Three ICANN directors wanted to go to Puerto Rico

The ICANN board of directors’ decision to scrap the in-person component of its next public meeting was not unanimous, it has emerged.

Three directors voted against the November 4 resolution, which said ICANN 73 would be ICANN’s seventh consecutive online-only gathering, according the a preliminary board report.

The plan for months was to have a “hybrid” meeting, with some face-to-face component at the convention center in San Juan, Puerto Rico, as an intermediate step towards post-pandemic normality.

But at the time of the vote travel restrictions in the US were such that getting to Puerto Rico was tough even for fellow Americans, so ICANN’s meetings team had not been able to do on-site preparation.

Nine directors voted to make 73 virtual, with four absent during the vote, the preliminary report states.

Five directors have taken their seats since the coronavirus pandemic began, and have therefore never officially met with their board colleagues in person.

It’s not the first time the board has been split on this matter. Last year, directors Ron Da Silva and Ihab Osman voted to return to face-to-face for the October 2020 Hamburg meeting.

Da Silva is no longer on the board, but there are at least two other directors among the current line-up on the same page.

The voting breakdown will not be revealed until the board approves the November 4 minutes, which could be months if history is any guide.

Virgin territory as GoDaddy pushes $30 million porn domain renewals

Brand owners big and small are in for a potential surprise December 1, as their 10-year-old .xxx domain blocks expire and registrars bill their customers to convert them into a new annually-renewing GoDaddy service.

GoDaddy confirmed to DI today that it will “auto-convert” the old Sunrise B blocks, first sold by ICM Registry in 2011, to its new AdultBlock service, which provides essentially the same functionality but across four TLDs rather than one.

Tony Kirsch, head of professional services at GoDaddy Registry, said:

Registrars have been contacting all the Sunrise B owners and advising them that as of December 1 they will be grandfathered and automatically converted into an AdultBlock service, but they have a choice to expire that or stop that happening prior to December 1.

And if it is that they don’t do that before December 1, we’ll still give them a grace period of at least 45 days. If that happens they can then, as you’d normally do, just turn around to the registrar and say “We don’t want that” and we will of course refund the money.

This means that GoDaddy, which acquired .xxx and ICM from MMX earlier this year, is billing its .xxx registrar partners to convert and renew what could be as many as 81,000 Sunrise B blocks.

While the registry fee for AdultBlock has not been published, retail registrars I checked have priced the service at $370 to $400 per year, which we can probably assume is low-end pricing. Most .xxx domains are sold via the specialist brand-protection registrars like CSC and Markmonitor, which sometimes have more complex pricing.

So that’s something in the ballpark of $30 million worth of renewal invoices being sent out in the coming weeks, for something in many cases brand owners may have institutionally forgot about.

Kirsch said that AdultBlock was introduced by MMX about 18 months ago and that registrars have been preparing their customers for the Sunrise B expiration for some time.

Sunrise B was a program, unprecedented in the industry at the time, whereby trademark owners could pay a one-off fee — ICM charged its registrars about $160 wholesale — to have their brands removed from the available pool.

The domains exist in the .xxx zone file and resolve to a black page bearing the words “This domain has been reserved from registration”, but they’re not registered and usable like normal defensive or sunrise registrations would be.

Companies got to avoid not only the potential embarrassment of being porn-squatted, but also the hassle of having to explain to a tabloid reporter why they “owned” the .xxx domain in question.

The term of the Sunrise B block was 10 years. ICM told me at the time that this was because the company’s initial registry contract with ICANN only lasted for 10 years, so it was legally unable to sell longer-term blocks, but I’ve never been sure how much I buy that explanation.

Regardless, that 10 year period comes to an end in two weeks.

Because Sunrise B was unprecedented, this first renewal phase is also unprecedented. We’re in virgin territory (pun, of course, very much intended) here.

Will we see the industry’s first public “block junk drop”?

There are a number of reasons to believe trademark owners, assuming they don’t just blindly pay their registrar’s invoices, would choose to allow their blocks to expire or to ask for a refund after the fact.

First, the price has gone up — a lot.

