AI experts replace Chapman on ICANN board

ICANN’s Nominating Committee has announced its annual picks for the Org’s board of directors, with two new fresh faces, both of whom have notable AI policy experience, joining.

Constance Bommelaer de Leusse and Raúl Echeberría, respectively French and Uruguayan internet policy experts, are the newcomers. Australian former regulator Chris Chapman is leaving after just one three-year term.

Echeberría is perhaps the more-familiar name, having been involved with ICANN since its early days. He’s a founder and former long-time CEO of LACNIC, and has held roles in ISOC, WSIS, and the IGF. He’s also former chair of ICANN’s Number Resource Organization.

De Leusse is a French academic, raised in the US, currently employed by the Sciences Po and Ecole normale supérieure (ENS-PLS) universities in Paris. She is a former ISOC VP.

Both have AI policy experience. Echeberría earlier this year sat on the steering committee of the AI Action Summit, hosted in Paris by President Macron, while de Leusse works for the AI & Society Institute at ENS-PLS.

On social media, de Leusse describes herself as a winemaker, which may or may not prove interesting.

NomCom also reappointed Sajid Rahman for a second three-year term. One of the two new appointees replaces former board chair Maarten Botterman, who is term-limited after nine years’ service. The other replaces Chapman.

In terms of geographic balance, it means a director from the Asia-Pacific region has been replaced by one from Latin America. I don’t believe this causes any significant issues in terms of limiting other groups’ election options.

NomCom, which also selected seven other people for non-board roles, said 37% of its candidates were from Africa, with 25% from Asia-Pac, 16% from Latin America, and 8% from Europe.

Only 2% were from North America, perhaps due to the fact that NomCom was unable to pick anyone from that region for a directorship due to its geographic diversity quotas.

NomCom said that 27% of its candidates were female, 73% male, which is broadly in line with previous years and historical stats for general ICANN participation.

The new appointees take their seats at the conclusion of ICANN’s AGM in October.

RDRS may not be dead

ICANN’s pilot Registration Data Request Service could live on beyond its original shelf life, if new recommendations are approved.

The GNSO’s RDRS Standing Committee has reached consensus on six proposals concerning the service’s future, the first of which is that it should carry on operating beyond its original November 2025 cut-off date.

RDRS is the system ICANN put in place to connect people who want access to unredacted Whois records with the registrars holding that data. It hasn’t been a spectacular success, and some large registrars have recently opted out of participation.

But the volunteer Standing Committee, which has been meeting every two weeks to monitor RDRS since it launched in November 2023, says that the service is useful and recommends that the pilot should carry on. Its report states:

The SC recommends maintaining the RDRS pilot service and continuing to promote voluntary registrar participation beyond its initial two-year term until a long-term permanent solution or a successor system is agreed upon.

The draft also recommends upgrading the service to improve the user interface, enable API access for both requestors and registrars, and enabling authentication for users starting with law enforcement.

ccTLD registries should also be allowed to opt in, the report says. Currently, the voluntary service is limited to ICANN-accredited gTLD registrars. At the last count, 78 registrars were participating, covering 47% of all registered gTLD domains.

Five of the committee’s recommendations reached “Full Consensus”, the highest degree of agreement, while one recommendation, discussing future policy work, had some objections and only received “Consensus”.

The report will now be put to the GNSO Council before going to the ICANN board of directors for possible final approval.

Apart from the ongoing running costs, some of the recommendations would require software development work, which costs money.

At the last count, there were 11,360 registered RDRS users and since launch they had submitted 3,344 data requests. That works out to a mean average of 167 per month.

Single-letter .com lawsuit thrown out of court

A domainer trying to lay claim to all remaining unregistered single-character .com and .net domain names has had his lawsuit against ICANN thrown out of court for a third time.

Bryan Tallman of VerandaGlobal.com (dba First Place Internet) reckons he is owed the rights to domains such as 1.com and a.net because he registered the matching second-level domains in the non-Latin versions of both gTLDs.

His original lawsuit, filed two years ago, stated that he paid Verisign, via registrar CSC Global, $25,285 for 1.닷넷 on the understanding that this would give him exclusive rights to 1.com and 1.net, which would be worth many millions of dollars.

.닷넷 is Verisign’s transliteration of .net in the Hangul script. Tallman registered dozens of other single-character Latin domains in internationalized domain name .com/.net transliterated gTLDs, thinking he could later get the .com/.net equivalents.

His argument was pretty flimsy, based primarily not on ICANN policy but on an ambiguously worded letter from Verisign to ICANN.

The first complaint was rejected by the Los Angeles Superior Court in March 2024. Tallman amended his complaint, but this was also thrown out this January. Tallman plodded on, regardless, with a third amended complaint.

