The DI Dakar Drunk-Dial Domain Dirt Dropbox

For the first time since DomainIncite launched, I’m skipping an ICANN meeting.
While many regular readers will be landing in Dakar, Senegal, over the next few days, I’ve decided this time to cover the meeting remotely.
For a reporter, in many ways remotely participating in ICANN meetings is a far easier proposition than actually being on the ground.
There’s no running around looking for power points to charge the laptop, no sweltering heat or icy air-con to contend with, no risk of almost getting mugged because you could only afford a hotel in the cheap end of town, very little danger of being forced to speak French.
The drawback of course is that the true value of an ICANN meeting isn’t in the uniformly webcast or magically transcribed sessions themselves.
It’s in the furtive hallway conversations, the over-the-shoulder whispered comments, the drinking banter and the passionate after-hours debates in the hotel bar.
I’m going to miss all that this time around.
To compensate, I’d like to announce the launch of the DI’s very own “remote participation” mechanism.
Let’s call it the DI Dakar Drunk-Dial Domain Dirt Dropbox or, if you like acronyms, the DIDDDDDD.
Hear a bit of good gossip in the bar? Maybe there’s a rumor about a new gTLD applicant, rumblings about disquiet in the GAC, a potential new ICANN CEO candidate…
Simply email your nugget to drunkgossip@domainincite.com and I’ll treat it every bit as confidentially as I would if I was standing right next to you with a bottle of Bière la Gazelle in my hand.
To make things more interesting, for every email sent to this address during Dakar, I’ll chug two fingers or down a shot.
Day or night, I promise.

Orange sponsors ICANN 42

The telecoms firm Orange has become a platinum sponsor of ICANN’s 42nd public meeting in Dakar, Senegal next week.
It’s a rare example of a company from outside the domain name industry handing over the big bucks to associate itself with ICANN.
While the company says it’s doing it for branding purposes, I’m sure it’s likely to set tongues wagging that Orange is a potential candidate for a .brand top-level domain.
If .apple is the no-brainer that is constantly used in articles to illustrate what a .brand is – and to highlight possible contention/objection issues – then .orange surely falls into the same category.
Platinum sponsorship for the Dakar meeting, which kicks off at the weekend, starts at $75,000. There are no takers for any of the other more-expensive sponsorship tiers this time.
Others paying up at this level are VeriSign, as usual, and the Public Interest Registry, which is publicizing its .ngo (non-governmental organizations) gTLD application.

Aussies to apply for four geo-TLDs

The Australian state governments of New South Wales and Victoria have put out a tender for a registry provider for up to four new top-level domains.
They want to apply to ICANN next year for geographic gTLDs including .victoria, .sydney, .melbourne and possibly .nsw, according to the RFP.
The new gTLDs would be self-funded commercial ventures, with some names reserved for public use, it says. Revenue would be shared between the government and the operator.
If a local presence is taken into account then ARI Registry Services, which recently changed its name from AusRegistry International to dilute the perception that it was too Australia-focused, could be considered a likely front-runner for the gigs.
The tender closes November 15.

