having a number of complementary named gTLDs, all of which offer the same high levels of internet security.

While Artemis has applied for .secure, it’s facing competition from the much richer Amazon.
Its initial hope that Amazon’s bid would be rejected due to the controversy over “closed generics” seems to have been dashed after Amazon was allowed to change its application.
NCC may be characterizing .trust as an “additional” security TLD, but it’s quite possible it will be its “only” one.
Deutsche Post, which as owner of DHL is the world’s largest courier service, has passed Initial Evaluation on .trust but has not yet signed its ICANN contract.
ICANN’s web site still shows Deutsche Post as the applicant for .trust and it’s not clear from NCC’s statement how the transfer would be handled.

ICANN heading to Geneva after all?

ICANN could wind up being based in Geneva as a result of the current post-Snowden internet governance discussions, according to a report in a Swiss newspaper.
Le Temps, citing several anonymous ICANN sources, reported today that an HQ move from Los Angeles to Geneva was a “very likely scenario”.
That’s as an alternative to allowing its functions to be taken over by the International Telecommunications Union, the paper reported.
It’s not the first time a move to Geneva has been touted.
Back in September, DI rubbished — and ICANN denied — claims that the organization had already put the wheels in motion for a move to Switzerland.
It still appears to be unlikely in the short term, and for the same reason: ICANN’s Affirmation of Commitments with the US Department of Commerce requires it to remain a US non-profit corporation.
But the AoC is now open for discussion again.
Barely a month after the Geneva move was first raised as a possibility, Edward Snowden’s revelations about widespread US spying on internet users had led to the Montevideo Declaration, in which ICANN spoke of the need for further “internationalization” of ICANN.
Later last October, ICANN CEO Fadi Chehade called America’s unique role in ICANN’s oversight “just not sustainable“.
Coming this April, governments, standards bodies, industry and others are set to meet in Sao Paolo, Brazil, for early-stage discussions that may eventually lead to the US cutting ICANN loose.
If ICANN does leave the US, Geneva does seem like the most plausible venue for its headquarters. It already has a small office there and has obtained international non-profit status for its local subsidiary.

EU guns for ICANN’s relationship with US

The European Union has made ICANN’s close relationship with the US one of the targets of a new platform on internet governance.
In a new communication on internet governance (pdf), the European Commission said it will “work with all stakeholders” to:

– identify how to globalise the IANA functions, whilst safeguarding the continued stability and security of the domain-name system;
– establish a clear timeline for the globalisation of ICANN, including its Affirmation of Commitments.

The policy is being characterized as being prompted by former NSA contractor Edward Snowden’s revelations about widespread US spying on internet users.
EC vice president Neelie Kroes issued a press release announcing the policy, saying:

Recent revelations of large-scale surveillance have called into question the stewardship of the US when it comes to Internet Governance. So given the US-centric model of Internet Governance currently in place, it is necessary to broker a smooth transition to a more global model while at the same time protecting the underlying values of open multi-stakeholder governance of the Internet.

Despite this, the document does not contain any allegations that link ICANN to spying, or indeed any justification for the logical leap from Snowden to domain names.
The EU position is not dissimilar to ICANN’s own. Last October CEO Fadi Chehade used Snowden as an excuse to talk about putting ICANN’s relationship with the US back in the spotlight.
As I noted at the time, it all looks very opportunistic.
Internationalizing ICANN is of course a noble objective — and one that has been envisaged since ICANN’s very creation 15 years ago — but what would it look like it practice?
I’d be very surprised if what the Commission has in mind isn’t a scenario in which the Commission always gets what it wants, even if other stakeholders disagree with it.
Right now, the Commission is demanding that ICANN rejects applications for .wine and .vin new gTLDs unless applicants agree to new rights protection mechanisms for geographic indicators such as “Champagne”.
That’s something that ICANN’s Governmental Advisory Committee could not reach consensus on, yet the EU wants ICANN to act based on its unilateral (insofar as the EU could be seen as a single entity) advice.
The new EC policy document makes lots of noise about its support for the “multi-stakeholder process”, but with hints that it might not be the “multi-equal-stakeholder process” championed by Chehade.
For example, it states on the one hand:

Those responsible for an inclusive process must make a reasonable effort to reach out to all parties impacted by a given topic, and offer fair and affordable opportunities to participate and contribute to all key stages of decision making, while avoiding capture of the process by any dominant stakeholder or vested interests.

