Will new gTLDs really increase phishing?

The US Federal Trade Commission has come out swinging against ICANN’s new generic top-level domains program, saying it will increase online fraud and should be scaled back.
In an open letter to ICANN’s top brass yesterday, the FTC’s four commissioners claimed that “the dramatic introduction of new gTLDs poses significant risks to consumers”.
Saying that more gTLDs will make it easier for scammers to acquire domain names confusingly similar to existing brands, the commissioners said the program should be rolled out as a limited pilot.
The FTC commissioners wrote (pdf):

A rapid, exponential expansion of gTLDs has the potential to magnify both the abuse of the domain name system and the corresponding challenges we encounter in tracking down Internet fraudsters. In particular, the proliferation of existing scams, such as phishing, is likely to become a serious challenge given the infinite opportunities that scam artists will now have at their fingertips. Fraudsters will be able to register misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down the site and launching a new one.

The letter demands better Whois accuracy enforcement, better ICANN compliance programs, and a cap on approved new gTLDs in the first round perhaps as low as a couple dozen.
The FTC’s claims that new gTLDs will increase phishing may not be supported by reality, however.
The latest data (pdf) from the Anti-Phishing Working Group shows that in the first half of the year only 18% of domain names used in phishing attacks were registered by the attacker.
That was down from 28% in the second half of 2010. Phishers are much more likely to compromise a domain belonging to somebody else – by hacking a web server, for example.
Of the 14,650 maliciously registered domains 10,444 (70%) were used to phish Chinese targets, “overwhelmingly” the e-commerce site Taobao.com, the APWG found.
Furthermore, only 2% of these domains – just 1,816 over six months – were judged to have been registered due to their confusing similarity with the brands they target.
The APWG said (emphasis in the original):

These are the lowest numbers we have observed in the last past four years, and show that using domain names containing brand strings has fallen further out of favor among phishers.
…
the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories

The APWG found only one gTLD that ICANN has introduced – .info, with 4.5% – in its top ten phishing TLDs. The .com space accounts for 48.9% of all phishing domains.
Will the increase in the number of gTLDs reverse these trends? The FTC seems to think so, but the claims in its letter appear to be based largely on guesswork and fear rather than data.
I suspect that the FTC’s letter is more concerned with ICANN’s ongoing bilateral talks with registrars over law enforcement-demanded amendments to the Registrar Accreditation Agreement.
These talks are completely separate and distinct from the new gTLDs program policies, but in the last few weeks we’ve seen them being repeatedly conflated by US lawmakers, and now the FTC.
This may be ignorance, but it could just as well be an attempt to apply political pressure on ICANN to make sure the RAA talks produce the results law enforcement agencies want to see.
ICANN does not want to be forced into an embarrassing retreat on its hard-fought gTLD expansion. By producing a strong RAA, it could deflect some of the concerns about the program.

Half the industry fighting over EBERO contracts

ICANN received a whopping 14 responses to its recent request for emergency back-end registry operators, contracts that could turn lucrative if and when new gTLDs start going out of business.
Following a request for information last month, responses received before the December 5 deadline came from Europe, Asia and North and South America, ICANN’s Karla Valente blogged.
While 14 may not seem like a lot, I’m only aware of 19 companies that are actively marketing new gTLD back-end registry services, so it’s a pretty high response rate.
The EBERO’s job is to make sure domain names continue to work after a new gTLD registry goes out of business. In the worst case scenario, it keeps the names resolving for up to three years, giving registrants the opportunity to migrate to another TLD.
The EBERO may, and I’m speculating here, also have an advantage in talks to take over the failed TLD full-time.
The successful providers will be paid from the Continuing Operations Instrument, a big chunk of cash that all new gTLD applicants are obliged to put aside to pay for their own funeral costs.
The price the successful EBEROs intend to charge is an important consideration when applicants calculate the size of their own COI, but those numbers have not yet been revealed.
The EBERO idea has come in for a bit of criticism due to ICANN’s high technical demands – 25,000 concurrent connections for an essentially stagnant TLD, for example – which some say favors incumbent registry operators such as VeriSign, Afilias and Neustar.
ICANN may wind up selecting more than one EBERO when it makes its decision early next year.

IGOs plead for special new gTLD protections

Twenty-eight intergovernmental organizations, including the UN, ITU and WIPO, have asked ICANN for special protection for their acronyms in the new top-level domains program.
A letter sent to ICANN earlier this week and obtained by DI, reads:

we formally request ICANN to make provision for a targeted exclusion of third party registrations of the names and acronyms of IGOs both at the top and second level, at least during ICANN’s first application round and until further appropriate policy could be developed.

