ICANN helps bust Russian child porn ring

ICANN recently helped break up a Russian child pornography ring.
That’s according to a remarkable anecdote from CEO Fadi Chehade, speaking during a session at the Internet Governance Forum in Bali, Indonesia today.
The “investigative effort” took “months” and seems to have entailed ICANN staff sifting through company records and liaising with law enforcement and domain name companies on three continents.
Here’s the anecdote in full:

We participated in a global effort to break down a child pornography ring.
You think: what is ICANN doing with a child pornography ring? Well, simple answer: where does child pornography get put up? On a web site. Where’s that web site hosted? Well, probably at some hosting company that was given the web site name by a registrar that is hopefully a registrar or reseller in the ICANN network.
We have a public responsibility to help with that.
We have some of the smartest people in the world in that space.
It took us months to nail the child pornography ring.
It took us through LA to Panama. We had to work with the attorney general of Panama to find the roots of that company. One of our team members who speaks Spanish went into public company records until he found, connected — these are investigative efforts that we do with law enforcement — then we brought in the registrars, the registries… and it turned out that this ring was actually in Russia and then we had to involve the Russian authorities.
ICANN does all of this work quietly, in the background, for the public interest.

Wow.
At first I wasn’t sure what to make of this. On the one hand: this obviously excellent news for abused kids and ICANN should be congratulated for whatever role it took in bringing the perpetrators to justice.
On the other hand: is it really ICANN’s job to take a leading role in covert criminal investigations? Why are ICANN staffers needed to trawl through Panamanian company records? Isn’t this what the police are for?
ICANN is, after all, a technical coordination body that repeatedly professes to not want to involve itself in “content” issues.
Session moderator Bertrand de La Chappelle, currently serving out his last month on the ICANN board of directors, addressed this apparent disconnect directly, asking Chehade to clarify that ICANN is not trying to expand its role.
In response, Chehade seemed to characterize ICANN as something of an ad hoc coordinator in these kinds of circumstances:

There are many topics that there is no home for them to be addressed, so ICANN gets the pressure. People come to us and say: “Well you solve this, aren’t you running the internet?”
We are not running the internet. We do names and numbers. We’re a technical community, that’s what we do.
But the pressure is mounting on us. So it’s part of our goal to address the larger issues that we’re not part of, is to frankly keep us focused on our remit. In fact, ICANN should become smaller, not bigger. It should focus on what it does. The only area we should get bigger in is involving more people so we can truly say we’re legitimate and inclusive.
The bigger issues and the other issues of content and how the internet is used and who does what, we should be very much in the background. If there is a legal issue, if we are approached legally by an edict of a court or… if it’s a process we have to respond to it.
We don’t want to be instigating or participating or leading… we don’t, we really don’t.

A desire to make ICANN smaller doesn’t seem to tally with the rapid expansion of its global footprint of hubs and branch offices and the planned doubling of its staff count.
Indeed, the very next person to speak on today’s panel was Chehade’s senior advisor and head of communications Sally Costerton, who talked about her team doubling in size this year.
I don’t personally subscribe to the idea that ICANN should be shrinking — too much is being asked of it, even if it does stick to its original remit — but I’m also not convinced that it’s the right place to be be carrying out criminal investigations. That’s what the cops are for.

On day one, Donuts in breach of new gTLD contract

Ooops! Donuts accidentally broke the terms of its first new gTLD Registry Agreement last night, just hours after its first string, .游戏, was delegated to the DNS root.
If you’ve been following the name collisions debate closely, you’ll recall that all new gTLD registries are banned from activating any second-level domains for 120 days after they sign their contracts:

Registry Operator shall not activate any names in the DNS zone for the Registry TLD (except for “NIC”) until at least 120 calendar days after the effective date of this agreement.

