Amazon snubs ICANN auction to win .coupon privately

Amazon has won the new gTLD .coupon, after Minds + Machines withdrew its application this week.
I understand that the two-way contention set was settled privately via a third party intermediary, possibly via some kind of auction, with M+M ultimately being paid off to withdraw its bid.
.coupon was the only ICANN-managed “auction of last resort” scheduled for July, following the $600,000 sale of .信息 last week.
The next batch of ICANN auctions is now not due to happen until August, unless of course ICANN rejigs its schedule in light of the .coupon settlement.
It’s not clear why Amazon has suddenly decided it prefers the idea of a private commercial settlement after all, but it appears to be good news for M+M, which will see the majority of the cash.
However, it could be related to the fact that .coupon, and dozens of other Amazon new gTLD applications, recently made the switch from being “closed generics” to more inclusive proposals.
Amazon had originally intended that itself and its subsidiaries would be the “only eligible registrants” for .coupon, but in March it changed the application, among many others.
Now, Amazon talks in vague terms about .coupon names being available to “eligible trusted third parties”, a term that doesn’t seem ready to define before the TLDs are actually delegated.
It seems to me, from Amazon’s revised applications, that .coupon and its other gTLDs will be locked down tight enough that they could wind up being effectively closed generics after all.
When Amazon publishes its first eligibility requirements document with ICANN, I expect members of the Governmental Advisory Committee will be watching closely.

.hotel avoids auction with CPE win

A new gTLD applicant backed by the hotel industry has won a Community Priority Evaluation, meaning it gets to automatically win the .hotel contention set without going to auction.
If the decision stands, no fewer than six rival applicants for the string — including the likes of Donuts, Radix, Famous Four and Minds + Machines — are going to have to withdraw their applications.
It’s a bit of a shocker.
The CPE winner is HOTEL Top-Level-Domain, which scored 15 out of 16 available points in the CPE. The minimum required to vanquish all foes is 14 points.
The company will have spent a fair bit of cash fighting the CPE, but nothing compared to the millions of dollars an auction for .hotel would be likely to fetch.
Crucially, where HOTEL prevailed was on the “Nexus” criterion — demonstrating a link between the string and the community supporting the application — where four points are available.
In the first four CPE results to come through, back in March, each applicant scored a 0 on Nexus and none scored more than 11 points overall.
Dot Registry, which failed four CPEs (.inc, .llc, .corp and .llp) this week, also repeatedly flunked on this count.
HOTEL, however, scored a 3.
Rival applicants such as Donuts and M+M had argued that HOTEL’s stated community failed to take into account smaller hoteliers, such as bed and breakfast owners.
But the CPE panelist decided that the application did not “substantially overreach”:

The string nexus closely describes the community, without overreaching substantially beyond the community. The string identifies the name of the core community members (i.e. hotels and associations representing hotels). However, the community also includes some entities that are related to hotels, such as hotel marketing associations that represent hotels and hotel chains and which may not be automatically associated with the gTLD. However, these entities are considered to comprise only a small part of the community. Therefore, the string identifies the community, but does not over-reach substantially beyond the community, as the general public will generally associate the string with the community as defined by the applicant.

There’s no formal appeals mechanism for CPE, but rival applicants could try their luck with more general ICANN procedures such as Requests for Reconsideration.
HOTEL Top-Level-Domain is a Luxembourg-based entity, founded in 2008 to apply for the gTLD, backed by about a dozen international hotelier associations, including the International Hotel and Restaurant Association.
The IHRA counts 50 major hotel chain brands among its members and claims to be officially recognized by the UN for its lobbying work on behalf of the hospitality industry.
HOTEL intends to keep the .hotel gTLD restricted “initially” to only hotels as defined in the international standard ISO 18513.
Registrants will be verified against hotel industry databases. This will happen post-registration, but before the domain name can be activated in the DNS.
In other words, unless you’re a member of the hotel industry, you won’t be getting to use a .hotel domain name. Domainers are apparently not wanted.
All .hotel names will also be checked a year from registration to ensure that they have a web site displaying relevant content. Redirection to other TLDs may be allowed.
I was so convinced that the CPE was designed in such a way that it would be failed by all the applicants which had applied for it, I bet $50 (to go to an applicant-nominated charity) that none would.
If HOTEL wants to let me know which charity they want the $50 to go to, I’ll get it donated forthwith. I’m just glad I didn’t offer to eat my underwear.