While ICM charged $160 for a 10-year Sunrise B block (maybe marked up by registrars to a few hundred bucks) brand owners can expect to pay something like $3,000 retail for a single string blocked for 10 years.

But buyers do get a bit more bang for their buck. Unlike Sunrise B, AdultBlock also blocks the trademark in three additional GoDaddy-owned TLDs — .porn, .sex and .adult — as standard.

Kirsch said he expects buyers to see a 40% to 50% saving compared to the cost of defensively registering each domain individually.

Second, the appetite for defensive registrations has waned over the past 10 years, with trademark owners employing more nuanced approaches to brand protection, largely due to the flood of new gTLDs since 2013.

When .adult, .sex and .porn launched, without the possibility of Sunrise B blocks, they got about 2,000 regular sunrise registrations each. And that’s extraordinarily high — for most new gTLDs a couple hundred was a good turnout.

Third, the .xxx launch attracted a whole lot of controversy and overreaction, and the .xxx zone file today contains a lot of Sunrise B crap.

When I scrolled a little through the zone, cherry-picking silly-looking blocks in 2019, I found these examples:

100percentwholewheatthatkidslovetoeat.xxx, 101waystoleaveagameshow.xxx, 1firstnationalmergersandacquisitions.xxx, 1stchoiceliquorsuperstore.xxx, 2bupushingalltherightbuttons.xxx, 247claimsservicethesupportyouneed30minutesguaranteed.xxx, 3pathpowerdeliverysystembypioneermagneticsinc.xxx

Is it worth $400 a year to block the trademark “100 Percent Whole Wheat That Kids Love To Eat”? Is there any real danger of a cybersquatter going after that particular brand (apart from the fact that I’ve now written about it twice)?

Kirsch said a “small percentage” of Sunrise B owners have already said they don’t want to convert, but given that the rest will auto-convert, and that the registrars are doing all the customer-facing stuff, the company has limited visibility into likely uptake.

Brian King, director of policy at MarkMonitor, told us: “We generally encourage our clients to consider blocks. They can be cost effective and a lot of times clients would rather have their brand be unavailable without having to register in TLDs where they don’t want to own domain registrations for any number of reasons.”

One reason brand owners may want to consider converting to AdultBlock — it’s rumored that GoDaddy will be relaxing its eligibility criteria for .xxx next year, removing the requirement for registrants to have a nexus to the porn industry.

It’s always been kind of a bullshit rule, basically a hack to allow ICM to run a “sponsored” TLD under ICANN’s rules from the 2003 application round, but doing away with it would potentially make it easier for cybersquatters to get their hands on .xxx domains.

CSC told customers in a recent webinar that the rules are likely to be changed next year, increasing the risk of cybersquatting.

There’s some circumstantial evidence to suggest that CSC might be on to something — pretty much every “sponsored” gTLD from the same 2003 application round as .xxx has relaxed their reg rules to some extent, sometimes when their contracts come up for renewal and ICANN tries to normalize them with the text of the standard 2012-round agreement.

And GoDaddy’s .xxx contract with ICANN is being renegotiated right now. It was due to expire in March, but it was extended in February until December 15, a little under a month from now. We may soon see ICANN open up the new text for public comment.

Kirsch, who’s not part of the negotiations, could not confirm that the eligibility relaxation is going to happen or that it’s something GoDaddy is pushing for.

If it were to happen, it wouldn’t be for some time, and it wouldn’t necessarily impact on the December 1 deadline for Sunrise B conversions, which is going to be interesting to watch in its own right.

“There are registrations that are protecting people’s trademarks that are expiring and our primary objective here is to ensure that that protection continues, and that’s what we’ll do,” GoDaddy’s Kirsch said.

“If we just let them expire, it would create a lot of opportunity for brand infringement. Faced with that choice, our primary objective is to protect trademark owners,” he said.

ICANN abandons face-to-face plan for Puerto Rico

ICANN has canceled its plans for a “hybrid” ICANN 73, saying this morning that the meeting will go ahead as an online-only virtual meeting.

Its board of directors yesterday voted to abandon efforts to have a face-to-face component in Puerto Rico as originally planned, as I predicted a few days ago.