For the first four gTLDs to go live, that clock doesn’t stop ticking until November 12.
And yet, last night, Donuts activated donuts.游戏, apparently in violation of its new contractual obligations with ICANN.
The name was live and resolving for at least an hour. Donuts pulled it after we asked a company executive whether it might be a breach of contract.
I don’t think it’s a big deal, and I doubt ICANN needs to take any action.
Chalk it down to the understandable ebullience that naturally accompanies finally getting delegated to the root after such a long and painful evaluation process.
The 120-day rule was also a late amendment to Specification 6 of the RA, added by ICANN just seven days before .游戏 was delegated and over three months after Donuts signed the original contract.
It’s designed to address the potential for collisions between second-level domains in new gTLDs and names used on internal networks that already have working SSL certificates.
The no-activation window was chosen to match the 120-day period that the CA/Browser Forum gives its certificate authority members to revoke clashing certificates.
It seems unlikely donuts.游戏 will have caused any security issues during the brief period it was alive.

First new gTLDs delegated (really!)

ICANN has delegated the first new gTLDs to the DNS root.
All four of the first batch of internationalized domain names appear to be present right now in root zone file:

• .xn--ngbc5azd (شبكة.) — means “.web” in Arabic. Operated by dotShabaka Registry.
• .xn--unup4y (.游戏) — means “.games” in Chinese. Operated by Donuts.
• .xn--80aswg (.сайт) — means “.site” in several Cyrillic languages. Operated by CORE Association.
• .xn--80asehdb (.онлайн) — means “.online” in several Cyrillic languages. Also operated by CORE Association.

Infuriatingly, and appropriately given the glitches that have plagued the program for the last 18 months, the news seems to have been announced unexpectedly by ICANN VP Christine Willett during a webinar that most listeners had been kicked out of due to a technical problem.
The race is now one to see which of the four will be the first to go live with a resolving web site.

Directi’s Radix wins .website gTLD auction

Directi-affiliated TLD registry Radix, has won the private auction for the .website gTLD, according to Radix.
The company beat rival portfolio applicants Donuts and Top Level Domain Holdings to the string, in an auction that was managed by Innovative Auctions, likely one of several going on this week.
There’s no outstanding Governmental Advisory Committee advice or objections to the Radix application, so its path to contracting and eventual delegation should be relatively uncontroversial now.
The price was undisclosed, Innovative’s standard terms.
Directi is in the process of being acquired by Endurance International, owner of Domain.com, which promised Radix up to $62 million to help with its gTLD auctions.

First new gTLDs to go live “in the next few hours”

The first four new gTLDs are expected to go live in the next few hours.
That’s according to the registries themselves, and reports out of the Internet Governance Forum in Bali, where ICANN division president Akram Atallah was speaking on a panel earlier today.
The gTLDs are: .сайт (Russian “.site”) and .онлайн (Russian “.online”) from CORE Association, شبكة. (Arabic “.web”) from dotShabaka Registry and .游戏 (Chinese “.games”) from Donuts.
By “go live” I mean of course that the ASCII versions of these strings (for example, .xn--ngbc5azd for شبكة.) will be entered into the DNS root.
It may take a short while for the registries to activate second-level domains (such as nic.) under their new TLDs, and nothing will actually go on sale for weeks.
They’re all of course internationalized domain names, given ICANN’s decision almost a year ago to prioritize IDNs at all stages of the evaluation and delegation process.
All four received their block-lists of “collision risk” second-level domains on Friday and elected to implement the blocks to get to delegation faster.
The three registries signed their contracts on stage at the ICANN meeting in Durban July 15.
This is a pretty big day for ICANN and its community. After many years and countless arguments and delays, new gTLDs are actually about to go live!

US raises ITU bogeyman as Chehade pushes for exit

ICANN CEO Fadi Chehade and a US ambassador today both talked up the multistakeholder model as a cure to concerns about PRISM and related surveillance programs.
But the US warned against using the spying scandal to push internet governance into the hands of “centralized intergovernmental control”, which I’m taking to mean the International Telecommunications Union.
Chehade and Ambassador Danny Sepulveda, US coordinator for international communications and information policy, were speaking at the opening ceremony of the Internet Governance Forum in Bali, Indonesia.
Chehade went first, telling the audience that ICANN plans to set up legal structures in other countries in addition to the US, following on from the three-hub strategy he put in place earlier this year.
It’s part of his effort to internationalize ICANN, he said.
“While we are a California corporation today there is nothing that precludes us from being also, in addition to that, a legal organization in other places, and we intend to do that in order to make ICANN a more international organization,” he said.
He went on to say something that could be interpreted as his intention to get rid of or renegotiate the Affirmation of Commitments with the US government:

We also believe our commitment to the world should be indeed to the world and not to any particular stakeholder, and we will work towards that and change that.

