We have a winner! Del Monte wins .delmonte LRO

No sooner did I predict the new gTLD Legal Rights Objection would not produce any prevailing complainants in this application round, then I’ve been proved wrong.
A three-person WIPO panel yesterday delivered a majority-verdict win for Del Monte, which had filed an LRO against its licensee, .delmonte new gTLD applicant Fresh Del Monte.
It’s a complex case, but the panelists’ thinking appears to be consistent with previously decided LROs.
Del Monte is the original owner of the Del Monte brand, with rights going back to the nineteenth century and registered trademarks all over the world.
Fresh Del Monte has used the Del Monte brand under license from the other company since 1989.
Fresh Del Monte also acquired a South African trademark for “Del Monte” in October 2011, but the panel viewed this with suspicion, wondering aloud whether it had been obtained just to bolster its new gTLD application.
The panel also wondered whether acquiring the mark may have been a breach of the two firms’ longstanding licensing agreement.
The circumstances behind the South African trademark were enough to convince two of the three panelists that there was “something untoward” about Fresh Del Monte’s behavior.
That was a crucial factor in the decision (pdf), with the panel citing earlier LRO precedent to the effect that there must be some kind of bad faith present by the applicant in order for an LRO to succeed.
But the most important factor, according to the decision, was the “likelihood of confusion” element of the LRO. The panelists wrote:

From the crucial perspective of the average consumer, and notwithstanding the somewhat complicated licensing arrangements, the coexistence of the parties’ products in certain territories, and the similarity of the parties’ coexisting food products, the evidence shows that the Trade Mark has continued to function as an indicator of the commercial origin of the Objector and its goods (whether the Objector’s direct goods, or licensed goods).

They’re not wrong. Both companies sell canned fruit and vegetables and use the same logo. It’s virtually impossible for the average guy in the street to tell the difference between the two.
Having been exposed to the Del Monte brand for as long as I can remember, having read the LRO decision, and having visited both companies’ web sites, I still couldn’t tell you which company’s canned pineapple I’ve been ignoring on supermarket shelves all these years.
But the decision was not unanimous. Dissenting panelist Robert Badgley agreed with most of the panel’s findings but thought they hadn’t given enough weight to Fresh Del Monte’s South African trademark.
The panel, he suggested, hadn’t looked closely enough at the circumstances of the trademark rights being acquired because it hadn’t allowed additional submissions on that point.
Basically, the decision seems to have been made on partial evidence. Badgley wrote:

I am prepared to conclude that it is more likely than not that Respondent owns the DEL MONTE mark in South Africa and its use of that mark has been bona fide. This conclusion is critical to my ultimate view that Objector has failed to carry its burden of proof and therefore the Objection should be overruled.

He also noted that the two companies, with their matching brands, had been coexisting for 24 years under their licensing arrangement.

Donuts, Uniregistry and Famous Four respond to ICANN’s new gTLD security bombshell

Following the shock news this morning that ICANN wants to delay hundreds of new gTLD applications due to potential security risks, we pinged a few of the biggest applicants for their initial reactions.
Donuts, Uniregistry and Famous Four Media, which combined are responsible for over a fifth of all applications, have all responded so far, so we’re printing their statements here in full.
As a reminder, two reports published by ICANN today a) strongly warn against delegating so-called “dotless” domains and b) present significant evidence that “internal name collisions” are a real and present danger to the security and stability of many private networks.
ICANN, in response to the internal name collision issue, proposed to delay 20% of all new gTLD applications for three to six more months while more research is carried out.
It also wants to ask new gTLD registries to conduct outreach to internet users potentially affected by their delegated gTLD strings.
Of the three, Donuts seems most upset. It sent us the following statement:

One has to wonder about the timing of these reports and the motivations behind them. Donuts believes, and our own research confirms satisfactorily to us, that dotless domains and name collision are not threatening to the stability and security of the domain name system.
Name collisions, such as the NxD (in the technical parlance) collisions studied in this report, happen every day in .com, yet the study did not quantify those and Verisign does not block those names from being registered.
We’re concerned about false impressions being deliberately created and believe the reports are commercially or competitively motivated.
There is little reason to pre-empt dotless domains now when there are ICANN processes in place to evaluate them in due course. We don’t believe that ICANN resources need to be deployed at this point on understanding the potential innovations of possible uses nor any security harms.
We also think that name collision is an overstated issue. Rather than take the overdone step of halting or delaying these TLDs, if the issue really is such a concern, it would be wiser to focus on the second-level names where a conflict could occur.
As the NTIA recently wrote, Verisign’s inconsistencies on technical issues are very troubling. These issues have been thoroughly studied for some time. It’s far past due to conclude this eight-year process an move to delegation