It goes on to claim that fighting abusive domain registrations and enforcing rights diverts funds from causes such as famine relief, scientific research and children’s rights.
For the sake of brevity, this is the list of the letter’s signatories in acronym form only: AfDB, EBRD, ESO, CERN, ESA, IADB, IAEA, IFAD, ILO, IMO, IMF, IOM, ITU, NIB, NATO, OECD, OPCW, UN, UNESCO, UNIDO, UPU, WB, WHO, WIPO, WMO, UNWTO, and WTO.
The letter justifies its request by citing the rights given to IGO names under the Paris Convention for the Protection of Industrial Property.
It’s a pretty flimsy argument. The Paris convention does not give IGOs exclusive rights to strings. It may protect the World Bank abbreviation WB, for example, but not to the extent that Warner Brothers can’t also use it to market movies.
The letter also cites ICANN’s Governmental Advisory Committee, which called for IGOs to be protected in its March 2007 GAC Principles regarding New gTLDs advice.
The Principles, however, talk about IGOs in the same breath as regular trademark owners, which is exactly how the new gTLD Applicant Guidebook treats them today.
There is some ICANN precedent for giving in to this kind of special pleading, however.
The latest Guidebook makes several dozen trademarks relating to the Red Cross, Red Crescent and Olympic movements “ineligible for delegation” as gTLDs, but offers them no second-level protection.
It was noted at the time the decision was made – at the behest of the GAC – that giving the Olympics special treatment would create a slippery slope to a full-blown Globally Protected Marks List, a concept ICANN has already rejected.
The UN et al only really have a shot at getting what they want if they can get the GAC on side, and several influential GAC members have already stated that the Olympic/Red Cross case was unique.
I think the response from ICANN will be a letter from president Rod Beckstrom politely declining the request and inviting its signatories to participate in the ICANN community.

Congressmen ask for new gTLDs delay

ICANN should consider delaying the launch of its new top-level domains program, a number of US lawmakers said at a House of Representatives committee hearing today.
If the Senate’s hearing on new gTLDs last week could be characterized as a “win” for ICANN, today’s House meeting probably went in favor of its adversaries in the Association of National Advertisers.
“I don’t think it’s ready for prime time,” Rep. Anna Eshoo said during the Energy & Commerce Committee hearing. “I suggest that it is delayed until consensus is developed among relevant stakeholders.”
That’s exactly what the ANA and the Coalition for Responsible Internet Domain Oversight wanted to hear, and her views were echoed by several other Congresspeople, using similar language.
ICANN’s senior vice president Kurt Pritz, who was put forward to defend the new gTLD program in Washington DC for the second consecutive week, disagreed.
“This process has not been rushed, it’s been seven years in the making,” he said. “All the issues have been discussed and no new issues have been raised.”
National Telecommunications and Information Administration associate administrator Fiona Alexander, there to defend the ICANN process if not its results, observed that “consensus” does not necessarily always mean “unanimity”.
The hearing also heard from Josh Bourne of the Coalition Against Domain Name Abuse, a long-time critic of ICANN and new gTLDs.
CADNA has recently taken a more pragmatic view of the program, coinciding with sister group Fairwinds Partners’ decision to emerge as a new gTLD consultancy.
Bourne therefore found himself not only defending the program but also praising .xxx, saying that its novel trademark protection mechanisms should be mandatory in new gTLDs.
CADNA’s main demand nowadays is for clarity into the dates of subsequent application rounds, which Bourne said would relieve the “condition of scarcity” that the uncertainty has created.
Bourne also said that Congress could fight fraud by revising the the 12-year-old US Anticybersquatting Consumer Protection Act.
Also on the panel as an opponent of the program was Anjali Hansen, an IP attorney with the Better Business Bureau, who came to complain about the cost of defending the “BBB” trademark.
Hansen’s testimony was essentially worthless. When she was not complaining about fraudsters infringing copyright on BBB’s logo (obviously irrelevant in the context of domains) she seemed to be claiming that the Better Business Bureau has exclusive rights to the string “BBB”.
As Pritz noted later, there are 50 registered trademarks for “BBB” – I’ve counted about 18 live ones in the US alone – and any one of those trademark owners would be able to object to .bbb.
There was also substantial confusion about the state of the program. Congressmen conflated separate controversies in order to support the view that new gTLDs should be delayed.
As I’ve noted before, there’s a worrying lack of detail on certain outstanding issues – such as continuity funding requirements – but Congressmen had evidently been fed different talking points and therefore peppered Pritz with questions about the state of ICANN’s negotiations to amend the Registrar Accreditation Agreement, an unrelated matter.
If two themes could be said to have emerged from the hearing, and last week’s Senate hearing, often expressed by the same Congressmen or witnesses, I’d say they were:
First, ICANN should make it harder for criminals to abuse new gTLDs.
Second, ICANN should make it cheaper and easier to obtain new gTLDs.
I would point out that a certain degree of doublethink is required to hold both positions true, but to do so would imply that the necessary singlethink had been done already.