"Impact of COVID-19 on ICANN73". That's the same language ICANN board uses in its agenda items when it's planning for no face-to-face component. Just saying. https://t.co/TZc7lExu7N

— Kevin Murphy (@DomainIncite) November 3, 2021

ICANN of course said it’s because of the coronavirus pandemic, and more particularly the associated travel restrictions and the lack of access to vaccines in some parts of the world from which its community members hail.

The US Centers for Disease Control currently rates Puerto Rico as its second-highest risk level, meaning ICANN’s meetings staff have been unable to travel there to do on-site planning. ICANN said:

While there has been progress that might make it feasible to plan for and convene a meeting in San Juan, Puerto Rico in March 2022, the current risks and uncertainties remain too high to proceed with an in-person meeting or with an in-person component.

Its board resolution stated:

Between the global inequity in vaccine availability across the world, continuing restrictions on persons from many countries or territories being allowed to enter the U.S., and backlogs in visa processing for those who are able to enter the U.S., ICANN org cannot estimate with any confidence the ability for attendees outside of the U.S. to attend ICANN73.

So 73 will be Zoom again. The time zone will remain UTC-4, Puerto Rico local time, which should make it less problematic for Europeans to attend.

The dates are still slated for March 5 to March 10 next year, but it seems likely that we’ll be looking at a March 7 kick-off, as March 5 is a Saturday and people don’t like working weekends if not somewhere they can also work on their tans.

ICANN said it “affirmed its intent” to attempt the hybrid model again for the mid-year ICANN 74 meeting, which is due to take place in The Hague, Netherlands, next June.

It’s bad news for ICANN participation, which has been declining in the new era of virtual meetings, but good news for its bank account. Virtual meetings cost a few million dollars less than in-person ones.

ICANN teases prices for private Whois lookups

ICANN has started to put some flesh on the bones of the forthcoming (?) SSAD system for accessing private Whois records, including teasing some baseline pricing.

During a session at ICANN 72 last week, staffers said responses to recent requests for information put the cost of having an identity verified as an SSAD user at about $10 to $20.

Those are vendor wholesale prices, however, covering the cost of looking at a government-issue ID and making sure it’s legit, and do not include the extra administration and cost-recovery charges that ICANN plans to place on top.

The verification fee would have to be renewed every two years under ICANN’s proposal, though the verification vendors are apparently pushing for annual renewals.

The fee also would not include the likely per-query charge that users will have to pay to request the true personal data behind a redacted Whois record.

It’s not currently anticipated that any money would flow to registrars, CEO Göran Marby said.

SSAD, the Standardized System for Access and Disclosure, is currently undergoing Operational Design Phase work in ICANN, with monthly webinar updates for the community.

ICANN expects to reveal more pricing details on the December webinar, staffers said.

ICANN adds another six months to Whois reform roadmap

ICANN says that its preparatory work for possible Whois reforms will take another six months.

The Operational Design Phase for the System for Standardized Access and Disclosure will now conclude “by the end of February 2022”, ICANN said this week.

That’s after the Org missed its original September deadline after six months of work.

ICANN program manager Diana Middleton said at ICANN 72 last week that ODP had been delayed by various factors including surveys taking longer than expected and throwing up more questions than they answered.

A survey of Governmental Advisory Committee members due September 17 was extended until the end of October.

But she added that ICANN intends to throw its first draft of the output — an Operational Design Assessment — at its technical writers by the end of the month, with a document going before the board of directors in early February.

SSAD is the proposed system that would funnel requests for private Whois data through ICANN, with a new veneer of red tape for those wishing to access such data.

The ODP is ICANN’s brand-new process for deciding how it could be implemented, how much it would cost, and indeed whether it’s worthwhile implementing it at all.

It’s also being used to prepare for the next round of new gTLDs, with a 13-month initial deadline.

The longer the current ODP runs, the greater the cost to the eventual SSAD user.

ICANN domains revenue ahead of estimates again

ICANN made a few million dollars more than expected in the third calendar quarter, according to its latest financials.