As I haven’t previously heard any reason to doubt Interisle Consulting’s impartiality or question its motivation in writing the name collisions report I asked Donuts for clarification, but the company declined to elaborate.
Interisle has been working with ICANN for some time on various technical studies and is also one of the new gTLD program’s independent evaluators, responsible for registry services evaluations.
Uniregistry CEO Frank Schilling was also unhappy with the report. He sent the following statement:

We are deeply dismayed by this new report, both by its substance and its timing. On the substance, the concerns addressed by the report relate, primarily if not solely, to solvable problems created by third-parties using the DNS in non-standard ways. We expect that any problems will be addressed quickly by the companies and individuals that caused them in the first place.
On ICANN’s timing, it is, come just as the first new gTLDs are prepared to launch, very late and, quite obviously, highly disruptive to the long-standing business plans of the companies that relied on ICANN’s guidebook and stated timelines. Uniregistry believes that the best approach is to move forward with the launch of all new gTLDs on the existing schedule.

Finally, Famous Four Media is slightly more relaxed about the situation, judging by the statement it sent us:

Famous Four Media’s primary concern is the security and stability of the Internet. Since this is in the interest of all parties involved in the new gTLD program from registries to registrants and all in between Famous Four Media welcomes these proposals.
Whilst the latest report, and the consequent ICANN proposals, will inevitably cause delays and additional costs in the launches of new gTLDs, Famous Four Media does not believe it will impact its go-to-market plans significantly. The majority of our TLD strings are considered “low risk” and see this in a very positive light although other applicants might not afford to be as sanguine.

According to the DI PRO New gTLD Application Tracker, which has been updated with the risk levels ICANN says each applied-for gTLD poses, 18 of Famous Four’s 60 original applications are in the riskiest two categories, compared to 23 of Uniregistry’s 54 and 102 of Donuts’ of 307.

New gTLDs are the new Y2K: .corp and .home are doomed and everything else is delayed

The proposed gTLDs .home and .corp create risks to the internet comparable to the Millennium Bug, which terrorized a burgeoning internet at the turn of the century, and should be rejected.
Meanwhile, every other gTLD that has been applied for in the current round could be delayed by months in order to mitigate the risks they pose to internet users.
These are the conclusions ICANN has drawn from Interisle Consulting’s independent study into the problems that could be caused when new gTLDs clash with widely-used internal naming systems.
The extensive study, which drew on 8TB of traffic data provided by 11 of the 13 DNS root server operators, is 197 pages long and absolutely fascinating. It was published by ICANN today.
As Interisle CEO Lyman Chapin reported at the ICANN meeting in Durban a few weeks ago, the large majority of TLDs that have been applied for in the current round already receive large amounts of error traffic:

Of the 1,409 distinct applied-for TLD strings, 1,367 appeared at least once in the 2013 DITL [Day In the Life of the Internet] data with the string at the TLD position.

