.xxx reveals new gTLD support problems

It’s late 2012. You’ve spent your $185,000, fought your way through objections, won your contention set, and proved to ICANN that you’re technically and financially capable of running a new generic top-level domain.
The registry contracts have been signed. But will your gTLD actually work?
The experiences of .xxx manager ICM Registry lately suggest that a certain amount of outreach will be needed before new gTLDs receive universal support in applications.
I’ve encountered three examples over the last few days of .xxx domain names not functioning as expected in certain apps. I expect there will be many more.
Skype. Type http://casting.com into a chat window and Skype will automatically make the link clickable. Do the same for the .xxx equivalent, and it does not.
Android, the Google mobile platform. I haven’t tested this, but according to Francesco Cetaro on Twitter, unless you manually type the http:// the domain doesn’t resolve.
TweetDeck, now owned by Twitter. It doesn’t auto-link or auto-shorten .xxx domains either, not even if you include the http:// prefix.
This problem is well known from previous new gTLD rounds. ICANN even warns applicants about it in the Applicant Guidebook, stating:

All applicants should be aware that approval of an application and entry into a registry agreement with ICANN do not guarantee that a new gTLD will immediately function throughout the Internet. Past experience indicates that network operators may not immediately fully support new top-level domains, even when these domains have been delegated in the DNS root zone, since third-party software modification may be required and may not happen immediately.
Similarly, software applications sometimes attempt to validate domain names and may not recognize new or unknown top-level domains.

As a 10-year .info registrant, I can confirm that some web sites will still sometimes reject email addresses at .info domains.
Sometimes this is due to outdated validation scripts assuming no TLD is longer than three characters. Sometimes, it’s because the webmaster sees so much spam from .info he bans the whole TLD.
This is far less of an issue that it was five or six years ago, due in part to Afilias’s outreach, but just this week I found myself unable to sign up at a certain phpBB forum using my .info address.
I understand ICM has also been reaching out to affected app developers recently to make them aware that .xxx now exists in the root and has resolvable domains.
ICANN also has released code in C#, Java, Perl, and Python (though not, annoyingly, PHP) that it says can be easily dropped into source in order to validate TLDs against the live root.
The last beta was released in 2007. I’m not sure whether it’s still under development.
(UPDATE: CentralNic CTO Gavin Brown has knocked up a PHP implementation here.)

Advertisers threaten to sue over new gTLDs

The Association of National Advertisers is threatening legal action unless ICANN “abandons” its recently approved new generic top-level domains program.
Its CEO, Robert Liodice, has written to his ICANN counterpart Rod Beckstrom outlining its litany of concerns about new gTLDs.
ANA’s strongly worded arguments will be familiar territory for anyone who has been following development of the program for the last few years.
It’s worried about cybersquatting, typosquatting, phishing, as well as the cost of defensive registrations and post-launch trademark enforcement.
The organization represents 400 companies that collectively spend $250 billion every year on their brands, according to the letter.
It also claims that ICANN shirked its duties by failing to adequately consider the economic impact of the program, and that it failed to develop it in a transparent, bottom-up manner.
Liodice wrote (pdf), with my emphasis:

ICANN must not ignore the legitimate concerns of brand owners and the debilitating effect on consumer protection and healthy markets its unsupervised actions will cause. Should ICANN refuse to reconsider and adopt a program that takes into account the ANA’s concerns expressed in this letter, ICANN and the Program present the ANA and its members no choice but to do whatever is necessary to prevent implementation of the Program and raise the issues in appropriate forums that can consider the wisdom, propriety and legality of the program.

The letter ends with a bunch of legal blah about ANA’s rights and remedies, a pretty obvious indication that it’s considering its legal position.
ICANN should “abandon” the program until ANA’s concerns have been addressed, Liodice wrote.
That’s not going to happen, of course.
There’s no way ICANN can put a halt to the program without basically admitting ANA’s analysis of it has merit.
If ANA wants to stop new gTLDs from going ahead, it’s going to need to do more than send a letter.
The letter is CC’d to the US Department of Commerce and several Congressmen, which suggests that we may see another Congressional hearing into the program before too long.
But will we see a lawsuit as well?
ICANN, at least, has anticipated the likelihood of having to defend itself in court for some time.
About 30% of the the $185,000 application fee – $30 million in a 500-application round – is allocated to various “risks”, of which a legal defense fund is one component.
I’d be surprised if ICANN’s legal team hasn’t war-gamed potential claims and defenses every time the Applicant Guidebook has been updated.
The next five months are going to be very interesting times.