Minutes later, Sepulveda took the stage to more or less agree with Chehade — at least at a high level — whilst simultaneously warning about too much governmental control over the internet.
He said:

The internet today is no more any one country’s than any others. It is no more any one stakeholder’s than any others.
…
We support an open dialogue on the modernization and evolution of the multistakeholder system that enables the operation of the global internet. Bottom-up, inclusive, cooperative efforts to empower users and enable innovation, free from arbitrary government control, is what the US has been pulling for all along.

He directly addressed the Montevideo declaration, which I wrote about earlier today, which he said was a call “to modernize the internet’s governing system and make it more inclusive”.
The declaration, he said, “should be seen as an opportunity to seek that broad inclusion and for organizing multistakeholder responses to outstanding internet issues”.
“We must work together with these organizations, in good faith, on these important issues,” he said.
“We should however guard against recent arguments for centralized intergovernmental control of the internet that have used recent news stories about intelligence programs for their justification,” he said.
This seems to be a reference to the ITU, the standard US bogeyman when it comes to control over ICANN.
Watch Chehade’s speech here, then fast forward to 1:25 to hear Sepulveda’s response.

ICANN using PRISM as excuse to break from the US

ICANN CEO Fadi Chehade, with backing from government leaders, is using the recent revelations about the PRISM mass surveillance program to try to speed up ICANN’s split from the US.
Speaking to an American radio station, Chehade said yesterday:

I think the current role the United States has with ICANN was always envisaged to change. The timing of that was the question — not if, it was just when. I think now it is clear that we need to talk about changing that role and evolving it to become a more global role where all stakeholders, not just governments, have an equal footing in the governance of the Internet. So the timing has been put into clear focus right now, that is what’s happening.

He was speaking from the latest Internet Governance Forum in Bali, where today he reiterated his calls for “all governments and all stakeholders” to work together “on equal footing”.
Similar rhetoric has been dribbling out of ICANN for the last couple of weeks.
Earlier this month, Chehade met in Montevideo, Uruguay, with the leaders of the five Regional Internet Registries, the World Wide Web Consortium, the IETF, ISOC and the IAB to discuss “current issues affecting the future of the Internet.”
They came out with the Montevideo Declaration, which states in part:

They reinforced the importance of globally coherent Internet operations, and warned against Internet fragmentation at a national level. They expressed strong concern over the undermining of the trust and confidence of Internet users globally due to recent revelations of pervasive monitoring and surveillance.
They identified the need for ongoing effort to address Internet Governance challenges, and agreed to catalyze community-wide efforts towards the evolution of global multistakeholder Internet cooperation.
They called for accelerating the globalization of ICANN and IANA functions, towards an environment in which all stakeholders, including all governments, participate on an equal footing.

The first and third paragraphs, taken together, suggested that ICANN was yet again ready to start talking about casting off the US government’s special oversight role, and that it would use Edward Snowden’s PRISM revelations as a way back into the conversation.
Milton Mueller of the Internet Governance Project first blogged about this, talking about ICANN “abandoning the US government”, prompting much media speculation about America’s future role in internet governance.
Chehade has been on the road, it seems, since Montevideo, first stopping off in Brazil to lend his encouragement to President Dilma Rousseff’s proposal for an April 2014 conference to discuss internet governance in light of the Snowden revelations.
Rousseff herself was targeted by the NSA and has become one of the most vocal government leaders in criticizing the US spy programs.
Lately it seems Chehade has been in India, where he told the Economic Times:

When any government decides to use a resource like the internet in ways that erodes the public trust, it is very regrettable. I feel like I’m the public trustee of the internet. All of us should be equal stewards of the public trust.
So when any one takes it away, it distresses all of us. It is not just by the recent revelations about PRISM, but there are other revelations that are coming out as well. Countries are employing millions of people to track the movements of their fellow citizens.
…
I would argue that the recent developments have emboldened people to make sure all stakeholders are participating on equal footing, including all governments.

