Facebook’s war on privacy claims first registrar scalp

China’s oldest accredited registrar says it will shut up shop permanently next week after being sued into the ground by Facebook, apparently the first victim of the social media giant’s war against Whois privacy.

Facebook sued OnlineNIC in 2019 alleging widespread cybersquatting of its brands. The complaint cited 20 domains containing the Facebook or Instagram trademarks and asserted that the registrar, and not a customer, was the true registrant.

The complaint named ID Shield, apparently OnlineNIC’s Hong Kong-based Whois privacy service, as a defendant and was amended in March this year to add as a defendant 35.cn, another registrar that Facebook says is an alter ego of OnlineNic.

The amended complaint listed an addition 15 squatted domains, for 35 in total.

This week, OnlineNIC director Carrie Yu (aka Carrie Arden aka Yu Hongxia), told the court:

Defendants do not have the financial resources to continue to defend the instant litigation, and accordingly no longer intend to mount a defense. Defendants do not intend to file any oppositions to any pending filing… Subject to any requirements of ICANN, Defendants intend to cease business operations on July 26, 2021.

But Facebook reckons the registrar is about to do a runner to avoid paying almost $75,000 in court fees already incurred and avoid the jurisdiction of the California court where the case is being heard.

Facebook had asked for $3.5 million in penalties in a proposed judgment and OnlineNIC had not opposed.

While it presents itself as American, it appears that OnlineNIC is little more than a shell in the US.

Its official headquarters are little more than a lock-up garage surrounded by builders’ merchants in a grim, windowless facility just off the interstate near Oakland, California.

Its true base appears to be a business park in Xiamen, China, where 35.cn/35.com operates. The company has boasted in the past of being China’s first and oldest ICANN-accredited registrar, getting its foot in the door when the floodgates opened in 1999.

Facebook is now asking the court for a temporary restraining order freezing the defendants’ financial and domain assets, and for a domain broker to be appointed to liquidate its domain portfolio.

If you’re a legit OnlineNIC customer, you might be about to find yourself in a world of hurt.

OnlineNIC had just over 624,000 gTLD domains under management at the last count. 35.cn had another 200,000.

The lawsuit is one of three Facebook is currently fighting against registrars, one prong of its strategy to pressure the ICANN community to open up Whois records rendered private by EU law and consequent ICANN policy.

OnlineNIC is the low-hanging fruit of the trio and the first to be sued. It already faced cybersquatting cases filed by Verizon, Yahoo and Microsoft in 2009. The Verizon case came with a $33 million judgment.

Facebook has also sued the rather less shady registrars Namecheap and Web.com (now Newfold Digital) on similar grounds.

Nope, no Seattle meeting for ICANN

ICANN’s planned public meeting in Seattle will have no face-to-face component, the board of directors decided yesterday.

In a resolution published last night, the board cited the global vaccine inequity and the ongoing difficulties with international travel and visas during the coronavirus pandemic.

But it added that it plans to go ahead with a hybrid online/in-person meeting for ICANN 73 in San Juan, Puerto Rico next March “if it is feasible to do so”.

The board noted that its last in-person AGM, held in late 2019, saw 68% of its participants come from outside the US, suggesting Seattle would go ahead with a majority of its community members absent.

It added that “it is likely that ICANN72 could be a meeting of in-person attendees from just a couple of regions, which does not serve global participants in ICANN’s multistakeholder model”

While some of the pandemic-related issues may be resolved by October, ICANN had to make the call now to avoid wasting money on a physical meeting it may have had to later cancel.

The results of the board vote have not yet been published. A similar resolution last year saw some directors vote in favor of a return to face-to-face meetings by October 2020.

The resolution states that ICANN org should use the next eight months to ensure the hybrid model planned for San Juan is as effective as possible for those who will still be unable or unwilling to attend in person due to the pandemic.

It adds that smaller regional meetings, where travel restrictions are less irrelevant, could still go ahead this year.

A recent poll showed a majority of community members from all regions were keen to return to in-person meetings for Seattle, but the majority was greater in North America than elsewhere.

A group of participants from the Asia-Pacific region recently wrote to ICANN to state that it was likely that nobody from that region would be able to show up in Seattle.