Overall revenue for the three months ended September 30, ICANN’s first fiscal quarter, was $38 million, ahead of the budgeted $35 million and the $36 million in the year-ago quarter.

Expenses were $27 million against a $32 million budget, due again to the lack of travel because of the pandemic. ICANN meetings are costing around $500,000 a pop right now, mostly spent on interpreters and translation, a few million bucks less that it normally spends.

The Org was running at an excess (profit) of $10 million for the quarter, compared to a $3 million budget.

ICANN said (pdf) that registry and registrar transaction fees, a good indicator of sales in the domain name industry, came in at $15 million and $10 million respectively, both $1 million better than the budget.

Other registrar fees, which includes fixed accreditation fees, were also $1 million over budget, at $4 million, perhaps due to the fact that not as many registrars de-accredited as expected.

Whois rule changes that nobody likes get approved anyway

ICANN’s Generic Names Supporting Organization Council has approved a handful of changes to Whois policy, despite the fact that pretty much nobody was fully on-board with the proposals and how they were made.

The new recommendations call for a new field in Whois records to flag up whether the registrant is a private individual, whose privacy is protected by law, or a legal entity like a company, which have no privacy rights.

But the field will be optional, with no obligation for registries or registrars to use it in their Whois services, which has angered intellectual property interests, governments and others.

The working group that came up with the recommendations also declined to find that Whois records should come with an anonymized registrant email address as standard. This absence of change was also adopted by the Council, causing more disappointment.

In short, nothing much is happening to Whois records for the foreseeable future as a result of these policy changes.

But the process to arrive at this conclusion has highlighted not just the deep divisions in the ICANN community but also, some argue, deficiencies in the ICANN process itself.

The Expedited Policy Development Process working group that has since 2018 been looking at the interaction between Whois and privacy protection law, primarily the European Union’s General Data Protection Regulation, had been asked two final questions earlier this year, to wrap up its long-running work.

First, should registrars and registries be forced to distinguish between legal and natural persons when deciding what data to publish in Whois?

Second, should there be a registrant-based or registration-based anonymized email published in Whois to help people contact domain owners and/or correlate ownership across records?

The answer on both counts was that it’s up to the registry or registrar to decide.

On legal versus natural, the EPDP decided that ICANN should work with the technical community to create a new field in the Whois standard (RDAP), but that there should be no obligation for the industry to use it.

On anonymized email addresses, the working group recommendations were even hand-wavier — they merely refer the industry to some legal advice on how to implement such a system in a GDPR-compliant way.

While this phase of the EPDP’s work was super-fast by ICANN standards (taking about nine months) and piss-weak with its output, it nevertheless attracted a whole lot of dissent.

While its tasks appeared straightforward to outsiders, it nevertheless appears to have inherited the simmering tensions and entrenched positions of earlier phases and turned out to be one of the most divisive and fractious working groups in the modern ICANN period.

Almost every group involved in the work submitted a minority statement expressing either their displeasure with the outcome, or with the process used to arrive at it, or both. Even some of the largely positive statements reek of sarcasm and resentment.

EPDP chair Keith Drazek went to the extent of saying that the minority statements should be read as part and parcel of the group’s Final Report, saying “some groups felt that the work did not go as far as needed, or did not include sufficient detail, while other groups felt that certain recommendations were not appropriate or necessary”.

This Final Report constitutes a compromise that is the maximum that could be achieved by the group at this time under our currently allocated time and scope, and it should not be read as delivering results that were fully satisfactory to everyone.

The appears to be an understatement.

The Intellectual Property Constituency and Business Constituency were both the angriest, as you might expect. They wanted to be able to get more data on legal persons, and to be able to reverse-engineer domain portfolios using anonymous registrant-baed email addresses, and they won’t be able to do either.

The Governmental Advisory Committee and Security and Stability Advisory Committee both expressed positions in line with the IPC/BC, dismayed that no enforceable contract language will emerge from this process.

Councilor Marie Pattullo of the BC said during the GNSO Council vote last Wednesday that the work “exceeds what is necessary to protect registrant data” and that the EPDP failed to “preserve the WHOIS database to the greatest extent possible”.

