Five gTLDs fail the geo test, but .banque passes IE

Five new gTLD applications failed their Initial Evaluation this week after being ruled “geographic”, according to results just published by ICANN.
The big name failure is Tata Group, the $100 billion-a-year Indian conglomerate, which had its bid for .tata put on hold because (presumably) its name matches the name of a tiny Moroccan province.
TUI AG, a €17.5 billion-a-year Germany-based travel group, also failed to pass the geo test with its bid for .tui, which matches the name of province of Burkina Faso.
Both of these applications were highlighted in our July 2012 article “20 new gTLD applications that think they’re not geographic, but are”.
Guangzhou YU Wei Information Technology failed on geographic grounds with three applications which match the names of Chinese provinces: .深圳, .佛山 and .广州.
Under ICANN rules, if your string matches a name of an administrative region of a country, you need support or a letter of non-objection from that country’s government.
All three applicants now have Extended Evaluation to try again to secure this support.
Also today, Gexban’s application for .banque got a passing IE score. It’s uncontested but has outstanding Governmental Advisory Committee advice standing in the way of contracting with ICANN.
While ICANN formally closed its IE process last week, it’s still mopping up the stragglers. Today, 23 applications remain in Initial Evaluation.

No, ICANN isn’t moving to Switzerland

There’s a rumor going around this morning that ICANN is planning to up sticks from its US base in California and become subject to Swiss jurisdiction instead.
While this would be a huge change for ICANN, which has been tethered to the US government since its formation in 1998, it’s almost certainly not what’s happening.
The rumor emerged following CEO Fadi Chehade’s speech at the Asia Pacific Regional Internet Governance Forum in Korea yesterday, during which he talked about setting up a “legal structure” in Switzerland.
Addressing long-standing criticisms that ICANN is too US-centric, he discussed the recent creation of “hub” offices in Istanbul and Singapore, then said:

You heard me announce recently in Durban that ICANN, for the first time, is setting up a legal structure in Switzerland. That means that ICANN is going to seek to become an international organization that is serving the world, not just as a private corporation in California. These are important fundamental steps that we are exploring in order for ICANN to take a new global posture.

That ICANN wants a Swiss presence is not news. At the Durban meeting in July Chehade said publicly that ICANN had opened an “engagement center” in Geneva, headed by his senior adviser Tarek Kamel.
But the version of the Chehade quote doing the rounds on mailing lists today capitalizes “International Organization”, which arguably changes the meaning and makes his remarks seem more profound.
A capitalized “International Organization” can mean one of two legal structures: either an International Non-Governmental Organization or an Intergovernmental Organization.
That would, indeed, imply a change of jurisdiction. ICANN is currently, legally, a California non-profit corporation.
However, if Chehade just said “international organization” with no implied upper-case letters, it just means it’s an organization with offices and legal entities internationally.
I think this is closer to the truth, and so do People In A Position To Know whom I’ve run this by this morning.
It’s important to note that ICANN’s Affirmation of Commitments with the US government forces it to stay headquartered in the US:

ICANN affirms its commitments to: … remain a not for profit corporation, headquartered in the United States of America with offices around the world to meet the needs of a global community;

While Chehade has expansionist plans on a scale beyond any of his predecessors, it seems unlikely that these include breaking the AoC, incurring the wrath of the US government.
UPDATE: ICANN has provided DI with the following statement:

ICANN is not currently planning to set up a headquarters office in Switzerland. We will have an engagement center in Geneva, along with others scattered around the world but our three main hubs, as Fadi has previously announced, will be in L.A., Istanbul and Singapore.

Teething troubles for TMCH testing

With the first new gTLD delegation likely just a matter of weeks away, registries and registrars are reporting problems getting access to the Trademark Clearinghouse for testing purposes.
ICANN launched an OT&E (operational test and evaluation environment) for companies to test their systems against the IBM-run TMCH back-end last week, but few have so far managed to get in.
Some registrars have been denied access because they have not yet signed the 2013 Registrar Accreditation Agreement.
While that’s a prerequisite for selling new gTLD domains, some say it should not also be a barrier to testing their TMCH implementation before they decide to sign on the dotted line.
At least one registrar that has actually signed the 2013 RAA also says it has been denied access.
Meanwhile, several back-end applicants and back-end registry providers have reported that they too have been told they can’t access the OT&E until they’ve signed the 2013 RAA.
Registries are of course not obliged to sign any RAA in order to act as registries.
Others say they’ve received the credentials needed to access the OT&E but that they don’t work.
ICANN has blamed a mix-up in its workflow for the registries getting blocked, something it expects to get fixed quickly. It’s also looking into the complaints from registrars.
The TMCH is the database that registries and registrars will use to validate trademarks during sunrise periods, and to check for possible cybersquatting during the first few months of launch.