We’ve previously reported on the volume of queries new gTLDs get, such as the fact that .home gets half a billion hits a day and that 3% of all requests were for strings that have been applied for in the current round.
The extra value in Interisle’s report comes when it starts to figure out how many end points are making these requests, and how many second-level domains they’re looking for.
These are vitally important factors for assessing the scale of the risk of each TLD.
Again, .home and .corp appear to be the most dangerous.
Interisle capped the number of second-level domains it counted in the 2013 data at 100,000 per TLD per root server — 1,100,000 domains in total — and .home was the only TLD string to hit this cap.
Cisco Systems’ proposed .cisco TLD came close, failing to hit the cap in only one of the 11 root servers providing data, while .box and .iinet (both also used widely on home routers) hit the cap on at least one root server.
The lowest count of second-level domains of the 35 listed in the report came from .hsbc, the bank brand, but even that number was a not-inconsiderable 2,000.
Why are these requests being made?
Surprisingly, interactions between a security feature in Google’s own Chrome browser and common residential routers appear to be the biggest cause of queries for non-existent TLDs.
That issue, which impacts mainly .home, accounts for about 46% of the requests counted, according to the report.
In second place, with 15% of the queries, are requests for real domain names that appear to have had a non-existent TLD — again, usually .home — appended by a residential router or cable modem.
Apparent typos — where a user enters a URL but forgets to type the TLD — were a relatively small percentage of requests, coming in at under 1% of queries.
The study also found that bad requests come from many thousands of sources. This table compares the number of requests to the number of sources.
[table id=14 /]
The “Count” column is the number, in thousands, of requests for each TLD string. The “Prefix Count ” column refers to the number of sources providing this traffic, counted by the /24 IP address block (each of which is up to 256 potential hosts).
As you can see, there’s not necessarily a correlation between the number of requests a TLD gets and the number of people making the requests — .google gets queried by more sources than the others, but it’s only ranked 24 in terms of overall query volume, for example.
Interisle concluded from all this that .corp and .home are simply too dangerous to delegate, comparing the problem to the year 2000 bug, where a global effort was required to make sure software could support the four-digit dating scheme required by the turn of the century.
Here’s what the report says about .corp:

users could be taken to the wrong web site (and possibly be exposed to phishing attacks) or told that web sites do not exist when they do, depending on how the .corp TLD is resolved. A corporate mail system might attempt to deliver email to the wrong server, and this could expose sensitive or confidential information to someone who was not supposed to receive it. In essence, everything deployed in the private network would need to be checked.
There are no easy solutions to these problems. In an ideal world, the operators of these private networks would get a timely notification of the new TLD’s delegation and then take action to address these issues. That seems very improbable. Even if ICANN generated sufficient publicity about the new TLD’s delegation, there is no guarantee that this will come to the attention of the management or operators of the private networks that could be jeopardized by the delegation.
…
It seems reasonable to estimate that the amount of effort involved might be comparable to a wholesale renumbering of the internal network or the Y2K problem.

It notes that applied-for TLDs such as .site, .office, .group and .inc appear to be used in similar ways to .home and .corp, but do not appear to present as broad a risk.
To be clear, the risk we’re talking about here isn’t just people typing the wrong things into browsers, it’s about the infrastructure on many thousands of private networks starting to make the wrong security assumptions about domain names.
ICANN, in response, has outlined a series of measures sure to infuriate many gTLD applicants, but which are consistent with its goal to protect the security and stability of the internet.
They’re also consistent with some of the recommendations put forward by Verisign over the last few months in its campaign to show that new gTLDs pose huge risks.
First, .corp and .home are dead. These two strings have been categorized “high risk” by ICANN, which said:

Given the risk level presented by these strings, ICANN proposes not to delegate either one until such time that an applicant can demonstrate that its proposed string should be classified as low risk

Given the Y2K-scale effort required to mitigate the risks, and the fact that the eventual pay-off wouldn’t compensate for the work, I feel fairly confident in saying the two strings will never be delegated.
Another 80% of the applied-for strings have been categorized “low risk”. ICANN has published a spreadsheet explaining which string falls into which category. Low risk does not mean they get off scot-free, however.
First, all registries for low-risk strings will not be allowed to activate any domain names in their gTLD for 120 days after contract signing.
Second, for 30 days after a gTLD is delegated the new registries will have to reach out to the owners of each IP address that attempts to query names in that gTLD, to try to mitigate the risk of internal name collisions.
This, as applicants will no doubt quickly argue, is going to place them under a massive cost burden.
But their outlook is considerably brighter than that of the remaining 20% of applications, which are categorized as “uncalculated risk” and face a further three to six months of delay while ICANN conducts further studies into whether they’re each “high” or “low” risk strings.
In other words, the new gTLD program is about to see its biggest shake-up since the GAC delivered its Advice in Beijing, adding potentially millions in costs and delays for applicants.
ICANN’s proposed mitigation efforts are now open for public comment.
One has to wonder why the hell ICANN didn’t do this study two years ago.