This time, the judge has run out of patience. Last month, he threw out the lawsuit entirely, with no leave to amend, saying Tallman did not have standing to sue as he had failed to show that he had any contractual relationship with ICANN at all.

With a few grandfathered exceptions such as x.com, owned by Elon Musk, all single-character .com and .net domain names have been reserved from reservation since the 1990s for stability reasons that are probably no longer particularly applicable.

A move by Verisign to experimentally auction o.com to a motivated buyer fizzled out a few years ago, likely indirectly due to the likely buyer’s relationship to a sexy Russian spy.

Three applicants qualify for cheapo gTLDs

Three organizations have been given ICANN’s approval to apply for new gTLDs next year at a deeply discounted rate.

All three are non-profit or nongovernmental organizations, ICANN said. Two come from the Asia-Pacific region and one comes from Europe.

The identities of the applicants have not and will not be disclosed — to publish their names would likely tip the applicants’ hands in terms of what strings they intend to apply for, inviting competition.

The Applicant Support Program offers non-profit entities worldwide or small businesses in non-developed nations a discount of 75% to 85% on the base $227,000 application fee, along with a selection of other benefits.

As of today, there are 45 active applications, ICANN said. Seven come from Africa, 14 from Asia-Pac, five from Europe, two from Latin America, and 12 from North America. Another five haven’t said where they’re based yet.

According to July 23 stats, only five applications — three of which presumably have now been approved — had been fully submitted and were in review.

In the 2012 round, there were only three ASP applications and only one, from the company that now runs .kids, was successful in obtaining the discount.

The window for ASP applications closes in November.

Blockchain crisis looming for new gTLD next round

New gTLD applicants could face more of a threat from blockchain-based alternative naming systems next year than perhaps they first thought.

ICANN is coming under pressure to give additional rights to the owners of top-level strings that act like TLDs on blockchains, potentially adding friction — and six figures of extra costs — to applications for matching strings.

In the recently closed public comment period on the current draft Applicant Guidebook, two blockchain naming firms focused on the risk posed from name collisions should a gTLD get delegated that matches a blockchain TLD.

More importantly, ICANN’s influential Security and Stability Advisory Committee expressed the same views.

Alexander Urbelis, general counsel and CISO of Ethereum Name Service, said in his comments that many operators of alt-TLDs will apply for their DNS matches in next year’s application round, adding:

ICANN should consider that a new gTLD, for which an identical string already exists in an alternative name space, should be considered a compromised asset, and that delegating such gTLDs may subject ICANN, and applicants, to substantial liability. In addition to the technical issues posed by name collision, such delegations could also result in consumer confusion, difficulties with resolving queries (particularly as access to alternative names is increasingly integrated into mainstream web browsers), security risks, and broken authentication systems

Shifting gears, Urbelis then goes on to espouse the exactly opposite view to what you might expect from an operator of a blockchain naming system:

We urge ICANN to ensure that operators of strings in alternative names spaces are not given preferential treatment in the upcoming new gTLD application round, either deliberately or inadvertently. Such operators should not be rewarded for choosing to operate outside of ICANN governance and policies, particularly when the results of such preferential treatment could be so devastating for the stability of the DNS, as well as consumer trust in the new gTLD program and the DNS itself.

However, he concludes that alt-TLDs should be considered during the application process, specifically when ICANN’s evaluators conduct the String Similarity Evaluation.

we note that the string similarity evaluation does not appear to account for strings that may exist in alternative name spaces that are not under ICANN governance. Given the proliferation of such strings and alternative name spaces in recent years, ICANN should not ignore their existence by considering string similarity within only the ICANN-governed DNS, particularly due to the technical issues outlined above in connection with name collision.

Currently, this evaluation stage only looks at similarity to existing TLDs, some strings blocked by policy, and other applied-for strings.

If Urbelis’ advice were taken on board, an application for .clown, for example, could find itself ruled similar to alt-TLD .down, which is on the Handshake naming system and available at some registrars.

ENS runs .eth as a blockchain TLD. While the company claims over 1.6 million names registered there, .eth can never make it to the consensus DNS because ETH is the protected three-letter code for Ethiopia and therefore blocked by a Guidebook policy that is pretty much locked-in.

Unstoppable Domains, which markets dozens of alt-TLDs, focused on name collisions in its brief comment to ICANN, seeking extra clarity in how the collision assessors will decide whether a string is “high risk”.

The current AGB says evaluators will look at both quantitative data — measurements of traffic for non-existent TLDs to the root servers for example — and unspecified “qualitative” factors. Unstoppable’s head of operations Michael Campagnolo wrote:

If ICANN wants to help applicants to assess their risk pre-application submission, examples and sources of qualitative evidence should be described and made available to applicants prior to, and in a reasonable amount of time before the opening of the application window, similar to the quantitative information.