Public Suffix List to get monthly new gTLD updates

New gTLDs are set to be added to the widely used Public Suffix List within a month of signing an ICANN registry agreement, according to PSL volunteer Jothan Frakes.
This is pretty good news for new gTLD registries.
The PSL, maintained by volunteers under the Mozilla banner, is used in browsers including Firefox and Chrome, and will be a vital part of making sure new gTLDs “work” out of the box.
If a TLD doesn’t have an entry on the PSL, browsers tend to handle them badly.
For example, after .sx launched last year, Google’s Chrome browser returned search results instead of the intended web site when .sx domain names were typed into the address/search bar.
It also provides a critical security function, telling browsers at which level they should allow domains to set cookies.
According to Frakes, who has been working behind the scenes with other PSL volunteers and ICANN staff to get this process working, new gTLDs will usually hit the PSL within 30 days of an ICANN contract.
Due to the mandatory pre-delegation testing period, new gTLDs should be on the PSL before or at roughly the same time as they are delegated, with plenty of time to spare before they launch.
The process of being added to the PSL should be fairly quick for TLDs that intend to run flat second-level spaces, according to Frakes, but may be more complex if they plan to do something less standard, such as selling third-level domains, for example.
Browser makers may take some time to update their own lists with the PSL updates. Google, with its own huge portfolio of applications, will presumably be incentivized to stay on the ball.

Economist replaces de La Chapelle on ICANN board

ICANN’s board of directors is to see one new member in November, with economist Bruno Lanvin replacing former French civil servant Bertrand de La Chapelle.
The changes were among several appointments announced by ICANN’s Nominating Committee yesterday.
NomCom has decided to keep previous appointees Cherine Chalaby, who’s head of the New gTLD Program Committee, and Erika Mann, the former MEP who now runs Facebook’s Brussels office.
Lanvin is currently executive director of the European Competitiveness Initiative and the Global Indices projects at INSEAD, a business school, but he spent 20 years of his career with the United Nations.
Outgoing director de La Chapelle was France’s Governmental Advisory Committee representative before his appointment to the board in 2010. He, Mann and Chalaby have initial three-year terms ending in November.
It’s not known if de La Chapelle, one of ICANN’s most vocal and active directors, had nominated himself for a second term.

Only 29 gTLD applications still in IE as 101 pass and nine fail

ICANN has published what was scheduled to be its final week of Initial Evaluation results for new gTLD applications.
It was a bumper week for results as evaluators mopped up stragglers that had previously been asked to provide more information via Clarifying Questions. There were 101 passes and 9 failures.
There are still 29 applications without published results. An ICANN spokesperson said that the results for these will continue to be delivered on a weekly basis as usual until all are done.
One hundred and one applications passed. These ones:

.origins .free .banamex .sex .dog .prof .rockwool .weather .farmers .itv .ford .hkt .inc .phd .blog .kid .esq .memorial .ira .art .gmbh .pccw .music .citi .bms .live .game .news .kone .shop .able .llc .frontier .flir .watches .tires .love .dds .ericsson .dunlop .volvo .fujitsu .telecity .movie .fidelity .mutuelle .stockholm .xperia .search .lupin .med .jewelry .kddi .tires .monster .news .lincoln .book .tube .mint .clinique .buy .goodyear .lego .seven .fresenius .richardli .llp .csc .ses .ftr .ikano .gallup .saxo .mutualfunds .baby .progressive .firestone .corp .music .movie .srl .retirement .seat .mba .pars .islam .nowruz .boston .persiangulf .tci .design .rip .sucks .shia .ally .style .halal .hotel .lifeinsurance .shriram

The failures, which are all “Eligible for Extended Evaluation” are:

• .livestrong (Lance Armstrong Foundation) — failed on both financial and technical questions. The first I recall seeing to be pushed into EE based on its proposed Registry Services. Also failed a drug test.
• .unicorn — Scored only 5 out of the required 22 points on its technical evaluation, easily the worst score I can recall seeing. Its back end provider is Gransy sro, a Czech-based registrar.
• .home (Dothome Ltd) — this is the .home bid Defender Security bought from CGR E-Commerce. The same one that filed all the Legal Rights Objections against other .home applicants. It failed its financial evaluation, but not because it failed to file its financial statements, which is usually the case.
• .smart (Smart Communications, Inc) — a dot-brand that failed technical.
• .art (EFLUX.ART, LLC) — failed technical and financial.
• These applications didn’t provide financial statements, so failed the financial questions: .transunion (Trans Union LLC), .pnc (PNC Domains LLC), .cipriani (Cipirani Hotel), .jcp (JCP Media Inc)

Donuts signs 12 more new gTLD registry contracts

Donuts today announced that it has signed 12 more new gTLD Registry Agreements with ICANN.
The contracts, which have not yet been published, cover .bike, .camera, .clothing, .equipment, .estate, .guru, .holdings, .lighting, .singles, .ventures, .voyage and .企业, which is “.enterprise” in Chinese.
As of a week ago, the firm has also passed all of its Initial Evaluations, with no failures.
According to the DI PRO database, Donuts still has a total of 300 applications in play, of which 148 are contested.
Another 30 have objections, at least 103 have GAC Advice, and 96 are classified as “uncalculated risk”, all factors that could lead to delay and possibly rejection.
Today’s news mean ICANN has signed registry contracts with at least 16 new gTLDs.
It’s not much by the standards it had set itself — expecting to sign 20 a week by now — but it’s almost as many as it’s signed in the preceding 15 years.

Name collisions comments call for more gTLD delay

The first tranche of responses to Interisle Consulting’s study into the security risks of new gTLDs, and ICANN’s proposal to delay a few hundred strings pending more study, is in.
Comments filed with ICANN before the public comment deadline yesterday fall basically into two camps:

• Non-applicants (mostly) urging ICANN to proceed with extreme caution. Many are asking for more time to study their own networks so they can get a better handle on their own risk profiles.
• Applicants shooting holes in Interisle’s study and ICANN’s remeditation plan. They want ICANN to reclassify everything except .home and .corp as low risk, removing delays to delegation and go-live.

They were responding to ICANN’s decision to delay 521 “uncalculated risk” new gTLD applications by three to six months while further research into the risk of name collisions — where a new gTLD could conflict with a TLD already used by internet users in a non-standard way — is carried out.
Proceed with caution
Many commenters stated that more time is needed to analyse the risks posed by name collisions, noting that Interisle studied primarily the volume of queries for non-existent domains, rather than looking deeply into the consequences of delegating colliding gTLDs.
That was a point raised by applicants too, but while applicants conclude that this lack of data should lead ICANN to lift the current delays, others believe that it means more delays are needed.
Two ICANN constituencies seem to generally agree with the findings of the Interisle report.
The Internet Service Providers and Connectivity Providers constituency asked for the public comment period be put on hold until further research is carried out, or for at least 60 days. It noted:

corporations, ISPs and connectivity providers may bear the brunt of the security and customer-experience issues resulting from adverse (as yet un-analyzed) impacts from name collision
…
these issues, due to their security and customer-experience aspects, fall outside the remit of people who normally participate in the ICANN process, requiring extensive wide-ranging briefings even in corporations that do participate actively in the ICANN process

The At-Large Advisory Committee concurred that the Interisle study does not currently provide enough information to fully gauge the risk of name collisions causing harm.
ALAC said it was “in general concurrence with the proposed risk mitigation actions for the three defined risk categories” anyway, adding:

ICANN must assure that such residual risk is not transferred to third parties such as current registry operators, new gTLD applicants, registrants, consumers and individual end users. In particular, the direct and indirect costs associated with proposed mitigation actions should not have to be borne by registrants, consumers and individual end users. The Board must err on the side of caution

Several individual stakeholders agreed with the ISPCP that they need more time to look at their own networks. The Association of Nation Advertisers said:

Our member companies are working diligently to determine if DNS Clash issues are present within their respective networks. However the ANA had to communicate these issues to hundreds of companies, after which these companies must generate new data to determine the potential service failures on their respective networks.

The ANA wants the public comment period extended until November 22 to give its members more time to gather data.
While the ANA can always be relied upon to ask for new gTLDs to be delayed, its request was echoed by others.
General Electric called for three types of additional research:

• Additional studies of traffic beyond the initial DITL sample.
• Information and analysis of “use cases” — particular types of queries and traffic — and the consequences of the failure of particular use cases to resolve as intended (particular use cases could have severe consequences even if they might occur infrequently — like hurricanes), and
• Studies of the time and costs of mitigation.