That sounds fair enough, but the document immediately goes on to state:

the fact that a process is claimed to be multistakeholder does not per se guarantee outcomes that are widely seen to be legitimate
…
it should be recognised that different stages of decision making processes each have their own requirements and may involve different sets of stakeholders.
…
Sound multistakeholder processes remain essential for the future governance of the Internet. At the same time, they should not affect the ability of public authorities, deriving their powers and legitimacy from democratic processes, to fulfil their public policy responsibilities where those are compatible with universal human rights. This includes their right to intervene with regulation where required.

With that in mind, what would an “internationalized” IANA look like, if the European Commission gets its way?
Right now, IANA may be contractually tethered to the US Department of Commerce, but in practice Commerce has never refused to delegate a TLD (even when Kroes asked it to delay .xxx).
Compare that to Kroes statement last September that “under no circumstance can we agree having .wine and .vin on the internet, without sufficient safeguards”.
Today’s policy news from the EC looks fine at a high level, but in light of what the EC actually seems to want to achieve in practical terms, it looks more like an attempt at a power grab.

Delegation wait time varies wildly for new gTLDs

New gTLDs get delegated on average 70 days after they sign their ICANN Registry Agreement, but the duration of the wait varies quite a lot by registry, according to DI research.
For the 145 delegated new gTLDs I looked at, the delegation has come 39 to 151 days after contract signing.
After signing an RA, registries have to enter into Pre-Delegation Testing before their strings are handed off to IANA, Verisign and the US Department of Commerce for delegation.
The Applicant Guidebook states that this transition to delegation phase is expected to take approximately two months. On average, ICANN seems to be only slightly missing that target.
The differing wait times could be attributed to any number of reasons. Difficulties during PDT, registry choice, geography and holidays could all see some take longer than others.
Donuts, which is responsible for almost two thirds of the gTLDs I looked at, seems to have refined the process to an art, getting its gTLDs delegated on average 62 days after contract signing.
There are currently 125 gTLDs that have contracts but have not yet been delegated, according to our records.
Here’s the table of delegation wait times, for those interested.
[table id=27 /]

Conflicting gTLD objection decisions to get appeals process?

ICANN seems to be considering an appeals process for new gTLD applicants that feel they’ve been wronged by dubious String Confusion Objection decisions.
But the process might be limited to applicants for .car, .cars and .cam.
In a resolution this Wednesday, ICANN’s New gTLD Program Committee said:

the NGPC is considering potential paths forward to address the perceived inconsistent Expert Determinations from the New gTLD Program String Confusion Objections process, including implementing a review mechanism. The review will be limited to the String Confusion Objection Expert Determinations for .CAR/.CARS and .CAM/.COM.

Why only those strings? I’m guessing it’s because the conflicting decisions would make for extremely confusing contention sets.
There were three SCOs against .cars applications, filed by Google, which has applied for .car. Google won one case but lost the other two.
That would mean that Google’s .car application would be in contention with one of the applicants but not the other two, hardly a fair outcome.
Similarly, Verisign objected to five .cam applications due to their similarity to .com. It won one and lost the other four.
The NGPC resolution calls for the publication, for comment, of a reviews process designed to untangle this mess. It does not appear to have been published yet.
But it seems that whatever ICANN has come up with will not apply to other applicants who feel they’ve been wronged by odd SCO, or other objection, decisions.

ICANN puts .islam and other gTLD bids in limbo

Or should that be Barzakh?
Rather than making the tricky decision on whether to approve .islam and .halal new gTLD applications, ICANN seems to have place both bids into permanent limbo.
It’s also put off calls on applications for .spa, .amazon, .wine and .vin, due to objections from the Governmental Advisory Committee.
On .islam and .halal, ICANN chair Steve Crocker wrote to Turkish applicant Asia Green IT System to say that the New gTLD Program Committee will not address the bids until AGIT has worked out its differences with the Organization for Islamic Cooperation.
He noted that AGIT has expressed a willingness in the past to work with the OIC, but that the OIC has formally decided to object to the two applications. Crocker wrote:

There seems to be a conflict between the commitments made in your letters and the concerns raised in letters to ICANN urging ICANN not to delegate the strings. Given these circumstances, the NGPC will not address the applications further until such time as the noted conflicts have been resolved.