ICANN 72 will be the sixth consecutive public meeting to be held virtually.

.org domains could come in seven new languages

Public Interest Registry is planning support for seven more languages in the .org gTLD.

The company has asked ICANN for permission to support seven additional internationalized domain name scripts: Croatian, Finnish, Hindi, Italian, Montenegrin, Portuguese, and Japanese.

Five of these languages use the Latin script also used in English, but have special accents or diacritics that require IDN tables to support in the DNS.

PIR submitted the request via the Registry Services Evaluation Process, where it is currently being reviewed by ICANN. Such RSEPs are usually approved without controversy.

MMX gets nod to sell 22 gTLDs to GoDaddy

New gTLD registry MMX expects to shortly offload most of its portfolio of strings to GoDaddy Registry after receiving ICANN approvals.

The company said today that its transfer requests for four of its gTLD contracts have received full ICANN approval.

Another 18 have received conditional ICANN approval, and MMX believes it has met these unspecified conditions.

Another five of its stable that are not fully owned and operated still require the nod from its partners.

MMX said in April that it planned to sell its entire portfolio to GoDaddy, after which it is expected the company will be wound down.

The company did not break down which transfer have received full approval, conditional approval, or are still waiting for approval.

It gTLDs are: .cooking, .fishing, .horse, .miami, .rodeo, .vodka, .beer, .luxe, .surf, .nrw, .work, .budapest, .casa, .abogado, .wedding, .yoga, .fashion, .garden, .fit, .vip, .dds, .xxx, .porn, .adult, .sex, .boston, .london and .bayern.

Panel hands .sucks squatter a WIN, but encourages action against the registry

A UDRP panel has denied a complaint against .sucks cybersquatter Honey Salt on a technicality, but suggested that aggrieved trademark holders instead sic their lawyers at the .sucks registry itself.

The three-person World Intellectual Property Organization panel threw out a complaint about six domains — covestro.sucks, lundbeck.sucks, rockwool.sucks, rockfon.sucks, grodan.sucks, tedbaker.sucks, tedbaker-london.sucks, and tedbakerlondon.sucks — filed jointly by four separate and unrelated companies.

The domains were part of the same operation, in which Turks & Caicos-based Honey Salt registers trademarks as .sucks domains and points them at Everything.sucks, a wiki-style site filled with content scraped from third-party sites.

Honey Salt has lost over a dozen UDRP cases since Everything.sucks emerged last year.

But the WIPO panel dismissed the latest case without even considering the merits, due to the fact that the four complainants had consolidated their grievances into a single complaint in an apparent attempt at a “class action”.

The decision reads:

although the Complainants may have established that the Respondent has engaged in similar conduct as to the individual Complainants, which has broadly-speaking affected their legal rights in a similar fashion, the Complainants do not appear to have any apparent connection between the Complainants. Rather it appears that a number of what can only realistically be described as separate parties have filed a single claim (in the nature of a purported class-action) against the Respondent, arising from similar conduct. As the Panel sees it, the Policy does not support such class actions

The panel decided that to force the respondent to file a common response to these complaints would be unfair, even if it is on the face of it up to no good.

Making a slippery-slope argument, the panel suggested that to allow class actions might open up the possibility of mass UDRP complaints against, for example, domain parking companies.

So the case was tossed without the merits being formally considered (though the panel certainly seemed sympathetic to the complainants).

But the sting in the tale comes at the end: the panel allowed that the complainants may re-file separate complaints, but also suggested they invoke the Trademark Post Delegation Dispute Resolution Procedure.

That’s interesting because the Trademark PDDRP, an ICANN policy administered by WIPO and others, is a way to complain about the behavior of the registry, not the registrant.

It’s basically UDRP for registries.

The registry for .sucks domains is Vox Populi, part of the Momentous group of companies. It’s denied a connection to Honey Salt, which uses Vox sister company Rebel for its registrations.

According to ICANN: “The Trademark PDDRP generally addresses a Registry Operator’s complicity in trademark infringement on the first or second level of a New gTLD.”

Complainants under the policy much show by “clear and convincing evidence” that the registry operator or its affiliates are either doing the cybersquatting themselves or encouraging others to do so.

There’s no hiding behind shell companies in tax havens — the policy accounts for that.