ICANN appoints new Ombudsman

ICANN has named Kiwi lawyer Chris LaHatte as its new Ombudsman.
The appointment, which runs for an initial period of two years from July 28, was made during a board meeting last Thursday, and revealed today.
LaHatte said this of his qualifications, on the ICANN blog:

I am an experienced mediator and lawyer and have practiced in New Zealand, Taiwan and Central Asia. I qualified as a lawyer from the University of Auckland and earned a Masters Degree in Dispute Resolution from Massey University, with judicial settlement conferences as my thesis. I am a Fellow of the Arbitrators and Mediators Institute of New Zealand, a mediator for the New Zealand Law Society on cost issues and a construction law adjudicator.

While his experience appears to be primarily in the construction industry, he seems to have at least a bit of domain savvy already, given that he owns his last name under .co.nz.
LaHatte replaces interim Ombudsman Herb Waye, who stood in following the departure of his old Mountie colleague Frank Fowlie, ICANN’s first Ombudsman, who quit in January.
The Ombudsman role was set up to handle complaints about the organization. It is often criticized for being relatively toothless.

Big Content calls for government new gTLD oversight

The music, movie and advertising industries have backed a US move that could see governments getting more control over the approval of new top-level domains.
They’ve urged the National Telecommunications and Information Administration to keep a proposed rule that would force ICANN to show a new gTLD is in the “global public interest” before giving it the nod.
But they are opposed by many other stakeholders who responded to the NTIA’s Further Notice Of Inquiry on the renewal of ICANN’s IANA contract.
The FNOI resulted in about 35 responses, from companies and organizations on five continents.
The most controversial question posed by the NTIA was whether the IANA contract should include this provision:

For delegation requests for new generic TLDS (gTLDs), the Contractor [ICANN] shall include documentation to demonstrate how the proposed string has received consensus support from relevant stakeholders and is supported by the global public interest.

This was broadly interpreted as a way for governments to have a de facto veto over new gTLD applications, via ICANN’s Governmental Advisory Committee.
The proposed measure has now been supported by the Recording Industry Association of America, the Association of National Advertisers, and the Coalition for Online Accountability, which represents the music and movie industries.
Brand owners want another bite
In his strongly worded response, ANA president Robert Liodice wrote that the new gTLD program “is likely to cause irreparable injury to brand owners”, adding that it supported the NTIA’s proposal.

[It] provides a layer, however thin, of contractual protection that gTLDs will not be deposited to the authoritative root zone without appropriate justification. While the ANA believes that these protections are marginal at best, and that a more secure, safe and permanent solution must be found to prevent the harms to brand owners and consumers described above; nonetheless, “something is better than nothing”

Special interests
The RIAA said in its filing that it “strongly supports” the proposal, on the basis that it thinks .music, if approved as a gTLD, could lead to more online music piracy.

there are no concrete obligations in the latest application guidebook to implement heightened security measures for these types of gTLDs that are focused on particular industries such as record music. Given the the risk that such a gTLD application could pass through the ICANN process without committing to such measures, it should be incumbent on the IANA contractor to document how its entry into the root would meet the “global public interest” standard.

It’s a drum the RIAA, never afraid of making special-interest arguments on matters of internet governance, has been beating for some time.
It stopped short of asking for all existing TLDs (and IP addresses, in the case of peer-to-peer applications) to be banned outright, which would presumably do much more to prevent piracy.
Oh no you ditn’t!
The COA, which includes the RIAA among its members, has the honor of being the first of ICANN’s critics to raise the Peter Dengate Thrush Situation to officially bash the organization.
PDT, as you’ll recall, joined Minds + Machines, likely to be a volume gTLD applicant next year, just a few weeks after he helped push through ICANN’s approval of the gTLD program.
COA counsel Steve Metalitz wrote:

This development tends to confirm COA’s view that “the new gTLD process, like so much of ICANN’s agenda, has been ‘led’ by only a small slice of the private sector, chiefly the registrars and registries who stand to profit from the introduction of new gTLDs.”
…
If a “check and balance” on addition of these new gTLDs to the root was advisable prior to this announcement, it now appears to be indispensable.