ICANN leaves new gTLD batching and support questions hanging

ICANN came closer to answering two very important questions about the new top-level domains application process at its board meeting last Thursday.
While confirming that cheaper application fees will be made available to worthy applicants, and that some sort of batching system will be introduced, ICANN has provided worryingly few details about both systems, just a month before the new gTLD program starts.
Application batching
ICANN is currently expecting over 1,000 new gTLD applications, but it’s said that it only has the capacity to process 500 at a time. It needs a way to fairly create two or more batches.
Commercial applicants obviously want their gTLDs processed and delegated as quickly as possible, so how the batches are created is obviously a critical detail.
Little progress has been made on this issue since Dakar.
A lottery has been ruled out, according to Thursday’s board resolutions, because it would be likely to attract nuisance lawsuits under California gambling law.
If you’ve been following ICANN closely for the last few months, or reading DI, you already knew this.
The board has also said that there will be no benefit to applying early during the January-April application window. We already knew this too.
Instead, as ICANN staff have said before and the board has now approved, there will be a “secondary time stamp … used for purposes of determining the processing order”.
This system has evidently not been finalized yet. Nevertheless, the resolution contains a few hints about how it might work.
First, the TLD Application System will not be used to acquire the stamps, but it may be used to communicate [something] with applicants.
Acquiring a stamp will require “judgment” by applicants. Getting into the first batch will apparently be a skill game, so as to not invite lottery lawsuits.
There will also be some kind of regional allotment system, so that applicants from outside Europe and North America have just as good a chance of getting into the first batch.
Finally, there will be an opt-out mechanism, so applicants with less urgent applications (.brands, perhaps) can choose to be batched later.
It’s not much to go on, but since the process of acquiring a time stamp will not come into play until after April 12, it’s not something applicants need to worry too much about at the moment.
It’s also not yet clear whether positions in the queue will be transferable. A slot in the first batch could be worth something, to some applicants.
Applicant Support
A mechanism for granting reduced fees to “needy” applicants in the developing world has been on the cards for a while. ICANN set aside $2 million in June to fund an Applicant Support program.
On Thursday, its board of directors approved an application fee reduction from $185,000 to $47,000, for “candidates that qualify according to the established criteria”.
While full details of these criteria have not been revealed, the board resolution suggests that “demonstrating need and operating in the public benefit” are the primary factors.
It’s not clear any more that the support program will be limited to applicants in the developing world, as had been recommended by the Joint Applicant Support working group.
The resolution does not mention geography, and senior VP Kurt Pritz suggested at last week’s US Senate hearing into new gTLDs that the YMCA of the USA may qualify for the reduced fee.
It appears that applicants wanting to take advantage of the reduced fee will have to take a bit of risk, however, paying their $47,000 fee up-front on the understanding that they will lose their money and their application if they are subsequently deemed unworthy of support.
Applicants will not find out if they’ve made the cut until November 2012.
ICANN’s $2 million only covers reduced fees for 14 applicants, and it’s not yet clear what would happen if more than 14 candidates qualify and ICANN cannot find third-party funding to support them.
Essentially, it’s looking a bit messy at the moment, and non-profits are only a little closer to understanding what their funding requirements might be today than they were last week.

Wanted: new CEO for ICANN

ICANN has hired a recruiting firm and posted a job ad, officially kicking off its hunt for a CEO to replace Rod Beckstrom when he leaves next summer.
The organization has posted a candidate profile, listing 25 personal, professional, technical and governance skills that are desirable.
Candidates should have a “solid record of either/or public, corporate, academic service, at a high international level” and be able to combine “weight of personality with empathy towards others of many different backgrounds”.
They should also understand the internet’s technical protocols and have knowledge of international institutions such as the UN, according to the profile.
“Few if any candidates will of course match every single criterion listed above, but those who reach the final shortlist are expected to score very highly against them,” it states.
The Brussels-based executive search firm Odgers Berndtson has been recruited to handle applications, ICANN said.
Beckstrom himself has previously said that he thinks his replacement should come from outside the domain name industry, but this is not stated as a requirement on the profile.