The trick here would be to prove that Honey Salt is connected to Vox Pop or the Momentous group.

Nothing is known about the ownership of Honey Salt, though Whois records and UDRP decisions identify a person, quite possibly a bogus name, as one “Pat Honeysalt”, who has no digital fingerprint to speak of.

The most compelling piece of evidence linking Honey Salt to Vox is gleaned by following the money.

The current business model is for Everything.sucks to offer Honey Salt’s domains for “free” by publishing transfer authorization codes right there on the squatted domain.

But anyone attempting to claim these names will still have to pay a registrar — such as Rebel — a transfer/registration fee that could be in excess of $2,000, most or all of which flows through to Vox Pop.

If we ignore the mark-up charged by non-Rebel registrars, the only party that appears to be profiting from Honey Salt’s activities appears to be the .sucks registry itself, in other words.

On its web site, Everything.sucks says it’s a non-profit and makes the implausible claim that it’s just a big fan of .sucks domains. Apparently it’s a fan to the extent that it’s prepared to spend millions registering the names and giving them away for free.

An earlier Everything.sucks model saw the domains listed at cost price on secondary market web sites.

The Trademark PDDRP, which appears to be tailor-made for this kind of scenario, has not to my knowledge been used to date. Neither WIPO nor ICANN have ever published any decisions delivered under it.

It costs complainants as much as $30,500 for a three-person panel with WIPO and has a mandatory 30-day period during which the would-be complainant has to attempt to resolve the issue privately with the registry.

The six domains in the UDRP case appear to have all gone into early “pending delete” status since the decision was delivered and do not resolve.

Will you use SSAD for Whois queries?

ICANN is pinging the community for feedback on proposed Whois reforms that would change how people request access to private registrant data.

The fundamental question is: given everything you know about the proposed System for Standardized Access and Disclosure (SSAD), how likely are you to actually use it?

The SSAD idea was dreamed up by a community working group as the key component of ICANN’s response to privacy laws such as GDPR, and was then approved by the Generic Names Supporting Organization.

But it’s been criticized for not going far enough to grant Whois access to the likes of trademark lawyers, law enforcement and security researchers. Some have called it a glorified ticketing system that will cost far more than the value it provides.

Before the policy is approved by ICANN’s board, it’s going through a new procedure called the ODP, for Operational Design Phase, in which ICANN staff, in coordination with the community, attempt to figure out whether SSAD would be cost-effective, or even implementable.

The questionnaire released today will be an input to the ODP. ICANN says it “will play a critical role in assessing the feasibility and associated risks, costs, and resources required in the potential deployment of SSAD.”

There’s only eight questions, and they mostly relate to the volume of private data requests submitted currently, how often SSAD is expected to be used, and what the barriers to use would be.

ICANN said it’s asking similar questions of registries and registrars directly.

There’s a clear incentive here for the IP and security factions within ICANN to low-ball the amount of usage they reckon SSAD will get, whether that’s their true belief or not, if they want ICANN to strangle the system in its crib.

It’s perhaps noteworthy that the potential user groups the questionnaire identifies do not include domain investors nor the media, both of which have perfectly non-nefarious reasons for wanting greater access to Whois data. This is likely because these communities were not represented on the SSAD working group.

You can find the questionnaire over here. You have until July 22.

“Diversity” warning over ICANN Seattle

ICANN has been told that it risks disenfranchising community members from outside the US if it goes ahead with a return to in-person meetings at ICANN 72 in Seattle this October.

APAC Space, a group comprising participants from the Asia-Pacific region, reckons there’s almost no chance that any of its members will be able to make it to Seattle, due to pandemic restrictions.

The group wrote (pdf):

Like the rest of the community, the APAC Space members are keen to see a return to face-to-face meetings, but we have serious concerns about continued, longterm disenfranchisement if this return is done in an inequitable way. If a hybrid meeting does go ahead in Seattle, we are reasonably confident that there will be minimal, if any, in-person attendance from the APAC region

APAC Space goes on to note that ICANN 73 next March is also scheduled to take place in the same region, in San Juan, Puerto Rico.

The letter continues:

We are concerned that holding a hybrid meeting in which participants from only some regions can participate in-person is not in line with ICANN’s goal to reflect regional and cultural diversity, and risks further disenfranchising regions that are already under-represented within ICANN’s processes.