Three more dot-brands dumped

Two companies have yanked three bids for dot-brand new gTLDs this week.
The German financial advisor Allfinanz Deutsche Vermögensberatung withdrew its applications for .allfinanzberatung and .allfinanzberater, which mean Allfinanz “advice” and “advisers”.
As well as being a bit of a mouthful, they both appear to be unnecessary given that the company also applied for .allfinanz by itself. That application has passed evaluation and is still active.
Meanwhile, in Finland, one of the world’s biggest elevator/escalator manufacturers, KONE, has withdrawn its equally unfathomable application for .kone.
Roughly 55 dot-brand applications have been withdrawn to date. Hundreds remain.

Afilias loses $600,000 auction for Chinese “.info”

The results of the first “auction of last resort” in the new gTLD program are in, and it’s a bit of a head-scratcher.
Afilias lost out to rival applicant Beijing Tele-info Network Technology in the ICANN-backed auction for .信息 which means “info” or “information” in Chinese.
The winning bid was $600,000, ICANN said.
That money goes into a special ICANN fund, which will be put to some kind of unspecified purpose (to be determined by the ICANN community) at a later date.
It seems like quite a low price. Given what little we know about new gTLD auctions conducted privately, over a million dollars seems to be pretty standard for a gTLD.
It also strikes me as odd that Afilias wasn’t willing to shell out over $600,000 for a gTLD that could take a localized version of its existing .info brand into the world’s largest market.
It’s the only contention set to be settled by ICANN auction so far. The next will take place July 9, and will see Minds + Machines take on Amazon for .coupon.
The third, which will see 22 strings hit the block, will take place August 6.

RADAR to be down at least two weeks after hack

ICANN expects its RADAR registrar database to be offline for “at least two weeks” following the discovery of a security vulnerability that exposed users’ login names and encrypted passwords.
ICANN seems to have been quick to act and to disclose the hack.
The attack happened last weekend and ICANN was informed about it by an “internet user” on Tuesday May 27, according to an ICANN spokesperson. RADAR was taken offline and the problem disclosed late May 28.
The spokesperson added that “we do not believe the user is affiliated with a current or previously accredited registrar.”
ICANN isn’t disclosing the nature of the vulnerability, but said RADAR will be offline for some time for a security audit. The spokesperson told DI in an email:

It will be at least two weeks. It is more important to complete a thorough security assessment of the site than to rush this process. First of all, we’re keeping the system offline until we complete a thorough audit of the system. We are also currently engaged in a security review of all systems and procedures at ICANN to assess and implement ongoing improvements as appropriate.

RADAR is a database used by registrars to coordinate stuff like emergency contacts and IP address whitelisting for bulk Whois access.
The downtime is not expected to impact registrants, according to ICANN. The spokesperson said: “Nothing that occurred has raised any concerns that registrants could or would be adversely affected.”

ICANN registrar database hacked

ICANN’s database of registrar contact information has been hacked and user data has been stolen.
The organization announced this morning that the database, known as RADAR, has been taken offline while ICANN conducts a “thorough review” of its security.
ICANN said:

This action was taken as a precautionary measure after it was learned that an unauthorized party viewed data in the system. ICANN has found no evidence of any unauthorized changes to the data in the system. Although the vulnerability has been corrected, RADAR will remain offline until a thorough review of the system is completed.

Users of the system — all registrars — have had their usernames, email addresses and encrypted passwords compromised, ICANN added.
ICANN noted that it’s possible to brute-force a hashed password into plaintext, so it’s enforcing a password reset on all users, but it has no evidence of any user accounts being accessed.
RADAR users may want to think about whether they have the same username/password combinations at other sites.
RADAR is a database used by registrars in critical functions such as domain name transfers.
Registrars can use it, for example, to white-list the IP addresses of rival registrars, enabling them to execute large amounts of Whois queries that would usually be throttled.
The news follows hot on the heels of a screwup in the Centralized Zone Data Service, which enabled any new gTLD registry to view data belonging to rival registries and other CZDS users.