Plenty of ICANN stakeholders on both sides of the new gTLD debate have been calling for a review of ICANN’s ethics policies recently, so the COA is far from alone in highlighting the perception problem PDT’s move, and others, may have created.
It looked dodgy, and people noticed.
But on the other hand…
Many responses to the FNOI take the opposing view – saying that the “global public interest” requirements appear to run contrary to IANA’s technical coordination mandate.
IANA’s statement of work, which mandates IANA staff independence from ICANN policy-making, seems like a very odd place to introduce a vague and highly policy-driven oversight check.
Opposition came from the gTLD registry community and likely applicants, as you might expect, as well as from a number of ccTLD operators, which was perhaps less predictable.
A typical response, from the ccNSO, was:

While recognising and supporting the need for ensuring that new gTLDs have consensus support and are consistent with the global public interest, the ccNSO suggests that the IANA contractor’s role should simply be to verify that ICANN has followed the Guidebook process and that all the evaluation criteria (not just the two referred to) have been met.

A number of responses also call for the strict separation of IANA staff from ICANN’s policy-making functions to be relaxed. The way the NTIA’s proposal is currently worded, it’s not clear if IANA’s experts would be able to provide their input to important work.

VeriSign boss leaves domain industry

Former VeriSign chief executive Mark McLaughlin, who resigned last week, is leaving the domain name industry entirely, signing up as the new CEO of Palo Alto Networks, a firewall vendor.
The privately held company is being tipped for an imminent IPO, which could mean a big stock payday for McLaughlin if executed successfully.
The Wall Street Journal quotes McLaughlin today as saying “the upside is on the equity side”.
Coming ahead of the launch ICANN’s top-level domains program, you could have been forgiven for thinking that McLaughlin may have been headhunted by a new gTLD player.
That would have been a heck of an endorsement of the commercial opportunity of new gTLDs, for the head of .com and .net to throw in with the newcomers.
But clearly McLaughlin has realized there’s more money in firewalls.
Smart man.
At VeriSign, founder Jim Bedzos has taken over as CEO while a permanent replacement for the 10-year VeriSign veteran is sought.

VeriSign CEO quits. But where’s he going?

VeriSign’s CEO and president Mark McLaughlin has quit the company for a CEO position at an undisclosed private company.
The news of his departure, after two years at VeriSign’s helm, came during the company’s second quarter earnings call yesterday.
McLaughlin’s been at VeriSign for over a decade. In his time as CEO, he oversaw a massive restructuring at the company.
VeriSign is now dramatically smaller – 1,000 people compared to 5,000 when he took over – following the sale of assets such as the security business, which Symantec bought.
His resignation is effective on Monday, but he’s told the company he’ll stick around until late August. Founder and chairman Jim Bedzos will become interim CEO while a replacement is found.
But where’s McLaughlin going?
The timing, less that six months before ICANN’s new top-level domains program kicks off, is certainly curious. It would be an unbelievable coup for a new gTLD firm to hire the former boss of .com.
A lot of people are switching companies at the moment, positioning themselves the best to exploit the new gTLD opportunity. (Anybody need a writer? I’m told my prices are very reasonable).
But he could be going anywhere, of course.
On VeriSign’s earnings call yesterday, McLaughlin said he wanted to join a private company and take it public, which made me think he may be leaving the domain business entirely.
McLaughlin is an advisor to Altos Ventures, a venture capital firm with a bunch of startups to its name.
There are not a great many companies in the domain industry – that we know about, at least – that immediately jump out as near-term IPO candidates.
McLaughlin plans to announce his new employer next week.