The “optional differentiation between legal and natural persons is inadequate”, she said, resulting in “a significant number of records being needlessly redacted or otherwise being made unavailable”. The approved policies contain “no real policy and places no enforceable obligations on contracted parties”, she said.

IPC councilor John McElwaine called the EPDP “unfinished work” because the working group failed to reach a consensus on the legal/natural question. The IPC minority statement had said:

Requiring ICANN to coordinate the technical community in the creation of a data element which contracted parties are free to ignore altogether falls far short of “resolving” the legal vs. natural issue. And failing to require differentiation of personal and non-personal data fails to meet the overarching goal of the EPDP to “preserve the WHOIS database to the greatest extent possible” while complying with privacy law.

But McElwaine conceded that “a minority of IPC members did favor these outputs as being minor, incremental changes that are better than nothing”.

The BC and IPC both voted against the proposals, but that was not enough to kill them. They would have needed support from at least one councilor on the the other side of the GNSO’s Non-Contracted Parties House, the Non-Commercial Stakeholders Group, and that hand was not raised.

While the NCSG voted “aye”, and seemed generally fine with the outcome, it wasn’t happy with the process, and had some stern words for its opponents. It said in its minority statement:

The process for this EPDP has been unnecessarily long and painful, however, and does not reflect an appreciation for ICANN’s responsibility to comply with data protection law but rather the difficulty in getting many stakeholders to embrace the concept of respect for registrants’ rights…

With respect to the precise issues addressed in this report, we have stressed throughout this EPDP, and in a previous PDP on privacy proxy services, that the distinction between legal and natural is not a useful distinction to make, when deciding about the need to protect data in the RDS. It was, as we have reiterated many times, the wrong question to ask, because many workers employed by a legal person or company have privacy rights with respect to the disclosure of their personal information and contact data. The legal person does not have privacy rights, but people do.

While welcoming the result, the Registrars Stakeholder Group had similar concerns about the process, accusing its opponents of trying to impose additional legal risks on contracted parties. Its minority statement says:

it is disappointing that achieving this result was the product of significant struggle. Throughout the work on this Phase, the WG revisited issues repeatedly without adding anything substantially new to the discussion, and discussed topics which were out of scope. Perhaps most importantly, the WG was on many occasions uninterested in or unconcerned with the legal and financial risks that some proposed obligations would create for contracted parties in varying jurisdictions or of differing business models, or the risks to registrants themselves.

The Registries Stakeholder Group drilled down even more on the “out of scope” issue, saying the recommendation to create a new legal vs natural field in Whois went beyond what the working group had been tasked with.

They disagreed with, and indeed challenged, Drazek’s decision that the discussion was in-scope, but reluctantly went ahead and voted on the proposals in Council in order to finally draw a line under the whole issue.

The question of whether the legal vs natural question has been in fact been resolved seems to be an ongoing point of conflict, with the RySG, RrSG and NCSG saying it’s finally time to put the matter to bed and the IPC and BC insisting that consensus has not yet been reached.

The RySG wrote that it is “well past time to consider the issue closed” and that the EPDP had produced a “valuable and acceptable outcome”, adding:

The RySG is concerned that some have suggested this issue is not resolved. This question has been discussed in three separate phases of the EPDP and the result each time has been that Contracted Parties may differentiate but are not required to do so. This clearly demonstrates that this matter has been addressed appropriately and consistently. A perception that this work is somehow unresolved could be detrimental to the ICANN community and seen as undermining the effectiveness of the multistakeholder model.

Conversely, the BC said the report “represents an unfortunate failure of the multistakeholder process” adding that “we believe the record should state that consensus opinion did not and still does not exist”.

The IPC noted “a troubling trend in multistakeholder policy development”, saying in a clear swipe at the contracted parties that “little success is possible when some stakeholders are only willing to act exclusively in their own interests with little regard for compromise in the interest of the greater good.”

So, depending on who you believe, either the multistakeholder process is captured and controlled by intransigent contracted parties, or it’s unduly influenced by those who want to go ultra vires to interfere with the business of selling domains in order to violate registrant privacy.