All of this posturing raises a few basic questions, the first of which is: what does PRISM have to do with ICANN?
The answer, it seems, is “nothing”.
The PRISM revelations have implicated the likes of Google, Microsoft and Facebook — all apparently cooperating with the NSA’s mass gathering of data on civilian internet users — but no domain name players.
If the Guardian were to report tomorrow that major infrastructure players such as Verisign or Go Daddy were also involved, I would not be in the least surprised, but so far I have yet to see a connection between the domain name business and NSA spying.
In that light, if ICANN were to sever its special relationship with the US, there would be presumably no impact whatsoever on PRISM or any other surveillance program.
Chehade’s current campaign therefore seems to be politically opportunistic at best and a distraction from the underlying problem of US human rights violations at worst.
But what is meant when people speak of “splitting from the US” anyway?
It seems to me there are three important areas where the US government has undue power over ICANN: jurisdiction, the Affirmation of Commitments and the IANA contract.
ICANN is based in California and subject to US federal law. While that continues to be the case, it will always be subject to the possibility of having its work thwarted by a US court or spurious lawsuit.
It also hampers ICANN’s ability to do business with some nations unencumbered by US trade embargoes, though ICANN is usually able to secure the requisite licenses when it needs to.
It’s also always going to be at risk of being hauled over the coals by Congress every couple of years, due to lobbying by US special interest groups, which interferes with its credibility as a global organization.
ICANN has already started setting up shop in other parts of the world. New “hub” offices in Istanbul and Singapore are being characterized as being on equal footing with the LA headquarters.
But that characterization seems disingenuous.
The Affirmation of Commitments, signed by the US Department of Commerce and former ICANN CEO Rod Beckstrom in 2009 and largely negotiated under his predecessor Paul Twomey, is one of ICANN’s principal governing documents.
One of ICANN’s commitments under the AoC is to “remain a not for profit corporation, headquartered in the United States of America with offices around the world to meet the needs of a global community”.
Being US-based is baked into ICANN’s governance. If the US has to go, the AoC has to go, which means all the other accountability and review obligations in the AoC also have to go.
The third prong of US control is the IANA contract and the trilateral relationship between ICANN, Verisign and the US National Telecommunications and Information Administration.
The NTIA, essentially, controls the DNS root. Verisign actually manages the boxes it runs on, but it only makes changes — such as adding new gTLDs or redelegating ccTLDs to new registries — with NTIA authorization. That authorization, in turn, is basically a rubber stamp on an IANA/ICANN recommendation.
To the best of my knowledge, NTIA has never abused its authority to overrule an ICANN determination, or pressured ICANN into making a US-friendly recommendation.
But the process by which ICANN recommends changes to the root is pretty opaque.
I have to wonder why, for example, it took two years for Iran’s IDN ccTLD to get approved by ICANN’s board. Only the lack of any outcry from Iran suggests to me that the delay was benign.
When ICANN was founded in 1998, the original plan was for control of the root to enter ICANN’s hands before the end of the Clinton administration (ie 2000), but over the years that plan has been abandoned by the US.
The IANA contract was put up for renewal in 2011 — with a strict provision that only US-based organizations were able to apply — and then-CEO Beckstrom also pushed for more ICANN independence.
In 2011, Beckstrom was making many of the same noises Chehade is today, saying that the IANA function should be a looser “cooperative agreement” rather than a US procurement contract.
In March that year, calling for such an agreement he said at ICANN’s San Francisco meeting:

When all voices are heard, no single voice can dominate an organization – not even governments. Not even the government that facilitated its creation.

