Cade and Dammak win ICANN awards

Marilyn Cade and Rafik Dammak have been named joint winners of this year’s ICANN Community Excellence Award, formerly the Ethos Award.

The award acknowledges those community members deemed to have embodied ICANN’s values and devoted a lot of time to community work.

As I previously blogged, policy consultant Cade, who died last year to a wide outpouring of tributes, was pretty much a shoo-in.

“This award is not intended to be a memorial. Instead, it is a well-deserved recognition of Marilyn’s contributions and commitment to ICANN and our multistakeholder community,” the awards selection committee noted.

Dammak has for over a decade contributed “countless volunteer hours” on various ICANN policy working groups, mainly in the GNSO, the committee noted. His impartiality was called out by the selection committee for praise.

He last year stepped in to fill a leadership vacuum in the working group devoted to reviewing Whois privacy policy.

ICANN waves off EFF concerns about the Ethos-Donuts deal

ICANN has dismissed concerns from the Electronic Frontier Foundation about the recent acquisition of Donuts by Ethos Capital.

Responding to a letter from EFF senior attorney Mitch Stoltz, ICANN chair Maarten Botterman said the deal had been thoroughly reviewed according to the necessary technical and financial stability standards.

In reviewing this transaction, the ICANN org team completed a thorough review and analysis of information provided by Ethos Capital and Donuts. Based on the review, the ICANN org team concluded that Donuts, as controlled by its proposed new owners would still meet or exceed the ICANN-adopted specifications or policies on registry operator criteria in effect, including with respect to financial resources, operational and technical capabilities, and overall compliance with ICANN’s contracts and Consensus Policies. Before its final decision on the matter, ICANN org provided multiple briefings to the Board. Following its final briefing and discussion with the Board, ICANN org approved the change of control in late March 2021.

The EFF had claimed that the anti-abuse parts of Donuts various registry agreements amounted to giving Donuts the right to “censor” domains, and it took issue with the Domain Protected Marks List domain blocking service.

Botterman noted that these predate the Ethos acquisition and were not reviewed.

Prior to the deal, which closed in March, Donuts was owned by another PE firm, Abry Partners. ICANN CEO Göran Marby had previously expressed puzzlement that the acquisition to lead to such concerns.

ICANNers itching to get back to face-to-face shindigs

A majority of ICANN community members want a return to in-person meetings as soon as possible, and overwhelmingly don’t care how many pandemic-related restrictions are put in place to get it done.

That’s according to the results of an online survey ICANN carried out, which ultimately had 665 responses, or 514 if you exclude responses from ICANN staff.

The survey found that over half of all respondents were keen to fling open the doors for ICANN 72 in Seattle this October, even if it meant reduced attendance and global diversity due to pandemic restrictions on travel.

There was even greater acceptance of — and indeed demand for — health measures such as social distancing, face masks, proof of vaccination, and on-site testing.

None of these proposed measures attracted less than 72% support, and no more than 11% of respondents objected to any individual measure.

While the majority of the respondents were from North America or Europe — which I think it’s fair to say are broadly considered to be well-vaccinated and in the closing days of their pandemic restrictions — ICANN has helpfully broken down some of the responses by geography.

Perhaps unsurprisingly, North Americans and Europeans were far more likely to approve of vaccination-related attendance rules, at 73% and 66% respectively. But a majority of those from Latin America, Asia and Africa were also tolerant of such restrictions.

North Americans were also much less likely to fear travel restrictions — ICANN 72 will be held on home turf, after all.

While the survey results show a clear inclination for reopening in-person meetings, with an online component for those unable to make it, the decision will be made by the ICANN board of directors next month.

The full survey results can be viewed here (pdf).

How awful would ICANN 72 have to be for you to stay at home?

ICANN is seriously considering holding its ICANN 72 public meeting with a face-to-face component in Seattle this October. But it wants to know what would make you stay at home.

The org is surveying community members to see how they would respond to stuff like temperature checks, rapid testing, compulsory mask wearing, , vaccine certificates, physical distancing and even physical tracking.

Do community members want this stuff to make them feel safe? Or would it make them steer clear of the meeting for the sheer annoyance and intrusion? Is the community made up of bleeding-heart liberal wokesters, or hardline dunderhead deniers?