And in either case the multistakeholder model is at risk — either “agree to disagree” counts as a consensus position, or it’s an invitation for an infinite series of future policy debates.

Business as usual at the GNSO, in other words.

ICANN 72 has lowest turnout since records began

Last week’s public ICANN meeting saw the fewest attendees since the Org started compiling and publishing statistics over five years ago.

According to a new blog post from meetings veep Nick Tomasso, there were 1,305 attendees at ICANN 72, which was the sixth consecutive public meeting to take place on Zoom due to the pandemic.

That’s smaller than the 1,330 who showed up virtually for the mid-year meeting, which typically have fewer attendees than the end-of-year AGM.

In fact, it’s the lowest number of documented attendees since ICANN first started regularly publishing the stats, with ICANN 55 in March 2016. That meeting was in Morocco, was hit by fears of terrorism, and still managed 2,273 attendees.

Even the 2017 meeting in Johannesburg, a long-haul flight for most ICANNers, attracted more people.

Last week’s meeting took place on Seattle time. This was fine for ICANN’s west coast staff, but meant sessions kicked off towards the end of business hours in Europe and in the middle of the night in east Asia.

But Tomasso reports that 22.1% of “real time” attendees were from Asia-Pac, with 20.8% coming from Europe. North Americans accounted for 35% of participants.

Participating in ICANN 72 was free, only requiring an account on ICANN’s web site. But there were no free flights or hotels, and the only thing in the virtual schwag bag was an origami fish or something.

CSC (not that one) scraps its dot-brand

A company formerly known as CSC has terminated its dot-brand gTLD contract four years after discontinuing the company name.

Computer Sciences Corporation, now known as DXC Technology, has told ICANN it no longer wishes to operate .csc, saying:

This gTLD was secured right before the merger of Computer Sciences Corporation (CSC) and Hewlett Packard Enterprise Services merged to form DXC Technology. Consequently, the gTLD has never been used and shutting it down will have no effect on internal or external stakeholders.

The CSC-HP merger and name changed happened in 2017.

At one point, nic.csc bore a notice saying it was the “registry for the .dxc top-level domain”, which was a cool trick given .dxc doesn’t exist and has never existed.

This CSC is different from the corporate registrar of the same abbreviation, where the CSC stands for Corporation Service Company. There’s a reasonable chance that this CSC will be able to apply for .csc in the next application round.

Verisign boss talks .web launch, timing and pricing

Verisign hasn’t fully won .web yet, but it expects to soon and is talking in general terms about what the it might look like live.

CEO Jim Bidzos yesterday told analysts that he expects the Independent Review Process panel currently considering an appeal by rival applicant Afilias to deliver its final verdict before the end of the year. No hearings are scheduled.

Afilias claims Verisign and its secret proxy, Nu Dot Co, cheated, and that ICANN broke its own rules, in the 2016 auction that saw Verisign promise to pay $135 million for .web. Verisign thinks the claims are rubbish.

Bidzos told analysts, wanting to known when they can put .web revenue into the models, that it while it’s a “bit early to speculate” when the company will launch .web, it will likely happen a “couple of quarters from delegation”.

On pricing, he noted that .web does not have the same price controls as .com and .net:

.web is, of course, different from .com and net and that it’s not a price controlled TLD… We do have flexibility with it that we don’t have with other TLDs, and premiums are available. Other sorts of options are available.

But will the company put its marketing muscle behind .web? Many people, myself included, have said that Verisign’s interest in the gTLD is more about keeping it out of its rivals hands. Bidzos said:

There certainly will be some sort of marketing launch that will occur, but I just think it’s too early to really talk about what that would look like and what the expense impact will be. But we certainly intend to market and promote .web. Our plan, our desire, as we’ve stated — and I’ll say again — is to offer our customers more choice and to make .web a very successful TLD.

His comments came as Verisign reported its third-quarter financial results.

The company reported revenue up 5.1% at $334 million and net income of $157 million compared to $171 million a year ago.

It had 172.1 million .com and .net domains in its registry at the end of the quarter, up 1.48 million sequentially and a 5.1% increase on the year-ago number.