Dotless domains “dangerous”, security study says

An independent security study has given ICANN a couple dozen very good reasons to continue outlaw “dotless” domain names, but stopped short of recommending an outright ban.
The study, conducted by boutique security outfit Carve Systems and published by ICANN this morning, confirms that dotless domains — as it sounds, a single TLD label with no second-level domain and no dot — are potentially “dangerous”.
If dotless domains were to be allowed by ICANN, internet users may unwittingly send their private data across the internet instead of a local network, Carve found.
That’s basically the same “internal name collision” problem outlined in a separate paper, also published today, by Interisle Consulting (more on that later).
But dotless domains would also open up networks to serious vulnerabilities such as cookie leakage and cross-site scripting attacks, according to the report.
“A bug in a dotless website could be used to target any website a user frequents,” it says.
Internet Explorer, one of the many applications tested by Carve, automatically assumes dotless domains are local network resources and gives them a higher degree of trust, it says.
Such domains also pose risks to users of standard local networking software and residential internet routers, the study found. It’s not just Windows boxes either — MacOS and Unix could also be affected.
These are just a few of the 25 distinct security risks Carve identified, 10 of which are considered serious.
ICANN has a default prohibition on dotless gTLDs in the new gTLD Applicant Guidebook, but it’s allowed would-be registries to specially request the ability to go dotless via Extended Evaluation and the Registry Services Evaluation Process (with no guarantee of success, of course).
So far, Google is the only high-profile new gTLD applicant to say it wants a dotless domain. It wants to turn .search into such a service and expects to make a request for it via RSEP.
Other portfolio applicants, such as Donuts and Uniregistry, have also said they’re in favor of dotless gTLDs.
Given the breadth of the potential problems identified by Carve, you might expect a recommendation that dotless domains should be banned outright. But that didn’t happen.
Instead, the company has recommended that only certain strings likely to have a huge impact on many internet users — such as “mail” and “local” — be permanently prohibited as dotless TLDs.
It also recommends lots of ways ICANN could allow dotless domains and mitigate the risk. For example, it suggests massive educational outreach to hardware and software vendors and to end users.

Establish guidelines for software and hardware manufacturers to follow when selecting default dotless names for use on private networks. These organizations should use names from a restricted set of dotless domain names that will never be allowed on the public Internet.

Given that most people have never heard of ICANN, that internet standards generally take a long time to adopt, and allowing for regular hardware upgrade cycles, I couldn’t see ICANN pulling off such a feat for at least five to 10 years.
I can’t see ICANN approving any dotless domains any time soon, but it does appear to have wiggle-room in future. ICANN said:

The ICANN Board New gTLD Program Committee (NGPC) will consider dotless domain names and an appropriate risk mitigation approach at its upcoming meeting in August.

NTIA alarmed as Verisign hints that it will not delegate new gTLDs

Verisign has escalated its war against competition by telling its government masters that it is not ready to add new gTLDs to the DNS root, raising eyebrows at NTIA.
The company told the US National Telecommunications and Information Administration in late May that the lack of uniform monitoring across the 13 root servers means it would put internet security and stability at risk to start delegating new gTLDs now.
In response, the NTIA told Verisign that its recent position on DNS security is “troubling”. It demanded confirmation that Verisign is not planning to block new gTLDs from being delegated.
The letters (pdf and pdf) were published by ICANN over the weekend, over two months after the first was sent.
Verisign senior VP Pat Kane wrote in the May letter:

we strongly believe certain issues have not been addressed and must be addressed before any root zone managers, including Verisign, are ready to implement the new gTLD Program.
We want to be clearly on record as reporting out this critical information to NTIA unequivocally as we believe a complete assessment of the critical issues remain unaddressed which left unremediated could jeopardize the security and stability of the DNS.
…
we strongly recommend that the previous advice related to this topic be implemented and the capability for root server system monitoring, instrumentation, and management capabilities be developed and operationalized prior to beginning delegations.

Kane’s concerns were first outlined by Verisign in its March 2013 open letter to ICANN, which also expressed serious worries about issues such as internal name collisions.
Verisign is so far the only root server operator to publicly express concerns about the lacking of coordinated monitoring, and many people believe that the company is simply desperately trying to delay competition for its $800 million .com business for as long as possible.
These people note that in early November 2012, Verisign signed a joint letter with ICANN and NTIA that said:

the Root Zone Partners are able to process at least 100 new TLDs per week and will commit the necessary resources to meet all root zone management volume increases associated with the new gTLD program

That letter was signed before NTIA stripped Verisign of its right to increase .com prices every year, depriving it of tens or hundreds of millions of dollars of additional revenue.
Some say that Verisign is raising spurious security concerns now purely because it’s worried about its bottom line.
NTIA is beginning to sound like one of these critics. In its response to the May 30 letter, sent by NTIA and published by ICANN on Saturday, deputy associate administrator Vernita Harris wrote:

NTIA and VeriSign have historically had a strong working relationship, but inconsistencies in VeriSign’s position in recent months are troubling… NTIA fully expects VeriSign to process change requests when it receives an authorization to delegate a new gTLD. So that there will be no doubt on this point, please provide me a written confirmation no later than August 16, 2013 that VeriSign will process change requests for the new gTLD program when authorized to delegate a new gTLD.