GE said more time is needed for companies such as itself to conduct impact analyses on their own internal networks and asked ICANN to not delegate any gTLD until the risk is “fully understood”.
Verizon, Heinz and the American Insurers Association have asked for comment deadline extensions for the same reasons.
The Association of Competitive Technology (which has Verisign as a member) said:

ICANN should slow or temporarily suspend the process of delegating TLDs at risk of causing problems due to their frequency of appearance in queries to the root. While we appreciate the designation of .home and .corp as high risk, there are many other TLDs which will also have a significant destructive effect.

Numerically, there were far more comments criticizing ICANN’s mitigation proposal. All were filed by new gTLD applicants, whose interests are aligned, however.
Most of these comments, which are far more focused on the details and the data, target perceived deficiencies in Interisle’s report and ICANN’s response to it.
Several very good arguments are made.
The Svalbard problem
First, there is criticism of the cut-off point between “low risk” and “uncalculated risk” strings, which some applicants say is “arbitrary”.
That’s mostly true.
ICANN basically took the list of applied-for strings, ordered by the frequency Interisle found they generate NXDOMAIN responses at the root, and drew a line across it at the 49,842 queries mark.
That’s because 49,842 queries is what .sj, the least-frequently-queried real TLD, received over the same period
If your string, despite not yet existing as a gTLD, already gets more traffic than .sj, it’s classed as “uncalculated risk” and faces more delays, according to ICANN’s plan.
As Directi said in its comments:

The result of this arbitrary selection is that .bio (Rank 281) with 50,000 queries (rounded to the nearest thousand) is part of the “uncategorized risk” list, and is delayed by 3 to 6 months, whereas .engineering (Rank 282) with 49,000 queries (rounded to the nearest thousand) is part of the “low risk” list, and can proceed without any significant delays.

What neither ICANN nor Interisle explained is why this is an appropriate place to draw a line in the sand.
This graphic from DotCLUB Domains illustrates the scale of the problem nicely:
.sj is the ccTLD for Svalbard, a Norwegian territory in the Arctic Circle with fewer than 3,000 inhabitants. The TLD is administered by .no registry Norid, but it’s not possible to register domains there.
Does having more traffic than .sj mean a gTLD is automatically more risky? Does having less mean a gTLD is safe? The ICANN proposal assumes “yes” to both questions, but it doesn’t explain why.
Many applicants say that having more traffic than existing gTLDs does not automatically mean your gTLD poses a risk.
They pointed to Verisign data from 2006, which shows that gTLDs such as .xxx and .asia were already receiving large amounts of traffic prior to their delegation. When they were delegated, the sky did not fall. Indeed, there were no reports of significant security and stability problems.
The New gTLD Applicants Group said:

In fact, the least “dangerous” current gTLD on the chart, .sx, had 331 queries per million in 2006. This is a higher density of NXDOMAIN queries than all but five proposed new TLDs. 4 Again, .sx was launched successfully in 2012 with none of the problems predicted in these reports.
These successful delegations alone demonstrate that there is no need to delay any more than the two most risky strings.

Donuts said:

There is no factual basis in the study recommending halting delegation process of 20% of applied-for strings. As the paper itself says, “The Study did not find enough information to properly classify these strings given the short timeline.” Without evidence of actual harm, the TLDs should proceed to delegation. Such was the case with other TLDs such as .XXX and .ASIA, which were delegated without delay and with no problems post-delegation.

Applicants also believe that the release in June 2012 of the list of all 1,930 applied-for strings may have skewed the data set that Interisle used in its study.
Uniregistry, for example, said:

The sole fact that queries are being received at the root level does not itself present a security risk, especially after the release to the public of the list of applied-for strings.