US House passes anti-ICANN bill

The US House of Representatives has passed the DOTCOM Act, which would prevent the Department of Commerce from walking away from its oversight of the DNS root zone.
The bill was approved as an amendment to a defense authorization act, with a 245-177 vote that reportedly saw 17 Democrats vote in line with their Republican opponents.
The DOTCOM Act has nothing whatsoever to do with .com. Rather, it’s a response to the National Telecommunications and Information Administration’s plan to relinquish its role in root zone management.
The bill as passed (pdf) would prevent NTIA from agreeing to any multistakeholder community-created IANA transition proposal until the Government Accountability Office had issued a study on the proposal.
The GAO would have one year from the point ICANN submits the proposal to come up with this report.
That means that if ICANN and NTIA want to stick to their September 2015 target date for the transition, either the ICANN community would need to produce a proposal at unprecedented and unlikely speed or the GAO would need to take substantially less than a year to write its report.
I don’t think it’s an impossible target, but it’s certainly looking more likely that NTIA will have to exercise one of the two-year automatic renewal options in the current IANA contract.
That’s all assuming that a matching bill passes through the Democrat-controlled Senate and then receives a presidential signature, of course, which is not a certainty.
Assuming a bloc vote by the 47 Republican Senators, only four Democrats (or independents) would need to switch sides in order for the DOTCOM Act to become, barring an unlikely presidential veto, law.
To the best of my knowledge there is not currently a matching bill in the Senate.

ICANN says Verisign should stay in charge of root zone

Verisign should stay in its key role in root zone management after the IANA transition process is complete, according to ICANN CEO Fadi Chehade.
The company currently acts as “maintainer”, alongside the US government as “administrator” and ICANN/IANA as “operator”.
This means Verisign is responsible for actually making changes — adding, deleting or amending the records for TLDs — in the root zone file.
In a blog post yesterday, Chehade said that ICANN will “establish a relationship directly with the third-party Maintainer”, adding:

As a means to help ensure stability, ICANN’s recommended implementation option is to have Verisign continue its role as the Maintainer. However, we will be working closely with all relevant parties including the Root Zone Operators to ensure there are contingency options in place to meet our absolute commitment to the stability, security and resiliency of the Domain Name System.

I wholeheartedly agree that Verisign should stay in its role, or at the very least that ICANN should not take over.
As we’ve learned over the last couple of years of software glitches in the new gTLD program, some of them security-related, ICANN would be a poor choice today to maintain this critical resource.
Chehade noted that the US National Telecommunications and Information Administration would be replaced in its “administrator” role by whatever mechanism the ICANN community comes up with during the transition process.

Amazon’s bid for .amazon is dead

ICANN has killed off Amazon’s application for the new gTLD .amazon, based on longstanding but extremely controversial advice from its Governmental Advisory Committee.
According to a New gTLD Program Committee resolution passed on Wednesday and published last night, the applications for .amazon and Chinese and Japanese translations “should not proceed”.
That basically means all three applications are frozen until Amazon withdraws them, wins some kind of appeal, manages to change the GAC’s mind, or successfully sues.
Here’s the last bit of the resolution:

Resolved (2014.05.14.NG03), the NGPC accepts the GAC advice identified in the GAC Register of Advice as 2013-07-18-Obj-Amazon, and directs the President and CEO, or his designee, that the applications for .AMAZON (application number 1-1315-58086) and related IDNs in Japanese (application number 1-1318-83995) and Chinese (application number 1-1318-5581) filed by Amazon EU S.à r.l. should not proceed. By adopting the GAC advice, the NGPC notes that the decision is without prejudice to the continuing efforts by Amazon EU S.à r.l. and members of the GAC to pursue dialogue on the relevant issues.