Harris said that a system is already in place that would allow the emergency rollback of the root zone, basically ‘un-delegating’ any gTLD that proves to cause a security or stability problem.
This would be “sufficient for the delegation of new gTLDs”, she wrote.
Could Verisign block new gTLDs?
It’s worth a reminder at this point that ICANN’s power over the DNS root is something of a facade.
Verisign, as operator of the master A root server, holds the technical keys to the kingdom. Under its NTIA contract, it only processes changes to the root — such as adding a TLD — when NTIA tells it to.
NTIA in practice merely passes on the recommendations of IANA, the department within ICANN that has the power to ask for changes to the root zone, also under contract with NTIA.
Verisign or NTIA in theory could refuse to delegate new gTLDs — recall that when .xxx was heading to the root the European Union asked NTIA to delay the delegation.
In practice, it seems unlikely that either party would stand in the way of new gTLDs at the root, but the Verisign rhetoric in recent months suggests that it is in no mood to play nicely.
To refuse to delegate gTLDs out of commercial best interests would be seen as irresponsible, however, and would likely put its role as custodian of the root at risk.
That said, if Verisign turns out to be the lone voice of sanity when it comes to DNS security, it is ICANN and NTIA that will ultimately look like they’re the irresponsible parties.
What’s next?
Verisign now has until August 16 to confirm that it will not make trouble. I expect it to do so under protest.
According to the NTIA, ICANN’s Root Server Stability Advisory Committee is currently working on two documents — RSSAC001 and RSSAC002 — that will outline “the parameters of the basis of an early warning system” that will address Verisign’s concerns about root server management.
These documents are likely to be published within weeks, according to the NTIA letter.
Meanwhile, we’re also waiting for the publication of Interisle Consulting’s independent report into the internal name collision issue, which is expected to recommend that gTLDs such as .corp and .home are put on hold. I’m expecting this to be published any day now.

Clean sweep for gTLD applicants as 91 pass

Ninety-one new gTLD applications passed Initial Evaluation this week, as ICANN enters the final month of results.
There were no failures to report. The following strings, with links to the relevant applicant on DI PRO, achieved passing scores:

.staples .gmo .hot .organic .degree .quebec .ricoh .guardian .hiphop .llp .ram .ieee .kpmg .obi .game .style .blackfriday .vlaanderen .tennis .baseball .afl .android .restaurant .sca .llc .rich .porn .gay .data .ink .nec .mzansimagic .moto .map .gap .zero .aarp .football .loans .schwarz .flsmidth .box .cloud .expert .stream .store .tunes .shopping .gmx .scot .tmall .dentist .live .app .tools .hair .ggee .bing .loans .video .golf .free .exposed .world .kerrylogisitics .llc .broker .coupons .eco .news .video .store .flights .comsec .inc .app .tours .abarth .edeka .locker .star .events .page .rent .financialaid .family .services .studio .honda .buy .click

There are now 1,377, passing applications and just 14 that are headed to Extended Evaluation.
With just 438 remaining in IE, ICANN remains on track to clean up the bulk of the process by the end of August as promised.
I expect there will be stragglers that do not receive their results until after the initial timeline is over, however, due to delays answering clarifying questions and such.

That’s all folks, no more LRO news

The results of Legal Rights Objections against new gTLD applications are no longer news.
That’s the decision handed down by the editor here at DI’s Global World International Headquarters today.
“Hey, Keith,” she barked from her ermine-carpeted corner office. “This LRO stuff is getting a bit old, don’t you think?”
“My name’s Kevin,” I said.
“Whatever,” she said. “LRO is now dog-bites-man. I decree it thus. No more of it, understand? Write more about Go Daddy girls.”
She has a point (she’s a great editor and I love her dearly).
The Legal Rights Objection has, I think, said pretty much everything it’s going to say in this new gTLD application round. I’m feeling pretty confident we can predict that all outstanding LROs will fail.
This prediction is based largely on the fact that the 69 LROs filed in this round all pretty much fall into three categories.