And if it turned out that the meeting would be predominately populated with vaxxed-up North Americans and Western Europeans, with few attendees from less well-off parts of the world, would that make you stay away in solidarity?

These are among the questions asked in the 10-page survey, sent out in advance of this week’s ICANN 71 public meeting, which had been due to take place in The Hague but instead will be ICANN’s fifth consecutive online-only gathering.

There’s going to be a live discussion about the possibility of a return to hybrid in-person meetings on Thursday.

The ICANN board is due to make a call on the location of 72 at some point in July.

And it’s not just a decision about health and global representation.

While the survey does not cover this, ICANN meetings are not cheap, and to set the ball rolling now with poor visibility into the pandemic situation a few months in advance would incur costs that could not be recouped.

More non-rules proposed for Whois privacy

An ICANN working group has come up with some extra policy proposals for how registries and registrars handle Whois records, but they’re going to be entirely optional.

The ongoing Expedited Policy Development Process team has come up with a document answering two questions: whether registrars should differentiate between people and companies, and whether there should be a system of uniform, anonymized email addresses published in Whois records.

The answer to both questions is a firm “Maybe”.

The EPDP working group seems to have been split along the usual party lines when it comes to both, and has recommended that contracted parties should get to choose whether they adopt either practice.

Under privacy laws, chiefly GDPR, protections only extend to data on natural persons — people — and not to legal persons such as companies, non-profits and other amorphous entities.

Legally, registries and registrars are not obliged to fully redact the Whois records of domains belonging to companies, but many do anyway because it’s easier than putting systems in place to differentiate the two types of registrant.

There’s also the issue that, even if the owner of the domain is a company, the contact information may belong to a named, identifiable person who is protected by GDPR. So ICANN’s contracted parties may reduce their potential liability by redacting everything, no matter what type of entity the domain belongs to.

The EPDP’s has decided to stick to the status quo it agreed to in an earlier round of policy talks: “Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so”.

Contracted parties will get the option to ask their registrants if they’re a natural person (yes/no/not saying) and capture that data, but they’ll have to redact the answer from public Whois output.

They’d have to “clearly communicate” to their customers the fact that their data will be treated differently depending on the choice they make.

On the second question, related to whether a system standardized, published, anonymized email addresses is feasible or desirable, the EPDP is also avoiding any radical changes:

The EPDP Team recognizes that it may be technically feasible to have a registrant-based email contact or a registration-based email contact. Certain stakeholders see risks and other concerns that prevent the EPDP Team from making a recommendation to require Contracted Parties to make a registrant-based or registration-based email address publicly available at this point in time.

Again, the working group is giving registries and registrars the option to implement such systems or not.

The benefit (or drawback, depending on your perspective) of giving each registrant a single anonymous email address that is published in all their Whois records is that it makes it rather easy to reverse-engineer that registrant’s entire portfolio.

If you’re a political insider running a whistle-blower blog, a bar owner who also moderates a forum for closeted gays in a repressive regime, or a domain name news blogger running a furry porn site on the side, you might not want your whole collection of domains to be easily doxxed.

But if you’re a trademark lawyer chasing cybersquatters or a security researcher tracking spammers, being able to take action against a ne’er-do-well’s entire portfolio at once could be hugely useful.

So the EPDP working group proposes to leave it up to individual registries and registrars to decide whether to implement such a system, basically telling these companies to talk to their lawyers.

The EPDP Team recommends that Contracted Parties who choose to publish a registrant- or registration-based email address in the publicly accessible RDDS should ensure appropriate safeguards for the data subject in line with relevant guidance on anonymization techniques provided by their data protection authorities and the appended legal guidance in this recommendation

An appendix to the recommendations, compiled by the law firm Bird & Bird, says there’s “a high likelihood that the publication or automated disclosure of such email addresses would be considered to be the processing of personal data”.

The EPDP recommendations are now open for public comment until July 19, and could become binding if they make it through the rest of the ICANN policy development system.

ICANN 71 — now with added bearded men!

What’s better than a flabby, bearded, middle-aged man lecturing you about DNS policy in a Zoom window? Why, up to 25 flabby, bearded, middle-aged men lecturing you about DNS policy in the same Zoom window, of course!

That appears to be an added benefit (to beard fans, at least) of upgrades ICANN has made to its remote participation platform ahead of this month’s ICANN 71 public meeting, which will be taking place virtually.