The subtext here, it appears, is that Unstoppable wants to know if non-DNS qualitative factors, such as the existence of an alt-TLD matching an applied-for string, will be taken into account.

That’s a good question, and as the AGB currently stands it appears to be up to the Technical Review Team that will conduct the name collision evaluation on each application.

The Name Collision Analysis Project working group, which came up with most of the current name collision rules, seemed to have mostly ignored alt-TLDs in its work due to difficulty and timing.

Unstoppable points out that applicants with strings deemed at high risk of collisions could incur extra fees of $100,000 to $150,000, on top of the $227,000 standard application fee, so the extra clarity on the rules could avoid applicants having to reach deeper into their pockets.

While ICANN is adept at ignoring or merely paying lip service to self-serving public comments filed by commercial entities, it is bound by its bylaws to take the advice of its Advisory Committees seriously.

Comments filed by the 17-member SSAC will carry more weight, and SSAC is warning that collisions between DNS and non-DNS naming systems could raise security risks, promote instability, and create user confusion.

SSAC’s SAC130 (pdf) — formal Advisory Committee advice — makes four recommendations related to name collisions. One is:

The AGB should explicitly state that the TRT is allowed to include evaluating potential collisions with known, widely used alternative naming systems and other external sources, as these can create foreseeable security and stability risks for DNS users.

If ICANN adopts the SSAC recommendations, it seems the TRT will be encumbered with the heavy burden of figuring out how, when and why an alt-TLD and an applied-for gTLD create risks so unacceptable that the applied-for string should be blocked.

Another question that has been raised in recent weeks is whether alt-TLD operators should be able to use mechanisms such as Community Priority Evaluation and Community Objection to secure their TLDs or disrupt other applications.

Could Unstoppable, for example, claim that its cohort of .wallet alt-TLD registrants constitute a protected “community” and thus get a priority approval?

The company could certainly try, but experts in the policy-making community and ICANN staff seem to think the point-based CPE mechanism is designed in such a way to make such a claim incredibly difficult to back up.

ICANN will consider all of the public comments over the coming weeks and months before making changes, if any, to the AGB.

There are hundreds of thousands of alt-TLDs out there — over 6,000 are even carried by a handful of ICANN-accredited registrars — but it’s not clear how many are actually used.

With that in mind, should ICANN offer additional protections to blockchain-based alt-TLDs, many new gTLD applicants would face the very real risk of additional friction and huge extra costs.

ICANN looking at new bulk reg rules

ICANN seems set to start creating more rules governing DNS abuse, including limits on bulk registrations and more tracking of registrants.

A small team of GNSO volunteers have put together a list (pdf) of dozens of proposed policy change areas, covering everything from registrant data accuracy to pricing to API access to getting ICANN Compliance to be more proactive.

While most of the ideas in the team’s analysis received a broad range of views, it settles on three areas, all related to bulk registration of abusive domains, that it thinks are ripest for further policy work.

The first is “Associated Domain Checks”. The small team think it’s worth looking into whether registrars should have to investigate proactively domains registered by known abusive registrants.

The group also thinks it’s worth looking into better industry information-sharing about domain generation algorithms, which bad actors use to create vast numbers of gibberish names that can be used in spam runs, phishing attacks, or botnets.

Finally, the group thinks rules around API access to registrar platforms should be looked at, given that bulk-registered abusive domains often seem to use APIs to programmatically obtain thousands of throwaway domains in seconds.

The small team thinks a Policy Development Process looking at just these three issues could be completed relatively quickly and the community could address the remaining issues later.

Whether the recommendations go to a PDP is now up to the GNSO Council, which will vote on the matter this Thursday. Assuming the vote passes, which seems likely, ICANN staff would then have to prepare a formal Issue Report, setting out the scope of future work, if any.

A PDP would likely take years to complete.

The three priority topic areas reflect closely the Governmental Advisory Committee advice coming out of June’s ICANN 83 public meeting. Both small team and GAC heavily source ICANN’s INFERMAL research and a recent NetBeacon white paper as their inspirations.

Wine producers worried about new gTLDs

American vintners are worried that someone might steal their protected regional names in the next new gTLD round.

The Napa Valley Vintners has written to ICANN to “express strong opposition to the creation of any generic top-level domain
(gTLDs) that uses our distinctive name.”

The trade association asks that the names of wine-producing areas of the States be added to the Reserved Names List in the new gTLD program’s Applicant Guidebook.

That list currently is limited to the names of intergovernmental organizations, NGOs, and Red Cross/Crescent related entities.

The NVV points out that the names of wine-producing regions are protected by US law — you can’t say your wine comes from Napa unless it was in fact made there.

According to Wikipedia, there are 276 protected American Viticultural Areas in 34 states. More than half are in California.