• Front-running. These are the cases where the objector is an applicant that secured a trademark on its chosen gTLD string, usually with the dot, just in order to game the LRO process. These have all been rejected so far. I thought Constantine Roussos’ .music objection was the only one with a sliver of a chance; now that it’s been rejected I think the chances of any outstanding objections of this type prevailing are zero.
• Brand v Brand. The objector may or may not be an applicant too, but both it and the respondent both own legit trademarks on the string in question. WIPO’s LRO panelists have made it clear, most recently yesterday in Merck v Merck (pdf) and Merck v Merck (pdf), that having a famous brand does not give you the right to block somebody else from owning a matching famous brand as a gTLD.
• Generic trademarks. Cases where an owner of a legit brand that matches a dictionary word files an objection against an applicant for the same string that proposes to use it in its generic sense. See Express v Donuts, for example. Panelists have found that unless there’s some nefarious intent by the applicant, the mandatory second-level rights protection mechanisms new gTLD registries must abide by are sufficient to protect trademark rights. As I don’t believe any applicants have a nefarious intent, I don’t believe any of these LROs will succeed.

In short, the LRO may be one of many deterrents to top-level cybersquatting, but has proven itself an essentially useless cash sink if you want to prevent the use of a trademark at the top level.
The impact of this, I believe, will be to give new gTLD consultants another excellent reason to push defensive gTLD applications on big brands in future new gTLD rounds.
Whether it will inspire unsavory types to apply for generic terms in future, in order to extort money from matching brands, will depend to a large extent on whether applicants in this round wind up making lucrative deals with the brands they’re competing against.
In any event, it seems certain that the LRO-to-application ratio will be far lower in future rounds.
DI will of course continue to peruse each new LRO as it is published and will report on any genuinely interesting developments, but we will not cover each decision as a matter of course.
Decisions are published by WIPO daily here and email notifications are sent along with WIPO’s daily UDRP newsletter.
Information about Go Daddy girls can, from now on, be found here.

ICANN to crack down on UDRP “cyberflight”

ICANN has moved closer to cracking down on cybersquatters who try to flip their domains when they discover they’ve been hit with a UDRP complaint.
Under recommendations approved by the GNSO Council yesterday, registrars would be bound by a much stricter set of UDRP-related domain locking rules in future.
So-called “cyberflight” — where squatters transfer their domains to a new registrar or registrants — appears to be a relatively infrequent problem, but when it does happen it causes big headaches for UDRP providers and trademark owners.
A survey of UDRP providers carried out as part of the GNSO’s policy development process discovered that the vast majority of registrars already lock domains hit by UDRP.
The problem is, they said, that locking practices are not uniform. Some registrars take well over a week to lock domains, and what the “lock” entails differs by registrar.
The recommendations of the GNSO’s Final Report on the Locking of a Domain Name Subject to UDRP Proceedings Policy Development Process, adopted by the Council yesterday, seek to standardize the process.
After being told about a complaint against one of its domains, the registrar in future would have a maximum of two business days to put a lock — preventing any changes in registrant or registrar — in place.
The lock would remain until the UDRP was resolved, but there would be various safeguards in place to enable complainants and respondents to settle their differences outside of the UDRP.
The lock would not prevent registrars or proxy/privacy services revealing the true identity of the registrant — that wouldn’t count as a change of registrant.
To prevent registrants abusing the two-day window to sell their domains or switch registrars, they would not be told about the existence of the UDRP until the domain had been locked.
The UDRP rules currently require the complainant to send a copy of their complaint to the domain owner at the same time it is filed with the UDRP provider.
But the GNSO has now recommended getting rid of this rule, stating: “as a best practice, complainants need not inform respondents that a complaint has been filed to avoid cyberflight.”
The registrant would be informed later by the UDRP provider instead.
Registrars would be prohibited from tipping off the registrant until the lock was in place.
The July 2013 recommendations (pdf) came out of a working group that was formed in April 2012, in response to policy ideas floated in 2011.
The GNSO’s resolution calls for ICANN staff to work with members of the working group on an implementation plan, which would eventually be put to the ICANN board for approval.
Once through the board, the new policy would become binding on all ICANN-accredited registrars.