The argument seems to be that a lot of the NXDOMAIN traffic seen in 2013 is due to people and software querying applied-for TLDs to see if they’re live yet.
It’s quite a speculative argument, but it’s somewhat supported by the fact that many applied-for strings received more queries in 2013 than they did in the equivalent 2012 sampling.
Second-level domains
Some applicants pointed out that there may not be a correlation between the volume of traffic a string receives and the number of second-level domains being queried.
A string might get a bazillion queries for a single second-level domain name. If that domain name is reserved by the registry, the risk of a name collision might be completely eliminated.
The Interisle report did show that number of SLDs and the volume of traffic do not correlate.
For example, .hsbc is ranked 14th in terms of traffic volume but saw requests for just 2,000 domains, whereas .inc, which ranked 15th, saw requests for 73,000 domains.
Unfortunately, the Interisle report only published the SLD numbers for the top 35 strings by query volume, leaving most applicants none the wiser about the possible impact of their own strings.
And ICANN did not factor the number of SLDs into its decision about where to draw the line between “low” and “uncalculated” risk.
Conspiracy theories
Some applicants questioned whether the Interisle data itself was reliable, but I find these arguments poorly supported and largely speculative.
They propose that someone (meaning presumably Verisign, which stands to lose market share when new gTLDs go live, and which kicked off the name collisions debate in the first place) could have gamed the study by generating spurious requests for applied-for gTLDs during the period Interisle’s data was being captured.
Some applicants put forth this view, while other limited their comments to a request that future studies rely only on data collected before now, to avoid tampering at the point of collection in future.
NTAG said:

Query counts are very easily gamed by any Internet connected system, allowing for malicious actors to create the appearance of risk for any string that they may object to in the future. It would be very easy to create the impression of a widespread string collision problem with a home Internet connection and the abuse of the thousands of available open resolvers.

While this kind of mischief is a hypothetical possibility, nobody has supplied any evidence that Interisle’s data was manipulated by anyone.
Some people have privately pointed DI to the fact that Verisign made a substantial donation to the DNS-OARC — the group that collected the data that Interisle used in its study — in July.
The implication is that Verisign was somehow able to manipulate the data after it was captured by DNS-OARC.
I don’t buy this either. We’re talking about a highly complex 8TB data set that took Interisle’s computers a week to process on each pass. The data, under the OARC’s deal with the root server operators, is not allowed to leave its premises. It would not be easily manipulated.
Additionally, DNS-OARC is managed by Internet Systems Consortium — which runs the F-root and is Uniregistry’s back-end registry provider — from its own premises in California.
In short, in the absence of any evidence supporting this conspiracy theory, I find the idea that the Interisle data was hacked after it was collected highly improbable.
What next?
I’ve presented only a summary of some key points here. The full list of comments can be found here. The reply period for comments closes September 17.
Several ICANN constituencies that can usually be relied upon to comment on everything (registrars, intellectual property, business and non-commercial) have not yet commented.
Will ICANN extend the deadline? I suppose it depends on how cautious it wants to be, whether it believes the companies requesting the extension really are conducting their own internal collision studies, and how useful it thinks those studies will be.

Roussos loses last .music LRO

Constantine Roussos’ DotMusic Ltd has lost its seventh and final Legal Rights Objection against rival .music applicants.
In the decision in DotMusic Ltd v DotMusic Inc, published (pdf) this hour, WIPO panelist Mark Partridge ruled:

the Panel is compelled to conclude that the Objector lacks enforceable rights. The term “.music” (or “dotMusic”) would in the Panel’s opinion be recognized as a generic designation for a top-level domain name directed at or relating to music and music-related services. As a result, the Panel is of the opinion that the Objector cannot own trademark rights in the terms “.music” (or “dotMusic”) per se as a matter of law, even if it has developed awareness of that term as being associated with it as the name of an entity.

That’s roughly in keeping with the first six DotMusic decisions and a not remotely surprising result.
The objections phase for .music is not over yet, however. There are still seven Community Objections pending, most of them filed by American Association of Independent Music, which is affiliated with Roussos’ bid.
There’s also the possibility that DotMusic and/or .music LLC (which also has industry backing) could apply for a Community Priority Evaluation, which would kill off all rivals at a stroke.
I’ve yet to hear a convincing argument why either application could win a CPE, so my guess is that .music is, eventually, heading to auction.

All gTLD confusion decisions in one handy chart

Dirk Krischenowski of DotBerlin has produced an interesting chart plotting all the new gTLD string confusion decisions to come out of ICANN and its objection panels to date.
He’s kindly allowed us to reproduce it here. Click to enlarge.

Each string-pair’s percentage of similarity, as determined by the Sword algorithm, determines its position on the Y-axis, while the color of the circle indicates which way the decision went.
It’s a nice way of visualizing the fact that while Sword may have been instructive in the String Similarity Panel’s determinations it’s not an overwhelming factor in String Confusion Objection decisions made by International Centre for Dispute Resolution panelists.
You can download the chart as a PDF here.