The org has implemented a new Zoom feature called Immersive View, which permits the illusion that everyone on a given panel or committee is sitting in the same room, by pasting their images in real-time to the same fake background image.

From Zoom’s blog announcing the feature earlier this year:

The feature supports up to 25 participants, which should be sufficient to accommodate every member of ICANN’s various committees and the board of directors.

While I’m making light of it, I do see some value to observers of being able to see all session speakers simultaneously. As an inveterate nose-picker, I’m not sure I’d be quite as happy about it as a participant.

Other useful features announced by senior engineering veep Ashwin Rangan yesterday include real-time captioning in English of non-English speakers and a return to one-on-one rooms for people wishing to have private meetings.

ICANN has also linked its meeting registration system with its regular web site login accounts, Rangan said.

Barrett to replace Da Silva on ICANN board

South African internet pioneer Alan Barrett is to replace Ron Da Silva as one of the Address Supporting Organization’s members of ICANN’s board of directors, the ASO’s Address Council said yesterday.

The pick comes after multiple rounds of interviews, which whittled down an initial slate of 10 nominees to a long list of eight, and then a short list of four, which included Da Silva.

It’s a selection, rather than an election, with the Address Council doing the hiring.

The handover will happen following ICANN 72nd public meeting, taking place this October either in Seattle or virtually, at the conclusion of Da Silva’s second three-year term on the board.

According to his bio, Barrett was co-founder of South Africa’s first commercial ISP in the early 1990s. He has served as a software consultant for the last 14 years and was CEO of Afrinic until 2019.

There are currently two other directors on the ICANN board, which has geographic regional quotas, hailing from Africa. Da Silva represents the North America region.

Afilias hints at more legal action over .web

As Verisign does everything but declare outright victory in last week’s Independent Review Process result, .web rival Afilias is now strongly hinting that its lawyers are not quite ready to retire.

John Kane, VP of Afilias (now Altanovo) said in a statement that Afilias is prepared to “take all actions necessary to protect our rights in this matter”.

This matter is of course the contested 2015 auction for the new gTLD .web, which was won by Nu Dot Co with $135 million of Verisign’s money.

Afilias thinks the winning bid should be voided because Verisign’s involvement had been kept a secret. The IRP panel stopped short of doing that, instead forcing ICANN’s board of directors to make a decision.

The earliest they’re likely to do this is at ICANN 71 later this month.

But with one IRP down, Afilias is now reminding ICANN that the board’s ultimate decision will also be “subject to review by an IRP Panel.”

So if ICANN decides to award .web to Verisign, Afilias could challenge it with another IRP, adding another two years to the go-live runway and another couple million dollars to the lawyers’ petty cash jar.

None of which should overly bother Verisign, of course, if one subscribes to the notion that its interest in .web is not in owning it but rather in preventing its competitors from owning it and aggressively marketing it against .com.

But Verisign also put out a statement reviewing the IRP panel’s decision last week, reiterating that it believes Afilias should be banned from the .web contest and banned from making any further complaints about Verisign’s bid.

While Afilias spent its press release focusing on trashing ICANN, Verisign instead focused its blog post on trashing Afilias.

According to Verisign, Afilias is no longer competent to run a registry (having sold those assets to Donuts) and is just looking for a payday by losing a private auction.

“Afilias no longer operates a registry business, and has neither the platform, organization, nor necessary consents from ICANN, to support one,” Verisign claims.

Afilias could of course outsource its would-be .web registry, as is fairly standard industry practice, either to Donuts or any other back-end operator.

American Gen Z not interested in ICANN?

ICANN seems to be having trouble recruiting American youngsters into its cult community.

The org today said that it’s extended the deadline for its NextGen program, which is trying to attract and throw money at a dozen under-30s from North America to attend its October public meeting.

It’s the second North American meeting in a row before which ICANN has had to extend the deadline for applications.

Ordinarily, the NextGen program offers 18-30 years-old students and academics in the internet policy field free travel and lodgings for an ICANN meeting, along with up to $200 for a visa and $500 to cover incidentals.

ICANN typically picks 12 to 15 participants for each meeting. Successful applicants have “mentors” and are obliged to actually participate, giving a short presentation on their relevant academic work.