The NTIA’s response was, basically, to give Beckstrom the finger.
It said in June 2011 that it “does not have the legal authority” to do what was asked of it, then produced an IANA contract that gave itself and governments in general much greater powers to micromanage ICANN.
After delays, rejections and giving ICANN the general runaround, the NTIA finally signed off on its new IANA contract in July last year, on the final day of Beckstrom’s tenure as CEO.
It lasts until September 30, 2015, with two two-year renewals options.
If Chehade wants to unshackle ICANN from the US, the IANA contract will have to be a cornerstone of that project.
But NTIA’s past performance makes that possibility seem unlikely, unless Chehade can rally enough political pressure from the likes of Brazil and India to change his own government’s mind.
He faces an uphill battle, in other words, and at the end of the day whether breaking from the US government would be a good thing or not depends entirely on what, if anything, replaces it.
Whatever happens, let’s not pretend that ICANN’s independence has anything to do with PRISM, and let’s not allow ICANN to distract us from the wholesale violations of our rights that the US government is perpetrating.

Live new gTLDs this month? First four pass to delegation

New gTLDs are on the home stretch, after ICANN sent the first four applications to the final delegation stage of the process.
The four are: .сайт (Russian “.site”) and .онлайн (Russian “.online”) from Core Association, شبكة. (Arabic “.web”) from dotShabaka Registry and .游戏 (Chinese “.games”) from Donuts.
These were also the first four to sign their registry contracts with ICANN — over three months ago — and the first to be given their name collisions mitigation plan, just a few days ago.
Proceeding to delegation means the applications are now in the hands of IANA, the ICANN department with responsibility over changes to the DNS root system.
IANA has its own set of procedures to follow before delegating, which have historically taken a couple of weeks to process. If I recall correctly, .xxx was with IANA for about 10 days before it went live.
It seems possible that the first new gTLDs could be live this month, meaning the first sunrise periods could kick off in early December, with general availability following a month later.
However, the Christmas and New Year holiday period may wind up forcing some registrars to stagger their dates in order to benefit from the best publicity window when they finally go on sale.

First collision block-lists out now. How painful will they be for new gTLDs?