With 86 days to go, the cost of new gTLDs is still unknown

If you’re planning to apply for a new generic top-level domain or two, wouldn’t it be nice to know how much it’s going to cost you?
It’s less than three months before ICANN opens the floodgates to new gTLD applicants, but you’re probably not going to find out how big your bank account needs to be until the last minute.
With 86 days on the clock until the application window opens, and 177 until it closes, there are still at least two huge pricing policies that have yet to be finalized by ICANN.
The first relates to reduced application fees and/or financial support handouts for worthy applicants from developing nations. I’ll get to that in a separate piece before Dakar.
The second is the controversial Continued Operations Instrument, a cash reserve designed to ensure that new gTLDs continue to operate even if the registry manager goes out of business.
In the current Applicant Guidebook, prospective registries are told to prove that they have enough money – either with a letter of credit or in a cash escrow – to keep their gTLD alive for three years.
To be clear, the COI money doesn’t go into ICANN’s coffers; applicants just need to show that the cash exists, somewhere.
The funds would be used to pay the Emergency Back-End Registry Operator (whichever company that turns out to be) in the event of a catastrophic gTLD business failure.
With hundreds of new gTLDs predicted, many of them likely to be laughably naive, we’re likely to see plenty of such failures.
With that in mind, ICANN wants to make sure that registrants and end users are not impacted by too much downtime if they put their faith in incompetent or unlucky registries.
It is estimated that the COI will amount to a six-figure sum for almost all commercial registries. For generics with a higher projected registration volume it could easily run into the millions.
It’s controversial for a number of reasons.
First, it raises the financial bar to applying considerably.
Forget the $185,000 application fee. Under the COI provision, applicants need to be flush enough to be able to leave millions of dollars dormant in escrow for at least five years.
It’s been sensibly argued that this money would be better devoted to making sure the registry doesn’t fail in the first place.
Second, even though the Guidebook gives .brand applicants the ability to shut down their gTLDs without the risk of another provider taking them over, it also expects them to create a COI.
This appears to be an unnecessary waste of cash. If a single-registrant .brand gTLD fails, the registry itself is the only registrant affected and the COI is essentially redundant.
Third, some applicants are thinking about low-balling their business model projections in order to keep their COI to a manageable amount.
This, as the better new gTLD consultants will tell you, could be a bad idea. When applications are reviewed the evaluators will be looking for discrepancies like this.
If you’re making one set of financial projections to investors and another to ICANN, you risk losing points on and possibly failing the evaluation.
Anyway, with all this in mind (and with apologies for burying the lead) ICANN has just said that it’s thinking about completely revamping the COI policy before applications are accepted.
Seriously.
ICANN’s Registry Stakeholder Group community has made a proposal – which appears to be utterly sensible on the face of it – that would reduce costs by pooling the risk among successful applicants.
The RySG said it that the COI “should not be so burdensome as to actually become a roadblock to the success of new registries by causing capital to be tied up unduly.”
Rather than putting up enough cash to cover its own failure, each successful applicant would pay $50,000 up-front into a Continued Operations Fund that would cover all potential registry failures.
The COF would be administered by ICANN (or possibly a third party), and would be capped at $20 million. In a round of 400 new gTLDs, that target would be reached immediately.
If the COF fell short of $20 million, each registry would have to pay $0.05 per domain name per year into the fund until the cap was reached.
It’s a shared-risk insurance model, essentially.
While ICANN’s COI policy is ultra-cautious, implicitly assuming that ALL new gTLDs could simultaneously fail, the COF proposal assumes that only a small subset will.
Reverse-engineering the RySG’s numbers, the COF appears to cover the risk of failure for registries representing some 10 million domain-years.
ICANN has opened up the proposal to public comments until December 2.
This means we’re unlikely to see any concrete action to approve or reject the COF alternative until, at the earliest, about a month before the first round application window opens.
ICANN likes cutting things fine, doesn’t it?

ICANN steps in front of astrology lawsuit

ICANN has agreed to take over a critical online time zone database, after its original operators were sued for copyright infringement by an astrology software company.
The organization said last night that it will start to manage the Internet Time Zone Database, following the retirement of Arthur David Olson, who has managed it for nearly 30 years at the US National Institutes of Health.
“The Time Zone Database provides an essential service on the Internet and keeping it operational falls within ICANN’s mission of maintaining a stable and dependable Internet,” ICANN COO Akram Atallah said.
While it’s possible that ICANN will face criticism for this apparent case of “mission creep”, the move could actually be pretty good news for new top-level domains applicants.
The tz database is used by countless applications and platforms. It’s baked into Java, PHP, Perl, Python, .NET, PostgreSQL and BSD-derived operating systems including Mac OS X.
If ICANN is able to leverage those relationships, it may be able to increase adoption of its Universal Acceptance of TLDs project, an authoritative database of all live TLDs.
This could help new gTLDs, primarily those longer than three characters, have a smoother ride in terms of compatibility with internet software.
But the real reason for the handover to ICANN at this time appears to be the fact that Olson was sued at the end of September by Astrolabe, a Massachusetts-based provider of astrology software.
Astrolabe claims (pdf) it has copyright on some facts about historical time zone information, and has sued Olson for an injunction and damages
The lawsuit prompted the removal of the FTP site where the database is hosted, and oodles of bad karma for Astrolabe after the suit was reported in The Register.
So has ICANN just risked having its name added to the lawsuit in order to ensure the ongoing stability of the time zone database? Is it taking one for the team? It certainly appears so.
According to Astrolabe’s latest observations:

Conditions are confused and uncertain. Feelings run high. Perceptions are altered, leading to misunderstandings. Imagination, escapism, and gullibility are factors to contend with.

Indeed.

ICANN directors ruled out of CEO search

ICANN’s directors have been barred from applying for the soon-to-be-vacated CEO position.
The board elected a panel of directors to get the CEO search underway last Tuesday, but noted:

no current or incoming member of the Board or liaisons may be considered as a candidate for the role of the CEO for the current CEO Selection process.

A replacement for Rod Beckstrom, who announced that he will step down when his contract expires next June, will now be overseen by a special CEO Search Process Management Work Committee.
The committee will comprise: Steve Crocker, Bertrand de La Chapelle, Erika Mann Chris Disspain, Cherine Chalaby, Ray Plzak and R. Ramaraj. George Sadowsky will chair.
I had previously put at least three of those on my speculative list of “insiders” who could conceivably apply for the CEO’s job.

VeriSign yanks domain seizure power request

That was quick.
VeriSign has withdrawn its request for new powers to delete domain names being used for abusive purposes, just a few days after filing it with ICANN.
The company had proposed a policy that would give law enforcement the ability to seize .com and .net names apparently without a court order, and a new malware scanning service.
The former came in for immediate criticism from groups including the American Civil Liberties Union and the Electronic Frontier Foundation, while the latter appeared to have unnerved some registrars.
But now both proposals have been yanked from ICANN’s Registry Services Evaluation Process queue.
This is not without precedent. Last year, VeriSign filed for and then withdrew requests to auction off one-letter .net names and a “Domain Name Exchange” service that looked a bit like domain tasting.
Both came in for criticism, and have not reappeared.
Whether the latest abuse proposals will make a reappearance after VeriSign has had time to work out some of the more controversial kinks remains to be seen.

Registrars not happy with VeriSign abuse plans

VeriSign has been talking quietly to domain name registrars about its newly revealed anti-abuse policies for several months, but some are still not happy about its plans for .com malware scans.
The company yesterday revealed a two-pronged attack on domain name abuse, designed to counteract a perception that .com is not as secure a space as it should be.
One prong, dealing with law enforcement requests to seize domains, I covered yesterday. It’s already received criticism from the Electronic Frontier Foundation and American Civil Liberties Union.
The other is an attempt to introduce automatic malware scanning into the .com, .net and .name spaces, rather like ICM Registry has said it will do with all .xxx domains.
Unlike the daily ICM/McAfee service, VeriSign’s free scans will be quarterly, but the company intends to also offer a paid-for upgrade that would search domains for malware more frequently.
On the face of it, it doesn’t seem like a bad idea.
But some registrars are worried about the fading line between registrars, which today “own” the customer relationship, and the registries, which for the most part are hidden away in the cloud.
Go Daddy director of network abuse Ben Butler, asked about both of yesterday’s VeriSign proposals, said in a statement that they have “some merit”, but sounded several notes of caution:

This is going to make all registrars responsible for remediation efforts and negative customer-service clean up. The registrar at this point becomes the “middle man,” dealing with customers whose livelihood is being negatively impacted. As mentioned in their report, the majority of sites infected with malware were not created by the “bad guys.”
While there is an appeal process mentioned, it could take some time to get issues resolved, potentially leaving a customer’s website down for an extended period.
This could also create a dangerous situation, allowing registries to gain further control over registrars’ operations – as registrars have the relationship with the registrant, the registrar should be responsible for enforcing policies and facilitating remediation.