New gTLD revenue projections revealed in leaked Famous Four presentation

Famous Four Media expects to make an average of almost $30 million revenue in year one from each of the new gTLDs it secures.
That’s according to a PowerPoint presentation (pdf), written for potential investors, that was provided by an anonymous source (I suspect not a fan of the company) to DI this week.
According to the presentation, “potential year 1 revenues for an average Registry” could amount to $28.4 million, the vast majority of which would come from sunrise, landrush and premium domain sales.
The presentation, dated June 2013, was prepared by Domain Venture Partners, the immediate parent of the 60 shell companies that Famous Four is using to apply for its 60 gTLDs.
The company was unable to provide an executive to discuss this story until August 14.
But according to the PowerPoint, the Domain Venture Partners II fund is an investment vehicle set up to “bridge the gap” in Famous Four’s funding requirements:

Domain Venture Partners II shall provide a unique structured regulated investment opportunity to participate in the new gTLD programme to provide secured fixed annual returns along with additional venture type returns at a time in the process where most of the major risks have been removed.

DVP is looking to raise up to $400 million, having raised £48.3 million ($73.2 million) in 2011 via the Domain Venture Partners I fund, it says. The current round opened in March and is expected to close in November.
Famous Four has applied for 60 gTLDs — mostly highly sought-after strings such as .poker, .music, .shop, .search and .buy — 10 of which were initially uncontested.
According to the presentation, landrush period auctions would account for about a third of year-one revenue in each gTLD: $9.7 million. That’s based on selling 45,697 domains for an average price of $213.34.
Revenue from trademark owners is the second-largest chunk. An average sunrise period could raise $6.9 million, assuming 39,679 domains at an average of $173.5 each, according to the PowerPoint.
Sales of regular domains during the first first year of general availability could raise $4.1 million, based on 225,759 registrations at $18.47 apiece, the presentation says.
Here’s the full slide, one of 33 in the deck:

The presentation says that the projections are “based on historical data points established by the existing operational gTLD Registries”, adding:

The figures are averages and therefore would represent projections for a standard gTLD Registry. Potential year 1 revenues for specific Registries may be below or above this average.

Some of the numbers strike me as optimistic. While the likes of .asia and .mobi may have seen these registration volumes due to the novelty and scarcity of new gTLD namespaces, my feeling is that those days are over.
The new gTLD program is likely to see scores of overlapping sunrise and landrush periods; it’s difficult to see registries benefiting from the same focus and excitement as their predecessors.
There’s a limited amount of domainer capital to spread around landrush sales and trademark owners are likely to be much more selective about where they defensively register their brands in a world of 1,300 gTLDs.
That said, Famous Four has applied for some of the nicest strings in the round so I may be wrong.
An appendix to the presentation discussing the first DVP funding round says that while Famous Four hopes to sign contracts for 30 new gTLDs, it has only secured 32% of the money it is looking for.
Securing investment appears to have been tough due in part to the complexity of the ICANN process and investors’ lack of familiarity with it, which looks like risk. It also says:

The costs associated with applications in the new gTLD have increased, the financial strength of most applicants has been reduced and the knowledge barrier to entry is too high to interest large standard venture investors.

Famous Four’s business model is based around consolidation and keeping costs down, according to the pitch. For the most part, this is due to the economies of scale of running a large number of TLDs.
With Neustar as its back-end provider, Famous Four says it has found the “lowest fees in the industry”.
But the model also involves keeping tax to a minimum. Famous Four is based in Gibraltar, where it says it will pay no tax on domain sales:

FFM is operating in a fiscal environment that has multiple advantages over others in the industry. Domain names sales are treated as royalty income which is currently zero rated in Gibraltar. This would result in an instant bottom line gain.

There’s a strong suggestion in the presentation that DVPII is not limiting its ambitions to the new gTLDs it has applied for.
It also seems to discuss acquiring other applicants and ccTLD rights, then bringing them into the Famous Four fold, but the plan was not completely clear to me and executives were unavailable for clarification.