Beckstrom to keynote London new gTLDs conference

ICANN CEO Rod Beckstrom will address a half-day conference on new generic top-level domains in London next month, just a few days before ICANN’s application window opens.
The Top Level, scheduled for January 9, is being hosted by Norwegian registry services provder CloudNames, the PR agency Burson-Marsteller and international law firm DLA Piper.
Each company also has an executive speaking, and then there’s a panel discussion.
Although BM is on ICANN’s payroll, having been recently named the recipient of a $900,000 outreach budget, it appears that the conference is not an ICANN initiative.
Tickets for the five-hour event are being sold for €490, or €441 for “early bird” registrations.
It will be presumably one of the last conferences Beckstrom will keynote on his world tour before ICANN starts accepting new gTLD applications, January 12.

US says it will not block the new gTLD program

NTIA boss Larry Strickling has come out in support of ICANN and its new top-level domains program, warning that its opponents “provide ammunition” to authoritarian regimes.
Speaking in Washington DC yesterday, Strickling warned that organizations fighting to put a stop to the new gTLD program risk provoking a UN takeover of the internet.
In a strongly worded defense of the six-year-old ICANN multistakeholder process that created the program, he said:

we are now seeing parties that did not like the outcome of that multistakeholder process trying to collaterally attack the outcome and seek unilateral action by the U.S. government to overturn or delay the product of a six-year multistakeholder process that engaged folks from all over the world.
The multistakeholder process does not guarantee that everyone will be satisfied with the outcome. But it is critical to preserving the model of Internet governance that has been so successful to date that all parties respect and work through the process and accept the outcome once a decision is reached.
When parties ask us to overturn the outcomes of these processes, no matter how well-intentioned the request, they are providing “ammunition” to other countries who attempt to justify their unilateral actions to deny their citizens the free flow of information on the Internet.
This we will not do. There is too much at stake here.

Strickling is assistant secretary at the National Telecommunications and Information Administration, which oversees the US government’s relationship with ICANN and IANA.
He’s made similar remarks in support of the multistakeholder model in the past, but never quite as firmly or directly aimed at opponents of the new gTLD expansion.
While he was diplomatic enough not to single out any one group, he was pretty clearly referring to the recently formed Coalition for Responsible Internet Domain Oversight.
CRIDO was formed by the Association of National Advertisers to fight new gTLDs. Yesterday, it had its day on Capitol Hill, but failed to convince Senators that the program should be stopped.
But Strickling did sound a note of caution about new gTLDs, saying that he agreed with Sen. Jay Rockefeller, who expressed concern about possible negative impacts of the expansion:

We agree with the Chairman’s concerns over how this program will be implemented and its potential negative effect if not implemented properly. We will closely monitor the execution of the program and are committed to working with stakeholders, including U.S. industry, to mitigate any unintended consequences.

But the minutiae of the Applicant Guidebook was not Strickling’s focus. Instead, it was the wider political picture.
The threat of an International Telecommunications Union takeover of the internet’s policy-making functions has plagued ICANN for almost as long as it has existed.
Strickling noted that the ITU’s World Conference on International Telecommunications is coming up one year from now, and that some nations will attempt to usurp ICANN.

Some nations appear to prefer an Internet managed and controlled by nation-states.
…
We expect that some states will attempt to rewrite the regulation in a manner that would exclude the contributions of multistakeholder organizations and instead provide for heavy-handed governmental control of the Internet.

For the ANA and CRIDO, Strickling’s remarks are a huge setback.
The ANA has previously said that it planned to use all three branches of the US political system — lobbying Congress and the NTIA, or taking ICANN to court — to achieve its ends.
The Senate clearly wasn’t interested yesterday and the NTIA has now confirmed that it’s on ICANN’s side.
That leaves only one option.

NRF director joins .shop applicant

Commercial Connect, one of the companies planning to apply to ICANN for the new top-level domain .shop, has appointed a US National Retail Federation Foundation director to its board.
Richard Last is also chairman emeritus of Shop.org and has a long history in retail, according to a Commercial Connect press release.
The NRF has been one of the more outspoken critics of the new gTLD program recently. While the organization does not oppose it outright, it does believe the program needs to be delayed.
GMO Registry also intends to apply for .shop, and has arguably been the higher-profile of the two public applicants, going so far as to sponsor ICANN events under the .shop brand.