A recent ICANN survey found that a majority of community members were keen to return to face-to-face meetings. While this was true everywhere, the majority was stronger among North Americans and Europeans.

ICANN’s board of directors is due to make a decision about Seattle later this month.

This article was updated July 9 to clarify authorship of the letter to ICANN.

ICANN DOESN’T money-grub in new gTLD contract shocker

ICANN may have a reputation for trying to slice itself a bigger slice of the pie whenever it renegotiates a new gTLD contract, but that doesn’t appear to be the case this week.

The .aero registry, which has been running for 20 years, looks set to continue to get its gTLD on the cheap, paying ICANN just a fifth of what newer registry operators pay.

But it has standardized on many other terms of the 2012-round Registry Agreement, meaning Uniform Rapid Suspension, zone file access via the CZDS, EBERO failover, and the registry code of conduct are all coming to .aero soon.

.aero is a “sponsored” TLD restricted to the aerospace industry, approved in 2000 as one of ICANN’s first “test-bed” gTLD round. The registry is Societe Internationale de Telecommunications Aeronautiques, a trade body.

Under the terms of its new contract, which is open for public comment, SITA will pay ICANN a fixed fee of $500 a year if it has under 5,000 names or $5,000 a year if it has more.

Registries receiving their delegations since 2012 pay $25,000 per year in quarterly installments.

.aero currently has about 12,000 names under management, so SITA will carry on paying $5,000 a year. Like other gTLDs, transaction fees kick in at 50,000 names, which at its historical growth rate should happen at some point in the 2090s.

The public comment period closes August 16, about a month before the current .aero contract expires. If history is any guide, any public comments filed will be duly noted and ignored.

ICANN backtracks on executive pay transparency

ICANN has not disclosed the results of a recent board vote to award the CEO his bonus, apparently reversing an earlier move to make that kind of information public.

The board voted last week to give Göran Marby his “at risk” compensation for the second half of the org’s fiscal 2021.

It’s not clear from the resolution whether he’s getting his full 30% or just a portion thereof.

It’s also not clear whether the vote was unanimous or not.

As I noted in February, ICANN disclosed that three directors voted against a resolution to give Marby a pay rise, which put him well over the million-dollars-a-year mark.

I wondered aloud back then whether the unprecedented decision to publish the vote on a matter of executive compensation was an accident, or a move towards increased transparency by the org, which I would have applauded.

The resolution from last week contains no such information, suggesting February may have been a publication accident after all.

The minutes from the February meeting have yet to be published, four months after the fact.

Net4 domains now parked after “fraud” ruling

The primary operating domain names of disgraced registrar Net 4 India are now parked, after the company lost its ICANN accrediation and was hit by a finding of fraud in an insolvency case.

The names net4.com and net4.in, which once hosted its customer-facing retail site, now return parking pages.

It emerged in recent court documents that Net4 paid $14,068 for net4.com in March 2011 via Sedo.

Net4 saw its ICANN termination terminated in May. All of its gTLD domains under management were transferred to PublicDomainRegistry, which also made side deals with registries to accept .tv, .me and .cc domains.

.in registrant were being dealt with by NIXI, the local ccTLD registry.

Net4 had been in insolvency proceedings for a few years before its customers started noticing serious problems renewing and transferring their names, or even contacting customer support.

Now it emerged that the insolvency court in late May found that Net4 had acted “fraudulently” in order to “defraud” its creditors.

The company had defaulted on millions of dollars in loans from the State Bank of India, debts that were subsequently sold to a debt recovery company called Edelweiss, which filed for Net4’s insolvency.

In a lengthy and complex May ruling (pdf), the Delhi insolvency court found that Net4 had transferred its primary operating assets including its domains, trademarks and registrar business to a former subsidiary, Net4 Network, in order to keep them out of the hands of Edelweiss.

Net4 had “fraudulently transferred” the assets in “undervalued and fraudulent transactions” designed to put the assets “beyond the reach of the Creditors so as to defraud the Creditors”, the court ruled.

The court ruled that the resolution professional handling the case is now free to pursue Net4 Network and its director for the money that would have otherwise have been held by Net4 proper.