This is not a formal rejection of the applications, but ICANN seems to have placed them in a limbo that will only be resolved when AGIT withdraws from the program or secures OIC support.
There’s also delaying treatment for .wine and .vin, which have become the subject of a raging row between Europe on the one hand and the US, Canada and Australia on the other.
Europe wants these two wine-related gTLDs to be subject to strict rules on who can register domains containing geographic indicators, such as “Champagne”. The others don’t.
ICANN in response has commissioned a third-party study on GIs, which it expects to be able to consider at its Singapore public meeting next month. Again, a decision has been avoided.
The two applicants for .spa don’t have any closure either.
Spa is the name of a town in Belgium, whereas the two applicants — Donuts and Asia Spa and Wellness Promotion Council — intend to use the string in its English dictionary sense.
There was a bit of a scandal during the Buenos Aires meeting last November when it was suggested that Belgium was using its position on the GAC to shake down the applicants for money.
Belgium denied this, saying the city of Spa didn’t stand to gain financially from the deals that it was trying to make with applicants. Some money would go to “the community served by .spa”, Belgium said, without elaboration.
ICANN has now decided to put .spa on hold, but wants to know more about these talks:

ICANN will not enter into registry agreements with applicants for the identified string at this time. The NGPC notes concern about concluding the discussions with the applicants and will request the GAC to (1) provide a timeline for final consideration of the string, and (2) identify the “interested parties” noted in the GAC advice.

Finally, ICANN has yet again delayed making a call on Amazon’s application for .amazon — until at least Singapore — out of an abundance of legal caution.
The GAC recommended that ICANN should reject .amazon because a few Latin American states claim ownership of the string due to it being the same as the Amazon region they share.
Amazon and others claim that it would be in violation of international law that prevents governments interfering with the use of trademarks for the GAC to block .amazon.
ICANN’s NGPC said:

ICANN has commissioned an independent, third-party expert to provide additional analysis on the specific issues of application of law at issue, which may focus on legal norms or treaty conventions relied on by Amazon or governments. The analysis is expected to be completed in time for the ICANN Singapore meeting so that the NGPC can consider it in Singapore.

In my view, the .amazon issue is the one most likely to bring a lawsuit to ICANN’s doorstep, so the organization clearly wants to get its legal position straight before making a call one way or the other.
All these decisions were made on Wednesday. You can read the NGPC’s resolution here and the important details here.

ICANN approves reworked GAC advice over US concerns

No sooner had we reported on the US government’s complaint about ICANN’s reinterpretation of GAC advice on new gTLDs than it emerged that ICANN has already approved the plan.
The ICANN board’s New gTLD Program Committee on Wednesday approved a resolution on how to implement the so-called Category 1 advice the Governmental Advisory Committee came up with in Beijing last April. The resolution was published today.
The Category 1 advice calls for stronger regulation — stuff like forcing registrants to provide industry credentials at point of sale — in scores of new gTLDs the GAC considers particularly sensitive.
Despite US Department of Commerce assistant secretary Larry Strickling calling for more talks after ICANN substantially diluted some of the GAC’s Beijing communique, the NGPC has now formally approved its watered-down action plan.
Under the plan, registrants in gTLDs such as .lawyer and .doctor will have to “represent” that they are credentialed professionals in those verticals when they register a domain.
That’s as opposed to actually providing those credentials at point of registration, which, as Strickling reiterated in his letter, is what the GAC asked for in its Beijing communique.
The full list of eight approved “safeguards” (as interpreted from GAC advice by ICANN) along with the list of the gTLDs that they will apply to, can be found in this PDF.

US unhappy with ICANN, urges more delay to many new gTLDs

The US government is not pleased with ICANN’s rather liberal interpretation of Governmental Advisory Committee advice on new gTLDs and wants more talks about “safeguards”.
Not only that, but it wants to start talking to ICANN about extending safeguards applicable to new gTLDs to old gTLDs, presumably including the likes of .com, too.
A letter to ICANN from Department of Commerce assistant secretary Larry Strickling, obtained by DI today, calls for more talks before ICANN finalizes its handling of the GAC’s Beijing communique.
Strickling notes, as DI has previously, that ICANN softened the meaning of the advice in order to smooth its implementation.

as can be the case when translating GAC Advice to contractual provisions, the NGPC [the ICANN board’s New gTLD Program Committee] made adjustments to the GAC Advice that the United States believes could cause enforcement problems and as such merits further discussion. The National Telecommunications and Information Administration (NTIA), on behalf of the United States, is planning to raise these concerns for discussion at the March GAC meeting in Singapore and requests that ICANN take this fact into account before moving forward with applications for strings impacted by the relevant portions of GAC advice