It’s currently fifty-fifty whether ICANN 72 goes ahead in Seattle this October or becomes the sixth meeting in a row to be held on Zoom, so pandemic-related travel restrictions probably have some bearing on interest in the NextGen program.

But pre-pandemic ICANN 66, the last to be held in the USA, also had to extend its application deadline and ultimately attracted only 11 successful applicants, one below the usual minimum threshold.

(It’s quite difficult, incidentally, to get quality statistics on the NextGen program. The list of North American participants for ICANN 66 is just a copy-paste of the African participants for ICANN 65, and the out-of-date numbers on the official stats page incorrectly have Mexico, Central America and the Caribbean islands categorized as North American (which they’re not, according to ICANN’s geographic regions policy).)

So what is it keeping younger North Americans away from ICANN?

If anything, one would assume a greater interest from academics in the region, given ICANN’s historical connection to the US government and its uniquely interesting position under the law.

.web ruling hands Afilias a chance, Verisign a problem, and ICANN its own ass on a plate

ICANN has lost yet another Independent Review Process case, and been handed a huge legal bill, after being found to have violated its own rules on transparency and fairness.

The decision in Afilias v ICANN has failed to definitively resolve the issue of whether the auction of the .web gTLD in 2016, won by a shell applicant called Nu Dot Co backed by $135 million of Verisign’s money, was legit.

ICANN’s now urging NDC, Afilias and other members of the .web contention set to resolve their beefs privately, which could lead to big-money pay-days for the losing auction bidders at Verisign’s expense.

For ICANN board and staff, the unanimous, three-person IRP panel decision is pretty damning, with the ruling saying the org “violated its commitment to make decisions by applying documented policies objectively and fairly”.

It finds that ICANN’s board shirked its duty to consider the propriety of the Verisign/NDC bid, allowing ICANN staff to get perilously close to signing a registry contract with an applicant that they knew may well have been in violation of the new gTLD program rules.

Despite being named the prevailing party, it’s not even close to a full win for Afilias.

The company had wanted the IRP panel to void the NDC/Verisign winning bid and award .web to itself, the second-highest bidder. But the panel did not do that, referring the decision instead back to ICANN.

As the loser, ICANN has been hit with a $1,198,493 bill to cover the cost of the case, which includes Afilias’ share of $479,458, along with another $450,000 to cover Afilas’ legal fees connected to an earlier emergency IRP request that ICANN “abusively” forced Afilias into.

The case came about due to a dispute about the .web auction, which was run by ICANN in July 2016.

Six of the seven .web applicants had been keen for the contention set to be settled privately, in an auction that would have seen the winning bid distributed evenly among the losing bidders.

But NDC, an application vehicle not known to be particularly well-funded, held out for a “last resort” auction, in which the winning bid would be deposited directly into ICANN’s coffers.

This raised suspicions that NDC had a secret sugar daddy, likely Verisign, that was covertly bankrolling its bid.

It was not known until after NDC won, with a $135 million bid, that these suspicions were correct. NDC and Verisign had a “Domain Acquisition Agreement” or DAA that would see NDC transfer its .web contract to Verisign in exchange for the money needed to win the auction (and presumably other considerations, though almost all references to the terms of the DAA have been redacted by ICANN throughout the IRP).

Afilias and fellow .web applicant Donuts both approached ICANN before and after the auction, complaining that the NDC/Verisign bid was bogus, in violation of program rules requiring applicants to notify ICANN if there’s any change of control of their applications, including agreements to transfer the gTLD post-contracting.

ICANN has never decided at the board level whether these claims have merit, the IRP panel found.

The board did hold a secret, off-the-books discussion about the complaints at its retreat November 3, 2016, and concluded, without any type of formal vote, that it should just keep its mouth shut, because Afilias and Donuts had already set the ball rolling on the accountability mechanisms that would ultimately lead to the IRP.

More than half the board was in attendance at this meeting, and discussions were led by ICANN’s top two lawyers, but the fact that it had even taken place was not disclosed until June last year, well over three and a half years after the fact.

Despite the fact that the board had made a conscious, if informal, choice not to decide whether the NDC/Verisign bid was legit, ICANN staff nevertheless went ahead and started contracting with NDC in June 2018, taking the .web contention set off its “on-hold” status.