The NGPC noted that it has no idea why the GAC chose to issue consensus advice against .amazon, but based its deliberations on the mountain of correspondence sent by South American nations.
Peru and Brazil, which share the Amazonia region of the continent, led the charge against the bids, saying they would “prevent the use of this domain for the purposes of public interest related to the protection, promotion and awareness raising on issues related to the Amazon biome”.
Amazon had argued that “Amazon” is not a geographic term and that it was against international law for governments to intervene and prevent it using its trademark.
ICANN commissioned a legal analysis that concluded that the organization was under no legal obligation to either reject or accept the applications.
Under the rules of the new gTLD program, the NGPC could have rejected the GAC’s advice, which would have led to a somewhat lengthy consultation process to resolve (or not) their differences.
The big question now is what Amazon, which has invested heavily in the new gTLD program, plans to do next.
A Reconsideration Request would be the simplest option for appeal, though almost certainly a futile gesture. An Independent Review Process complaint might be slightly more realistic.
There’s always the courts, though all new gTLD applicants have to sign legal waivers when they apply.
A fourth option would be for Amazon to negotiate with the affected governments in an attempt to get the GAC advice reversed. The company has already attempted this — offering to protect certain key words related to the region at the second level, for example — but to no avail.

Was panel wrong to put .africa on ice or does ICANN have an accountability problem?

Did an Independent Review Process panel get it wrong when it accused ICANN of failing to implement proper accountability mechanisms, or did it actually highlight a more serious problem?
As we reported yesterday, an IRP panel has ordered ICANN to not delegate ZA Central Registry’s .africa gTLD until it’s heard an appeal by failed rival bidder DotConnectAfrica.
IRP is ICANN’s last avenue of appeal for organizations that believe they’ve been wronged by ICANN decisions. Due to the duration of the process and the need for legal representation, it’s extremely expensive.
The IRP panel in the .africa case based its decision largely on the fact that ICANN has failed to create a “standing panel” of would-be IRP panelists, something the panel said would have sped up the process.
A “standing panel” is supposed to be six to nine panelists-in-waiting — all respected jurists — from which three-person IRP panels could be selected when needed in future.
DCA would not have needed to file for an emergency injunction against .africa’s delegation had this standing panel been created, the panel said.
According to the IRP panel, the creation of a standing panel has been “required” by the ICANN bylaws since April 2013, and ICANN has “failed” to follow its own rules by not creating one. It wrote:

the Panel is of the view that this Independent Review Process could have been heard and finally decided without the need for interim relief, but for ICANN’s failure to follow its own Bylaws… which require the creation of a standing panel

But ICANN disagrees, getting in touch with us today to point out that the panel only partially quoted the ICANN bylaws.
This is the bit of the bylaws the panel quoted:

There shall be an omnibus standing panel of between six and nine members with a variety of expertise, including jurisprudence, judicial experience, alternative dispute resolution and knowledge of ICANN’s mission and work from which each specific IRP Panel shall be selected.

There seems to me to be little ambiguity in that paragraph; ICANN “shall” create a standing panel.
But ICANN reminds us that the IRP panel ignored a second bit of this paragraph, which states:

In the event that an omnibus standing panel: (i) is not in place when an IRP Panel must be convened for a given proceeding, the IRP proceeding will be considered by a one- or three-member panel comprised in accordance with the rules of the IRP Provider; or (ii) is in place but does not have the requisite diversity of skill and experience needed for a particular proceeding, the IRP Provider shall identify one or more panelists, as required, from outside the omnibus standing panel to augment the panel members for that proceeding.

Basically, the bit of the bylaws stating that ICANN “shall” create a standing panel is almost immediately negated by a bit that explains what is supposed to happen if ICANN does not create a standing panel.
It’s confusing.
Is ICANN “required” (the panel’s word) to create this standing panel or not? ICANN seems to think not, but the panel thinks otherwise.
I have no opinion because, luckily, I’m not a lawyer.
But I did a bit of digging into the public record to figure out why the bylaws are so confusing on this issue and what I found is slightly worrying if you’re concerned about ICANN accountability.
The bylaws paragraph in question was added in April 2013, but it has its roots in the findings of the first Accountability and Transparency Review Team, which is the key way ICANN’s accountability is reviewed under the 2009 Affirmation of Commitments with the US government.
The ATRT said in 2010 (pdf) that ICANN should “seek input from a committee of independent experts on the restructuring of the three review mechanisms” including the IRP.
ICANN did this, convening a three-person Accountability Structures Expert Panel, made up of widely respected corporate/legal brains Mervyn King, Graham McDonald and Richard Moran
It was this ASEP that came up with the idea for a standing panel, which it said would speed up IRP decisions and reduce costs.
Members of the standing panel would be paid an annual retainer even when not working on an IRP, but it would be cheaper because IRP complainants and ICANN wouldn’t have to repeatedly explain to a new panel of doddery old ex-judges what ICANN is and does.
The ASEP, in its report (pdf) did not specify what should happen if ICANN decided not to implement its recommendation on the standing panel.
I can’t know for sure, but from the public record it seems that the confusing second part of the bylaws amendment was the creation of the ICANN board, possibly based on a single comment from gTLD registries.
The provision about a standing panel was formally added to the bylaws with an April 2013 resolution of ICANN’s board of directors, which followed a December 2012 resolution that approved the change in principle.
The second part of the amendment, the bit about what happens if ICANN does not institute a standing panel, was added at some point between those two resolutions.
The April resolution sheds a little light on the reason for the addition, saying (with my added emphasis):