ICANN has published the name collision block-lists for the first four new gTLDs, and they making pretty interesting reading.
The four registries in question will be required to block between 104 and 680 unique second-level domains from their gTLDs if they want to use the fastest path to delegation on offer.
The four gTLDs with lists published this morning are: .сайт (Russian “.site”), .онлайн (Russian “.online”), شبكة. (Arabic “.web”) and .游戏 (Chinese “.games”).
These were the first four new gTLDs with signed Registry Agreements. ICANN seems to be following the order contracts were signed, rather than the official prioritization number.
So what’s on the lists?
Gibberish
The first thing to note is that, as expected, ICANN has helpfully removed invalid strings (such as those with underscores) and gibberish Google Chrome strings from the lists, greatly reducing their size.
The block-lists are based on Day In The Life Of The Internet data, which recorded DNS root queries for applied-for gTLDs over 48-hour periods between 2006 and 2013.
According to ICANN, “a significant proportion” of the DITL queries were for the nonsense 10-character strings that Chrome generates and sometimes accidentally sends to the public DNS.
Because these “appear to present minimal risk if filtered from the block lists”, ICANN has made an effort to automatically remove as many as possible, while acknowledging it may not have caught them all. The human eye is good at spotting meaningless strings, software is not so adept.
All four lists still contain plenty of gibberish strings, according to this human eye, but mostly they’re not of 10 characters in length.
IDNs
All four lists published today are for non-Latin domain names and are presumably expecting their registries to be mostly populated with IDN.IDN domain names.
As such, the impact of their mostly Latin block-lists may be even smaller than it first appears.
For example, if we look at the list for .сайт, which has 680 strings to block, we discover that only 80 of them are IDNs (beginning with xn--). I assume they’re all, like the gTLD, in Cyrillic script.
I haven’t decoded all of these strings from Punycode and translated them from Russian, but the fact is there’s only 80 of them, which may not be unduly punitive on CORE Association’s launch plan.
At the other end of the spectrum, Donuts will only have to block 13 IDN strings from its .游戏 (Chinese .games) gTLD, and the ASCII strings on its list are mostly numeric or gibberish.
There’s very probably some potentially valuable generic strings on these lists, of course, which could impact the landrush purse, but it’s beyond this monoglot’s expertise to pick them out.
Trademarks
A small number of Latin-script brands appear on all four lists.
Donuts will have to block nokia.游戏, htc.游戏 and ipad.游戏 in its Chinese “.games”, for example. CORE will have to block iphone.сайт and brazzersnetwork.онлайн. DotShabaka Registry will have to block شبكة.redbull.
The impact of this on the registries could be minimal — a few fewer sunrise sales, assuming the brand owner intended to defensively register.
If the blocked brand was a potential launch partner it could be much more annoying and even a launch-delaying factor. It’s not yet clear how registries and brand owners will be able to get these names unblocked.
Bear in mind that registries are not allowed to activate these domains in any sense for any use — they must continue to return NXDOMAIN error responses as they do today.
I’m sure ipad.游戏 (“ipad.games”) could have some value to Apple — and to Donuts, in the unlikely event it managed to persuade Apple to be an anchor tenant — but it’s no longer available.
ICANN will deliver full mitigation plans for each gTLD, which may often include releasing blocked names to their ‘rightful’ owner, but that’s not expected for some months.
Generic terms
A number of generic dictionary terms are getting blocked, which may prove irksome for those registries with long lists. For example, CORE will have to block photo.сайт and forum.сайт.
So far, .онлайн has by far the longest list of ASCII generics to block — stuff like “football”, “drinks”, “poker” and “sex”. Even weirdness like “herpesdating” and “musclefood”.
As it’s an IDN, this might not be too painful, but once ICANN starts publishing lists for Latin gTLDs we might start seeing some serious impact on registries’ ability to sell and market premium domains.
Shurely shome mishtake
There are a few strings on these lists that are just weird, or are likely to prove annoying to registries.
All four of these gTLDs are going to have to block “www” at the second level, for example, which could impact their registry marketing — www.tld is regularly used by TLD registries.
It is going to be really problematic if “www” shows up on the block-lists for dot-brand registries — many applicants say “www.” is likely to be the default landing page for their dot-brand.
The only string that ICANN says it won’t put on any block-list is “nic”, which was once the standard second-level for every TLD’s registry web site but doesn’t really have mass recognition nowadays.
The block-lists also include two-letter strings, most of which correspond to ccTLDs and all of which are already banned by the base Registry Agreement for precisely that reason.
There’s no reason for these two-letter names to be on the lists, but I don’t see their presence causing any major additional heartaches for registries.
So is this good news or what?
As the four block-lists to be released so far are for IDN gTLDs, and because I don’t speak Chinese, Arabic or Russian, it’s a difficult call today to say how painful this is going to be.
There are plenty of reasons to be worried if you’re a new gTLD applicant, certainly.
Premium names will be taken out of play.
You may lose possible anchor tenants.
Your planned registry-use domain names may be banned.
If you’re a dot-brand, you’d better start thinking of alternatives to “www.”.
But the block-lists are expected to be temporary, pending permanent mitigation, and they’re so far quite small in terms of meaningful strings, so on balance I’d say so far it’s not looking too bad.
On the other hand, nothing on the published lists jumps out at me like a massive security risk, so the whole exercise might be completely pointless and futile anyway.

Donuts and Uniregistry sign more new gTLD contracts

ICANN has signed eight more Registry Agreements with new gTLD applicants, six of them with Donuts.
Donuts’ newly contracted gTLDs are .photos, .recipes, .limo, .domains, .coffee and .viajes (.travel in Spanish).
Uniregistry, meanwhile, signed an RA for .gift and Luxury Partners signed for .luxury.
As you might expect from these portfolio applicants, they’re all expected to be open, unrestricted registries.