ICANN demands the right to terminate .jobs

ICANN has asked the International Chamber of Commerce to rule that it has the right to terminate Employ Media’s .jobs contract.
It’s filed its response to Employ Media’s demand for arbitration over the disputed Universe.jobs service, which saw the registry vastly expand the .jobs space.
Employ Media “transcended the very intent behind creation of the TLD” with Universe.jobs, which allocated tens of thousands of .jobs domains to the DirectEmployers Association, ICANN said.
The organization wants the ICC to rule that it “may, but is not required to, terminate the Registry Agreement with Employ Media”, as it has already threatened.
Employ Media took ICANN to arbitration in May, after ICANN notified it that it was in breach of its registry agreement and they were not able to settle their differences in private talks.
The registry wants a declaration that it is not in breach.
But according to ICANN, Employ Media is still and has always been restricted to selling domains just to human resources professionals to promote jobs “within their own organizations”.
That’s despite ICANN’s approval of a contract amendment last year that allowed the registry to sell non-companyname .jobs domains.
This liberalization, ICANN says, did not allow the company to launch Universe.jobs, which monetizes at least 40,000 geographical and vocational .jobs through a massive third-party jobs board.
ICANN is now trying to frame the arbitration proceeding around a single question – was its breach notice “appropriate” or not?
The whole debacle is based around two interpretations of the .jobs Charter, which spells out who can register .jobs domains. This is what it says:

The following persons may request registration of a second-level domain within the .JOBS TLD:
– members of SHRM [the Society For Human Resources Management]; or
– persons engaged in human resource management practices that meet any of the following criteria: (i) possess salaried-level human resource management experience; (ii) are certified by the Human Resource Certification Institute; (iii) are supportive of the SHRM Code of Ethical and Professional Standards in Human Resource Management, as amended from time to time, a copy of which is attached hereto.

Employ Media’s interpretation is fairly literal and liberal – any signed-up SHRM member can register a .jobs domain and somebody at DirectEmployers is a member and therefore eligible.
Becoming a SHRM member is pretty straightforward and cheap. It’s not much of a barrier to entry.
ICANN argues that this interpretation is bogus:

Employ Media has espoused policies that allow a .JOBS domain name (or thousands of them) to be used for virtually any purpose as long as a human resource manager is propped up to “request” the domain. In doing so, Employ Media has failed to enforce meaningful restrictions on .JOBS registrations, as required by the Registry Agreement.

It further argues that Employ Media should have allocated premium .jobs domains through an “open, fair and transparent” process, rather than the “self-serving… backroom deal” with DirectEmployers.
Evidence now filed by ICANN shows that the two organizations have been arguing about this since at least November 2009, when Employ Media launched a Universe.jobs “beta”.
ICANN also now says that it has no problem with Universe.jobs, provided that Employ Media and SHRM amend their Charter policies to make the service retroactively compliant.
The more this dispute progresses and the more convoluted and expensive it becomes, the more it leaves me scratching my head.
You can download the latest arbitration documents from ICANN.

Bit-squatting – the latest risk to domain name owners

Forget phishing, forget cybersquatting, forget typosquatting, high-value domain name owners may have a whole new threat to worry about – “bit-squatting”.
This appears to be the conclusion of fascinating new research to be presented by Artem Dinaburg at the Black Hat and DEF CON hacker conferences in Las Vegas next week.
Defective internet hardware, it turns out, may be enabling a whole new category of typosquatting that could prove worrying for companies already prone to domain name abuse.
According to a summary of Dinaburg’s research, RAM chips can sometimes malfunction due to heat or radiation, resulting in “flipped bits”, where a 1 turns into a 0 or vice-versa.
Because the DNS uses ASCII encoding, a query containing a single flipped bit could actually send the user to a completely different domain name to the one they intended to visit.
To test the theory, Dinaburg appears to have registered the typo domain name mic2osoft.com. While it’s not visually confusing or a likely typo, in binary it is only one bit different to microsoft.com.
The ASCII binary code for the digit 2 is 00110010, which is only one bit different to the lower-case letter r, 01110010.
The binary for the string “microsoft” is:

011011010110100101100011011100100110111101110011011011110110011001110100

and the binary encoding for “mic2osoft” is (with the single changed bit highlighted):

011011010110100101100011001100100110111101110011011011110110011001110100

Therefore, if that one bit were to be accidentally flipped by a dodgy chip, the user could find themselves sending data to the bit-squatter’s domain rather than Microsoft’s official home.
I would assume that this is statistically only a concern for very high-traffic domains, and only if the bit-flipping malfunction is quite widespread.
But Dinaburg, who works for the defense contractor Raytheon, seems to think that it’s serious enough to pay attention to. He wrote:

To verify the seriousness of the issue, I bit-squatted several popular domains, and logged all HTTP and DNS traffic. The results were shocking and surprising, ranging from misdirected DNS queries to requests for Windows updates.
…
I hope to convince the audience that bit-squatting and other attacks enabled by bit-flip errors are practical, serious, and should be addressed by software and hardware vendors.

His conference presentations will also discuss possible hardware and software solutions.
For large companies particularly at risk of typosquatting, the research may also present a good reason to conduct a review of their trademark enforcement strategies.
I’m not going to be in Vegas this year, but I’m looking forward to reading more about Dinaburg’s findings.
The annual Black Hat and DEF CON conferences are frequently the venues where some of the most beautifully creative DNS hacks are first revealed, usually by Dan Kaminsky.
Kaminsky is not discussing DNS this year, judging by the agendas.
The conferences were founded by Jeff Moss, aka The Dark Tangent, who joined ICANN as its chief security officer earlier this year.

Final gTLD Applicant Guidebook expected this week

It’s been over a month since ICANN approved its new top-level domains program, but we still don’t have a final-final version of the Applicant Guidebook.
The resolution approving the program ICANN passed in Singapore called for a number of amendments to be made to the 352-page tome.
The current draft was published May 30, and so far ICANN has not said when the next version – likely to be the version used in the first round of applications – will be released.
I inquired, and now word has come from on high that ICANN’s new gTLD team hopes to have the English version of the new Guidebook published by the end of July – this coming weekend.
The Singapore resolution called for changes to the government Early Warning and Advice processes, added protection for Olympic and Red Cross trademarks, and a modification of the Uniform Rapid Suspension cybersquatting policy.
One has to wonder if the changes outlined in the resolution are the only changes that we’ll see – a month seems like a long time to make just a few fairly minor edits.
The resolution said the board “authorizes staff to make further updates and changes to the Applicant Guidebook as necessary and appropriate”.
The first round of new gTLD applications is set to open January 12.

Could .om become the next typo TLD?

Will Oman’s .om domain follow in the footsteps of .co? Or .cm? Or neither?
The country-code top-level domain is set to be transferred to a new manager following an ICANN vote this coming Thursday.
The redelegation is one item on a unusually light agenda for the board’s July 28 telephone meeting. It’s on the consent agenda, so it will likely be rubber-stamped without discussion.
The domain is currently assigned to Oman Telecommunications Company, but the new owner is expected to be the national Telecommunications Regulatory Authority or an affiliated entity.
The Omani TRA was given authority over the nation’s domain names by Royal Decree in 2002.
It has already successfully had the Arabic-script ccTLD .عمان approved by ICANN for use as an internationalized domain name, but the IDN has not yet been delegated.
AusRegistry International this March won a $1.3 million contract with the TRA to provide software and services for the .om and .عمان registries.
At the time, the TRA said it planned to market both Latin and Arabic extensions to increase the number of domain registrations.
The .om ccTLD is of course a .com typo, like .co and .cm, but squatting is not currently possible due to its strict registration policies.
Only Omani entities may register .om domains today, and only third-level domains (such as example.com.om and example.net.om) may be registered. Domains may not be resold.
I have no particular reason to believe this situation will change under new stewardship, but it will certainly be worth keeping an eye on the TLD for possible policy changes.
When Cameroon’s .cm opened up, it implemented a widely vilified blanket wildcard in an attempt to profit from .com typos.
Colombia’s .co of course took the responsible route, disowning wildcards and embracing strong anti-squatting measures, even if its mere existence was still a headache for some trademark owners.