Some of these names actually have a small degree of protection already, but only accidentally. The string “Napa” would be considered a protected geographic string until the current AGB rules, for example, but only if somebody wanted to run .napa as a city-gTLD.

The issue of protecting wine-related geographic indicators has come up at ICANN before. While it was processing the applications for .wine and .vin in 2014, there was a protracted bust-up in the Governmental Advisory Committee about whether they should go ahead.

Several European governments pressed ICANN to ban or delay .wine, now an Identity Digital gTLD, until promises were made about protecting names like “Champagne” and “Rioja” at the second level.

France in particular got very pissed off, but ultimately objections were dropped after the registry made some kind of deal with the wine-makers.

The NVV letter is cc’d to the federal government’s Alcohol and Tobacco Tax and Trade Bureau, presumably to send the message that the group is not messing about.

The letter (pdf) is addressed to “The Honorable Sally Costerton”, under the apparent assumption that she’s still ICANN’s acting CEO. That hasn’t been true for the last eight months. Also, as lovely as she is, I’m not sure she qualifies for that particular honorific.

Goodyear tires of its dot-brand

For the record, I’m not proud of that headline. It doesn’t even work in British English. But if I hadn’t done it, some of you would have complained, and I want you to be happy.

Rubber company Goodyear has become the latest new gTLD registry operator to tell ICANN to terminate a dot-brand.

In this case, it’s not the company’s primary, .goodyear, but rather .dunlop, the brand of one of its tire-making subsidiaries.

The company did not give ICANN a reason for the self-termination; the Dunlop brand appears to be alive and well.

Neither .goodyear nor .dunlop have any registered domains. Dunlop and Goodyear both use .eu and .com domains for their primary web sites.

ICANN’s “review of reviews” kicks off

The ICANN community has kicked off its “review of reviews”, a hopefully brief exercise in navel-gazing designed to free ICANN from even more navel-gazing over the longer term.

The seven supporting organizations and advisory committees have put forth a proposal, which ICANN’s top brass has accepted, for a Review of Reviews Cross Community Group (RoR CCG) that will seek to rescue ICANN from the quagmire of introspection into which it has sunk in recent years.

ICANN’s bylaws, written when the Org got divorced from the US government a decade ago, call for more than half a dozen reviews — of stuff like accountability, competition, security and Whois — most of which are on five-year cycles.

But the institutional lethargy that has consumed ICANN for the last decade, coupled with an already heavy volunteer workload, has meant that the reviews sometimes miss deadlines and still haven’t been fully implemented by the time the next cycle comes around.

The new CCG is being set up to see what can be done to terminate this vicious cycle. A charter document (pdf) sent to ICANN this week reads:

The purpose of the CCG is to manage a fundamental evaluation of the following reviews set out in the ICANN Bylaws, as a whole system, including their implementation, and propose a refreshed system of reviews.

Its timeline is ambitious. The group hopes to have some proposals ready to show the community by ICANN 86, less than a year from now. By ICANN standards that’s pretty much Ludicrous Speed.

The CCG will have a limited membership: two members from each SO and AC, two ICANN staffers and two members of the board for a total of 18. Anyone will be able to passively observe the mailing list and teleconferences.

The draft CCG charter has been accepted by ICANN chair Tripti Sinha. It’s expected that the group will hold public sessions this October in Dublin at ICANN 84.

Huge registrars flee from RDRS

Ten notable domain registrars have abandoned ICANN’s pilot Registration Data Request Service, substantially reducing its usefulness.

In June, 10 accredited registrars pulled their support for the voluntary service, which is designed to give law enforcement, IP owners, and security researchers an easier way to request unredacted Whois records.

Team Internet is out, taking with it its registrars 1API, Internet BS, Key-Systems GmbH, Key-Systems LLC, Moniker, RegistryGate and TLD Registrar Solutions.

Newfold Digital exited with Network Solutions, Register․com, and PublicDomainRegistry․com.

The sum of all this is that there are now 78 participating registrars, compared to 88 at the end of May, and they now only represent 47% of all registered gTLD domains, down from 54%.

That’s the lowest level of participation since RDRS launched in late November 2023 and the first time it’s dropped below half of all registered gTLD domains.

Usage of RDRS has dropped to a whole new low. There were only 68 requests for Whois records in June, down from the previous low of 91 in March.

Perhaps counter-intuitively, the number of searches that resulted in “Registrar Not Supported” errors remained static at 16%, tying for the lowest ratio across the entire pilot to date.

ICANN’s Governmental Advisory Committee recently said it wants ICANN to consider making RDRS mandatory for all registrars.

Aug 7 Correction: this article originally erroneously stated that Corporation Service Company had removed one registrar and added another. In fact, the registrar in question had simply changed its name. I apologise for the error.