It has also emerged that VeriSign unilaterally introduced the malware scanning service as a mandatory feature of .cc and .tv domains – which are not regulated by ICANN – earlier this year.
The changes appear to have been introduced without fanfare, but are clearly reflected in today’s .tv registration policies, which are likely to form the basis of the .com policies.
Some registrars weren’t happy about that either.
Six European registrars wrote to VeriSign last month to complain that they were “extremely displeased” with the way the scanning service was introduced. They told VeriSign:

These changes mark the beginning of a substantive shift in the roles of registries regarding the monitoring and controlling of content and may lead to an increase of responsibility and liability of registries and registrars for content hosted elsewhere. As domain name registrars, we hold the position that the responsibilities for hosted content and the registration of a domain name are substantially different, and this view has been upheld in European court decisions numerous times. In this case, Verisign is assuming an up-front responsibility that surpasses even the responsibilities of a web hoster, and therefore opens the door to added responsibilities and legal liability for any form of abuse.
…
In the end, the registrar community will have to face the registrant backlash and criticism, waste countless hours of support time to explain this policy to the registrants and again every time they notice downtimes or loss of performance. These changes are entirely for the benefit of Verisign, but the costs are delegated to the registrants, the registrars and the hosting service providers.

The registrars were concerned that scanning could cause hosting performance hits, but VeriSign says the quarterly scan uses a virtual browser and is roughly equivalent to a single user visit.
They were also worried that the scans, which would presumably ignore robots.txt prohibitions on spidering, would be “intrusive” enough to potentially violate European Union data privacy laws.
VeriSign now plans to give all registrars an opt-out, which could enable them to avoid this problem.
It looks like VeriSign’s plans to amend the Registry-Registrar Agreement are heading for ICANN-overseen talks, so registrars may just be digging into a negotiating position, of course.
But it’s clear that there is some unease in the industry about the blurring of the lines between registries and registrars, which is only likely to increase as new gTLDs are introduced.
In the era of new gTLDs, and the liberalization of ICANN’s vertical integration prohibitions, we’re likely to see more registries having hands-on relationships with customers.

VeriSign’s .com takedown power grab causing controversy

VeriSign’s request for a wide-ranging set of powers that would enable it to shut down .com and .net domain names that are suspected of abuse is already attracting criticism.
The proposals came in a Registry Services Evaluation Process request to ICANN that I reported on for The Register this morning.
It’s asking (pdf) to be able to create a new anti-abuse policy that would refocus many of the controls currently in the hands of registrars to the registry level instead.
The policy would “allow the denial, cancellation or transfer” of any VeriSign-managed domain if any any of these conditions were triggered:

(a) to protect the integrity, security and stability of the DNS;
(b) to comply with any applicable court orders, laws, government rules or requirements, requests of law enforcement or other governmental or quasi-governmental agency, or any dispute resolution process;
(c) to avoid any liability, civil or criminal, on the part of Verisign, as well as its affiliates, subsidiaries, officers, directors, and employees;
(d) per the terms of the registration agreement,
(e) to respond to or protect against any form of malware (defined to include, without limitation, malicious code or software that might affect the operation of the Internet),
(f) to comply with specifications adopted by any industry group generally recognized as authoritative with respect to the Internet (e.g., RFCs),
(g) to correct mistakes made by Verisign or any Registrar in connection with a domain name registration, or
(h) for the non-payment of fees to Verisign. Verisign also reserves the right to place upon registry lock, hold or similar status a domain name during resolution of a dispute;