Whereas, as contemplated within the [December 2012] Board resolution, and as reflected in public comment, further minor revisions are needed to the Bylaws to provide flexibility in the composition of a standing panel for the Independent Review process (IRP).
Resolved (2013.04.11.06), the Bylaws revisions to Article IV, Section 2 (Reconsideration) and Article IV, Section 3 (Independent Review) as approved by the Board and subject to a minor amendment to address public comments regarding the composition of a standing panel for the IRP, shall be effective on 11 April 2013.

The notes to the resolution further explain (again with my emphasis):

The Bylaws as further revised also address a potential area of concern raised by the community during the public comments on this issue, regarding the ability for ICANN to maintain a standing panel for the Independent Review proceedings. If a standing panel cannot be comprised, or cannot remain comprised, the Bylaws now allow for Independent Review proceedings to go forward with individually selected panelists.

The “minor amendment” referred to in the resolution seems to have enabled ICANN to basically ignore the ASEP recommendations, which (remember) stem from the ATRT review, for the last 12 months.
The April 2013 resolution was on the consent agenda for the meeting, so there was no minuted discussion by the board, but it seems pretty clear that “public comments” are responsible for the second part of the bylaws amendment.
But whose public comments?
When the ASEP report was open for comment, only two people responded — the Registries Stakeholder Group and former ICANN director Alejandro Pisanty, apparently commenting in a personal capacity.
On the subject of the proposed standing panel, the RySG said it wasn’t happy:

We also are concerned with the concept of standing panels for the IRP. A key component of the IRP is that the review is “independent.” To keep this independence, we believe that service on an IRP tribunal should be open to all eligible panelists, not just those with previous experience with or knowledge of ICANN. Determining whether an organization has complied with its bylaws or articles of incorporation should not require historic knowledge of the organization itself, and we believe that any jurist generally qualified by the IRP provider should be more than capable of acting as a panelist for an IRP.

It wasn’t the RySG’s main concern, and it wasn’t given much space in its comment.
Pisanty, commenting during the comment-reply period, seemed to disagree with the RySG, saying that the ongoing institutional knowledge of a standing panel could be a boon to the IRP.
When the ASEP report was discussed at a lightly attended early-morning session of the ICANN Toronto meeting in October 2012, the only person to comment on the standing panel was Neustar lawyer Becky Burr, and she liked the idea (transcript).
It’s not what you’d call a groundswell of opposition to the standing panel idea. There were few opinions, those opinions were split, and if anything the balance of commentary favors the notion.
In any event, when ICANN compiled its usual compilation report on the public comments (pdf) its legal staffer said:

After review of the comments, no changes to the ASEP recommendations are recommended, and the report will be forwarded to the Board for consideration and action, along with the proposed Bylaws amendments.

ICANN staff, it seems, didn’t think the RySG’s (lone?) opposition to the standing panel concept was worth messing with the ASEP’s recommendations.
And yet the ICANN board added the text about what happens in the event of a standing panel not existing anyway.
I could be wrong, but it does look a little bit like the ICANN board giving itself a carte blanch to ignore the recommendations of the ASEP, and therefore, indirectly, the ATRT.
ICANN may well have a point about the .africa IRP panel inappropriately ignoring some key sentences in the ICANN bylaws, but I can’t help but wonder how those sentences got there in the first place.