Notes from the Senate new gTLDs hearing

The US Senate’s Commerce Committee held a hearing into ICANN’s new generic top-level domain program today, following pressure from the Association of National Advertisers.
It must have been a busy day on Capitol Hill. Not only was the hearing delayed by 45 minutes, but when it did begin only four or five Senators showed up to speak.
Committee chair Sen. Jay Rockefeller put his head through the door just long enough to deliver a prepared statement, leaving Sen. Amy Klobuchar to lead the rest of the hearing.
It was a relatively subdued and hurried affair that heard for the most part some extremely well-worn arguments about the potential benefits and risks of new gTLDs.
Nevertheless, the hearing did generate a few headline moments. These are my first impressions.
Rockefeller in pro-gTLD shocker
Given that the hearing was called at the behest of ICANN’s critics, it was slightly surprising that the Committee’s chairman gave a generally pro-expansion statement.
Sen. Rockefeller said he was generally in favor of new gTLDs, believing them to be pro-competition and pro-innovation, but suggested that the roll-out should be slower and more cautious.
“I think we’ll have to get used to .hotel, I think we’ll have to get used to .auto,” he said.
“If ICANN is determined to move forward, it should do so slowly and cautiously,” he said. “The potential for fraud, consumer confusion, and cybersquatting is massive and argues for a phased in implementation. Scaling back the initial round of new top level domains introduced in 2013 may be a prudent approach.”
ICANN expects about 1,000 applications
Senior vice president Kurt Pritz gave the latest ICANN guesstimate about how many new gTLD applications it expects to receive in the first round.
That number is 500 to 1,000, maybe a little more but “not thousands”, he said, noting that the estimate was completely based on hearsay.
New ICANN conflict of interest rules
ICANN’s board of directors evidently voted to restrict their post-ICANN employment opportunities at the board meeting earlier today, if Pritz’s testimony is an accurate guide.
He said that directors will not be able to work for any new gTLD operator that they have voted to approve for 12 months after they leave ICANN.
Cheaper application fees for worthy applicants
Again scooping the publication of today’s ICANN board meeting resolutions, Pritz revealed that application fees are going to be reduced from $185,000 to $47,000 for needy applicants.
This suggests heavily that ICANN figured out a way to accommodate the recommendations of the Joint Applicant Support working group, which proposed a number of measures aimed at reducing the financial burden for applicants in developing nations.
There was no word from Pritz about which organizations or nations will be eligible for the reduction, however.
The ANA compares senators to Disney characters
At one point, the ANA’s Dan Jaffe wheeled out a slide bearing a picture of Donald Duck and Mickey Mouse, to illustrate the problem of inaccurate Whois information.
He was addressing Sen. Maria Cantwell and Sen. Kelly Ayotte, both of whom asked questions about fraud and both of whom use Whois privacy services on their official campaign web sites.
I found this immensely amusing.
Dyson speaks for the little guy (if he has a trademark)
Former ICANN chair Esther Dyson said in her opening testimony that she was the only person at the hearing there to represent public opinion, rather than that of big business.
She then went on to complain, with a straight face, about all the trademark enforcement headaches big business will have to deal with in a world of hundreds of new gTLDs.
She’s particularly miffed, as a director of a company called Meetup, that ICM Registry has reserved meetup.xxx as a premium domain name.
Meetup will probably sue whoever buys the name for trademark infringement, she indicated.
Way to stick it to The Man, Esther!
Wither IDNs?
Non-Latin-script gTLDs were not discussed in any depth during the hearing, meriting only one or two mentions.
That’s unusual, given that IDN gTLDs are the one benefit of the ICANN program that not even intellectual property interests have dared to argue against.
Next steps
The ANA and the YMCA want somebody to put a stop to the new gTLD program, or to at least delay it.
Dyson suggested that for the US to unilaterally intervene might be a bad idea, politically.
When asked whether the Department of Commerce would be able to stay ICANN’s hand, Commerce representative Fiona Alexander ducked the question.
With a handful of exceptions, nobody on the Senate committee seemed to care enough about the subject to show up and ask questions.
I think this probably counts as a win for the pro-expansion camp.
There is however another hearing, this time before the House Energy and Commerce Committee, next week. If recent history is any guide, we’re likely to be in for more of the same.