As you can see, that’s a pretty broad range of justifications.
Notably, it would enable a domain to be canceled or transferred at the “requests of law enforcement or other governmental or quasi-governmental agency”, which would seem to circumvent the current practice of a court order being obtained before a domain is seized.
The question of what constitutes a “quasi-governmental agency” is also interesting. Is ICANN itself such a thing?
The policy would also enable a take-down “to avoid any liability, civil or criminal”, which seems to be just begging for VeriSign to be named spuriously in commercial lawsuits between .com registrants.
The RSEP also suggests that VeriSign plans to extend its hand of friendship to law enforcement agencies from outside the US:

Pilots with European Law Enforcement, Government CERTS and Registrars are planned, and other global test pilots will follow, to ensure global collaboration in the continuing development of the procedures.

Today, US agencies can get court orders instructing VeriSign to hand over domains. While imposing US law on .com owners from other countries is controversial, at least overseas registrants know where they stand.
Now VeriSign is talking about cooperating with European law enforcement agencies too.
At the risk of getting dangerously close to invoking Godwin’s Law, this brings us back to an old jurisdictional problem – what if the French police demand the seizure of a .com site selling Nazi memorabilia, which is illegal in France but legal in the US, for example?
Taking it a step further, what if VeriSign starts entertaining takedown requests from some of the world’s least pleasant theocracies, banana republics and dictatorships?
Half of .com could disappear overnight.
Since VeriSign has a business to run, that’s obviously not going to happen. So the company is going to have to draw a line somewhere, separating criminality from legitimate behavior and free speech.
I’m speculating wildly here, of course, but the RSEP doesn’t contain nearly enough detailed information about VeriSign’s proposed procedures to make a more informed analysis.
VeriSign knows what it is proposing is controversial. The RSEP says:

Registrants may be concerned about an improper takedown of a legitimate website. Verisign will be offering a protest procedure to support restoring a domain name to the zone.

The proposals have been made following many months of discussions between registries, registrars, law enforcement agencies and other community stakeholders.
It’s not entirely clear from VeriSign’s RSEP, which sometimes confusingly conflates the abuse policy with a separate proposed malware scanning service, how a takedown notice would be processed.
One likely reading is that VeriSign would act almost like a centralized clearinghouse for takedown requests, forwarding them to individual registrars for enforcement.
The registrars could be obliged by the terms of an amended Registry-Registrar Agreement to follow whatever process had been laid down.
There seems to be some concern in the ICANN community about this.
ICANN senior VP of stakeholder relations Kurt Pritz recently sent a document to PIR’s David Maher and Oversee.net’s Mason Cole outlining the procedure for amending the RRA.
The flowchart (pdf) describes a trilateral negotiation between the registry proposing the change, the Registrars Stakeholder Group and ICANN, with the ICANN board having the ultimate decision-making authority.
However this proceeds through ICANN, it’s going to cause some heated community debate.

ANA finds SEO more effective than Facebook

Advertisers are “beginning to question the effectiveness” of social media marketing, but they’re still mostly sold on the benefits of search engine optimization.
That’s according to a new study from the Association of National Advertisers, the results of which have just been published.
The ANA’s survey of 92 marketers gave SEO an “effectiveness rating” of 52%, the highest rating given to any of the six categories respondents were asked to comment on.
However, that represented a decline of three percentage points from a similar survey in 2009.
Social networking sites (presumably including Facebook, although names were not named) received an effectiveness rating of 28%, up from 17% two years ago, ANA reported.
SEO and social sites were used in marketing by 88% and 89% of respondents respectively.
ANA president Bob Liodice said in a press release:

While marketers have substantially increased their use of newer media platforms over the past few years, they are beginning to question the effectiveness of some of these vehicles. The ANA survey indicates a strong willingness by marketers to integrate innovative new approaches into their marketing mix; however, this enthusiasm is tempered by concerns regarding the return-on-investment of these emerging options.

While it’s all speculation at this point, SEO improvements are often pointed to as a potential (and I stress: potential) benefit of new dot-brand or category-killer top-level domains.
The ANA is the current opponent-in-chief of ICANN’s new gTLD program.