DotMusic loses LRO, and four other cases rejected

Constantine Roussos has lost his first Legal Rights Objection over the flagship .music gTLD.
The case, DotMusic v Charleston Road Registry (pdf) was actually thrown out on a technicality — DotMusic didn’t present any evidence to show that it was the owner of the trademarks in question.
But the WIPO panelist handling the case made it pretty clear that DotMusic wouldn’t have won on the merits anyway.
If any applicant can be said to have built a brand around a proposed generic-term gTLD, it’s Roussos. DotMusic has been promoting .music on social media an in the music industry for years.
The company also owns the string “music” in a number of second-tier TLDs such as .co, .biz and .fm.
It’s not a bogus, last-minute attempt to game the system, like the .home cases — filed using Roussos-acquired trademarks — that have been thrown out repeatedly over the last couple of weeks.
The panelist addressed this directly:

On the one hand, the Panel recognizes that there has been a real investment by the Objector and associated parties in the trademark registrations, domain name registrations, sponsorship and branding to create consumer recognition and goodwill entitled to protection. On the other hand, there is a circularity in the Objector’s position in that the rights upon which the Objector relies to defeat the application are to a certain extent conditional on the defeat of the Applicant and the Objector’s success in obtaining the <.music> gTLD string.

In other words, Catch-22.
The panelist decided that .music is generic, that Google’s proposed use of it is generic, and that obtaining a trademark on a gTLD should not be a legit way to exclude rival applicants for that gTLD.

One objective of the Objector has been to obtain precisely the type of competitive advantage (in this case in the application process for the <.music> gTLD string) that the doctrine of generic names is designed to prevent. However, as the Applicant proposes to use the <.music> gTLD string in a generic sense it is immune from this challenge.

On that basis, the LRO would have failed, had DotMusic managed to demonstrate standing to object in the first place.
Unfortunately, DotMusic didn’t present any evidence that it actually owned the trademarks in question, which were applied for by Roussos and assigned to his company CGR E-Commerce.
The objection failed on that basis.
Defender Security, which obtained trademarks on “.home” from Roussos, ran into the same problems proving ownership of the trademarks in its LROs on the .home gTLD.
Four other LROs were decided this week:
.mail (United States Postal Service v. GMO Registry)
The case (pdf) turned on whether USPS owns a trademark that exactly matches the applied-for string (it doesn’t) and whether the word “mail” should be considered generic (it is) rather than a source identifier (it isn’t).
It’s pretty much the same logic applied in the two previous .mail LROs.
.food (Scripps Networks Interactive v. Dot Food, LLC)
This is the first of two competitive LROs filed by Scripps — which runs TV stations including the Food Network — against its .food applicant rivals to be decided.
Scripps has a bunch of trademarks containing the word “food”, including a November 2011 registration in the US for “Food” alone, covering entertainment services.
The WIPO panelist found (pdf) that the trademark was legit, but decided that it was not enough to prevent Dot Food using the matching string as a gTLD.
The fact that rights protection mechanisms exist in the new gTLD program was key:

to the extent that registration and use of a particular second-level domain within the <.food> gTLD actually creates a likelihood of confusion, then Objector will have remedies available to it, including the established Uniform Domain Name Dispute Resolution Policy, the forthcoming Uniform Rapid Suspension System and relevant laws. The fact that such disputes at the second level may arise is inherent in ICANN’s new gTLD program and is not in the circumstances of this case sufficient to uphold the present legal rights objection.
Objector’s rights in the FOOD mark do not confer upon it the exclusive right to use of the word “food” in all circumstances, particularly where, as here, Applicant intends to use the <.food> gTLD in connection with the food industry. Such intended use of the word would appear to be only for its dictionary meaning and not because of Objector’s trademark rights.

.vip (i-Registry v. Charleston Road Registry)
It’s the second objection by .vip applicant to get thrown out. In this case the respondent was Google.
Like the first time, the WIPO panelist found that the i-Registry trademark had been obtained for the purposes of the new gTLD program and that Google’s use of it in its generic sense would not infringe its rights.
.cam (AC Webconnecting Holding v. Dot Agency)
The second and final LRO decision (pdf) in the .cam contention set.
AC Webconnecting, an operator of webcam-based porn sites, lost again on the grounds that it applied for its trademark just a month before ICANN opened up the new gTLD application window in January last year.
The company didn’t have time to, and produced no evidence to suggest that, it had used the trademark and built up goodwill around “.cam” in the normal course of business.
In other words, front-running doesn’t pay.