Talks progressed to the point where, on June 14, ICANN had sent the .web contract to NDC, which immediately returned a signed copy, and all that remained was for ICANN to counter-sign the document for it to become binding.

ICANN VP Christine Willett approved the countersigning, but four days later Afilias initiated the Cooperative Engagement Process accountability mechanism, the contract was ripped up, and the contention set was placed back on hold.

“Thus, clearly, a registry agreement with NDC for .WEB could have been executed by ICANN’s Staff and come into force without the Board having pronounced on the propriety of the DAA under the Guidebook and Auction Rules,” the IRP panel wrote.

This disconnect between the board and the legal staff is at the core of the panel’s criticism of ICANN.

The board had decided that Afilias’ claim that NDC had violated new gTLD program rules was worthy of consideration and had informally agreed to defer making a decision, but the staff had nevertheless gone ahead with contracting with a potentially bogus applicant, the panel found.

In the opinion of the Panel, there is an inherent contradiction between proceeding with the delegation of .WEB to NDC, as the Respondent [ICANN] was prepared to do in June 2018, and recognizing that issues raised in connection with NDC’s arrangements with Verisign are serious, deserving of the Respondent’s consideration, and remain to be addressed by the Respondent and its Board, as was determined by the Board in November 2016. A necessary implication of the Respondent’s decision to proceed with the delegation of .WEB to NDC in June 2018 was some implicit finding that NDC was not in breach of the New gTLD Program Rules and, by way of consequence, the implicit rejection of the Claimant’s [Afilias’] allegations of non-compliance with the Guidebook and Auction Rules. This is difficult to reconcile with the submission that “ICANN has taken no position onw hether NDC violated the Guidebook”.

The upshot of the panel’s ruling is to throw the issue back to ICANN, requiring the board to decide once and for all whether Verisign’s auction gambit was kosher.

If you’ll excuse the crude metaphor, ICANN’s board has been told to shit or get off the pot:

The evidence in the present case shows that the Respondent, to this day, while acknowledging that the questions raised as to the propriety of NDC’s and Verisign’s conduct are legitimate, serious, and deserving of its careful attention, has nevertheless failed to address them. Moreover, the Respondent has adopted contradictory positions, including in these proceedings, that at least in appearance undermine the impartiality of its processes.

…

[The panel r]ecommends that the Respondent stay any and all action or decision that would further the delegation of the .WEB gTLD until such time as the Respondent’s Board has considered the opinion of the Panel in this Final Decision, and, in particular (a) considered and pronounced upon the question of whether the DAA complied with the New gTLD Program Rules following the Claimant’s complaints that it violated the Guidebook and Auction Rules and, as the case may be, (b) determined whether by reason of any violation of the Guidebook and Auction Rules, NDC’s application for .WEB should be rejected and its bids at the auction disqualified;

At the same time as the decision was published last night — shortly after midnight UTC and therefore helpfully too late to make it into today’s edition of ICANN’s godawful new email subscriptions feature — ICANN issued a statement on the outcome.

“In its Final Declaration, the IRP panel ruled that the ICANN Board, and not an IRP panel, should decide which applicant should become the registry operator for .WEB,” CEO Göran Marby said.

“The ICANN Board will consider the Final Declaration as soon as feasible, within the timeframe prescribed in the Bylaws, and remains hopeful that the relevant .WEB applicants will continue to seek alternatives to resolve the dispute between them raised during the IRP,” the statement concludes.

That should be of concern to Verisign, as any non-ICANN resolution of the .web battle is inevitably going to involve Verisign money flowing to its competitors.

But my first instinct strikes me that this a is a low-probability outcome.

It seems to me much more likely at first glance that ICANN will rule the NDC/Verisign ploy legitimate and proceed to contracting again.

For it to declare that using a front organization to bid for a gTLD is against the rules would raise questions about other applications that employed more or less the same tactic, such as Automattic’s successful bid, via an intermediary, for .blog, and possibly the 100-ish applications Donuts and Rightside cooperated on.

The ICANN bylaws say the board has to consider the IRP’s findings at its next meeting, for which there’s currently no published date, where feasible.

I should note that, while Donuts acquired Afilias last December, the deal did not include its .web application, which is why both the panel’s decision and this article refer to “Afilias” throughout.