The letter (pdf) was sent February 4, just a day before the NGPC held a meeting — the results of which we do not yet know — that had the GAC Advice on its agenda.
The New gTLD Applicants Group had urged the NGPC to finally put the GAC Advice to rest, highlighting the “heavy burden that the delay in the implementation of GAC Category 1 Advice has imposed upon affected applicants” in a letter last week.
The Category 1 advice, you may recall, comprised eight “safeguards” mandating policies such as industry engagement and registrant authentication, applicable to at least 386 gTLD applications.
Back in November, ICANN announced how it planned to handle this advice, but changed its meaning to make it more palatable to ICANN and applicants.
Those changes are what Strickling is not happy with.
He’s particularly unhappy with changes made to the GAC’s demand for many gTLDs to be restricted to only card-carrying members of the industries the strings seem to represent.
The GAC said in Beijing:

At the time of registration, the registry operator must verify and validate the registrants’ authorisations, charters, licenses and/or other related credentials for participation in that sector.

In other words, you’d have to provide your doctor license before you could register a .doctor domain.
But ICANN proposed to implement it like this:

Registry operators will include a provision in their Registry-Registrar Agreements that requires Registrars to include in their Registration Agreements a provision requiring a representation that the Registrant possesses any necessary authorisations, charters, licenses and/or other related credentials for participation in the sector associated with the Registry TLD string.

The doctor under this policy would only require the doctor to check a box confirming she’s a doctor. As Strickling said:

The NGPC has changed the GAC-coveyed concept of “verification and validation” to “representation”

Requirements for registries to mandate adherence to government regulations on the protection of financial and healthcare data are also his targets for further discussion.
What all this boils down to is that, assuming ICANN paid heed to Strickling’s letter, it seems unlikely that NTAG will get closure it so desperately wants until the Singapore meeting in late March — a year after the original Beijing communique — at the earliest.
In other words, lots of new gTLD applicants are probably going to be in limbo for a bit longer yet.
But Strickling also has another bombshell to drop in the final sentence of the letter, writing:

In addition, we will recommend that cross community discussion begin in earnest on how the safeguards that are being applied to new gTLDs can be applied to existing gTLDs.

So it seems the GAC is likely to start pressing to retroactively apply its new gTLDs advice to legacy gTLDs too.
Registrant verification in .com? Stricter Whois checks and enforcement? That conversation has now started, it seems.

EU body tells ICANN that 2013 RAA really is illegal

A European Union data protection body has told ICANN for a second time — after being snubbed the first — that parts of the 2013 Registrar Accreditation Agreement are in conflict with EU law.
The Article 29 Data Protection Working Party, which is made up of the data protection commissioners in all 28 EU member states, reiterated its claim in a letter (pdf) sent earlier this month.
In the letter, the Working Party takes issue with the part of the RAA that requires registrars to keep hold of customers’ Whois data for two years after their registrations expire. It says:

The Working Party’s objection to the Data Retention Requirement in the 2013 RAA arises because the requirement is not compatible with Article 6(e) of the European Data Protection Directive 95/46/EC which states that personal data must be:
“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected”
The 2013 RAA fails to specify a legitimate purpose which is compatible with the purpose for which the data was collected, for the retention of personal data of a period of two years after the life of a domain registration or six months from the relevant transaction respectively.

Under ICANN practice, any registrar may request an opt out of the RAA data retention clauses if they can present a legal opinion to the effect that to comply would be in violation of local laws.
The Working Party told ICANN the same thing in July last year, clearly under the impression that its statement would create a blanket opinion covering all EU-based registrars.
But a week later ICANN VP Cyrus Namazi told ICANN’s Governmental Advisory Committee that the Working Party was “not a legal authority” as far as ICANN is concerned.
The Working Party is clearly a bit miffed at the snub, telling ICANN this month:

The Working Party regrets that ICANN does not acknowledge our correspondence as written guidance to support the Waiver application of a Registrar operating in Europe.
…
the Working Party would request that ICANN accepts the Working Party’s position as appropriate written guidance which can accompany a Registrar’s Data Retention Waiver Request.

It points out that the data protection commissioners of all 28 member states have confirmed that the letter “reflects the legal position in their member state”.
ICANN has so far processed one waiver request, made by the French registrar OVH, as we reported earlier this week.
Weirdly, the written legal opinion used to support the OVH request is a three-page missive by Blandine Poidevin of the French law firm Jurisexpert, which cites the original Working Party letter heavily.
It also cites letters from CNIL, the French data protection authority, which seem to merely confirm the opinion of the Working Party (of which it is of course a member).
EU registrars seem to be in a position here where in order to have the Working Party’s letter taken seriously by ICANN, they have to pay a high street lawyer to endorse it.