EFF rages as Ethos closes Donuts buy

The Electronic Frontier Foundation thinks the acquisition of Donuts by “secretive” private equity group Ethos Capital represents a risk to free speech.

The deal, which sees Ethos buy a controlling stake from fellow PE firm Abry Partners, closed earlier this week, having apparently received no official objection from ICANN.

But the EFF now wants ICANN to force Donuts to change its gTLD registry contracts to make it harder for the company to engage in what it calls “censorship-for-profit”.

The group’s senior staff attorney, Mitch Stoltz, raised the issued at the Public Forum session of last week’s ICANN 70 virtual public meeting, and expanded upon his thinking in a blog post this week. He wrote:

Donuts already has questionable practices when it comes to safeguarding its users’ speech rights. Its contracts with ICANN contain unusual provisions that give Donuts an unreviewable and effectively unlimited right to suspend domain names—causing websites and other internet services to disappear.

He pointed to Donuts’ trusted notifier program with the Motion Picture Association, which streamlines the takedown of domains used for pirating movies, as an example of a registry’s power to censor.

Donuts runs gTLDs including ones with social benefit meanings that the EFF is particularly concerned about, such as .charity, .community, .fund, .healthcare, .news, and .university.

Stoltz also makes reference to the Domain Protected Marks List, a Donuts service that enables trademark owners to block their marks, and variants, across its entire portfolio of 240+ gTLDs.

In effect, this lets trademark holders “own” words and prevent others from using them as domain names, even in top-level domains that have nothing to do with the products or services for which a trademark is used. It’s a legal entitlement that isn’t part of any country’s trademark law, and it was considered and rejected by ICANN’s multistakeholder policy-making community.

The DPML is not unique to Donuts. Competitors such as UNR and MMX have similar services on the market for their gTLDs.

When Stoltz raised the EFF’s concerns at last week’s ICANN meeting, CEO Göran Marby basically shrugged them off, saying he didn’t understand why one PE firm buying an asset off another PE firm was such a big deal.

I have to say I agree with him.

Ethos came under a lot of scrutiny last year when it tried to buy .org manager Public Interest Registry, turning it into a for-profit entity, generating cash for Ethos’ still-undisclosed backers.

(This week, Ethos disclosed in a press release that its investors include massive hedge funds The Baupost Group and Neuberger Berman “among others”, which appears to be the first time these names have been mentioned in connection with the company).

But a pretty good case could be made that .org is a unique case, that has had a non-profit motive baked into its DNA for decades. That does not apply to Donuts, which was a profit-making venture from the outset.

It’s not entirely clear why the EFF is suddenly concerned that Donuts will start exercise its contractual right-to-suspend more frequently under Ethos than under Abry. Stoltz wrote:

As we learned last year during the fight for .ORG, Ethos expects to deliver high returns to its investors while preserving its ability to change the rules for domain name registrants, potentially in harmful ways. Ethos refused meaningful dialogue with domain name users, instead proposing an illusion of public oversight and promoting it with a slick public relations campaign. And private equity investors have a sordid record of buying up vital institutions like hospitals, burdening them with debt, and leaving them financially shaky or even insolvent.

Even with the acquisition passing through ICANN easily, the EFF wants Donuts to change its contracts to make it more difficult for the company to suspend domain names on a whim.

I believe the language causing the controversy comes from anti-abuse policies in the Public Interest Commitments found in almost all Donuts’ contracts with ICANN, which state in part:

Registry Operator reserves the right, at its sole discretion and at any time and without limitation, to deny, suspend, cancel, or transfer any registration or transaction, or place any domain name(s) on registry lock, hold, or similar status as it determines necessary for any of the following reasons:

a. to protect the integrity and stability of the registry;

b. to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process;

c. to comply with the terms of this Registry Agreement and the Registry Operator’s Anti-Abuse Policy;

d. registrant fails to keep Whois information accurate and up-to-date;

d. domain name use violates the Registry Operator’s acceptable use policies, or a third party’s rights or acceptable use policies, including but not limited to the infringement of any copyright or trademark; or

e. as needed during resolution of a dispute.

As a voluntary PIC, this language is unique to Donuts, though other registries have similar provisions in their registry agreements.

ICANN refuses to say why it allowed Donuts to buy Afilias

ICANN appears determined to make its decision-making process when it comes to industry consolidation as opaque as possible.

The Org has denied a request from two rival registries for information about how it approved the acquisition of Afilias by Donuts last December, apparently exploiting a loophole in its bylaws.

The transaction got the nod from ICANN after its December 17 board of directors meeting, at which the board discussed the deal and gave CEO Göran Marby the nod to go ahead and process the request.

What it didn’t do was pass a formal resolution approving the deal, which seems to have given it the room to wriggle out of its transparency requirements, such as publishing its rationale and briefing materials.

It’s a trick it also used last year when it decided to bar Ethos Capital from acquiring Public Interest Registry.

In response to a Documentary Information Disclosure Process request (pdf) last month, filed by Dot Hotel and Domain Venture Partners, ICANN said:

ICANN org makes available, as a matter of due course, on the ICANN website the resolutions taken, preliminary report, minutes, and the Board briefing materials for each Board meeting… ICANN org has already published all materials for the 17 December 2020 Board meeting.

No new information was published.

The DIDP was filed by two applicants for the new gTLD .hotel, which are competing with applications originally filed by both Donuts and Afilias.

They’d also asked for ICANN’s rationale for allowing Donuts to own two .hotel applications post-acquisition, but ICANN said it had no documents reflecting that rationale.

The .hotel contest is also the subject of an Independent Review Process case and a lawsuit, in which DVP is a plaintiff.

ShortDot bought another gTLD. Guess what .sbs stands for now?

Growing new gTLD portfolio registry ShortDot has acquired another unwanted dot-brand, .sbs, which it intends to repurpose as an open, generic TLD.

.sbs was originally owned by SBS, for Special Broadcasting Service, an Australian public-service broadcaster. But the company never used it.

Now, while launch plans are still in development, ShortDot intends to relaunch .sbs to mean something entirely different, much as it recently did with .cfd.

“.sbs will be branded as shorthand for ‘Side by Side’, perfect for social causes, charitable organizations and other philanthropic initiatives,” ShortDot COO Kevin Kopas told us.

That does not appear to be a meaning of the acronym in common usage.

ShortDot is currently two weeks away from general availability for its next most-recent acquisition, .cfd, which originally stood for the financial term “contracts for difference” but is now being marketed as “clothing and fashion design”.

The company, best known for high-volume .icu, which has sold and lost over five million registrations over the last two years, now has five gTLDs in its stable, including unused dot-brand .bond and .cyou.

As Net4 goes dark, NIXI says customers won’t lose their expired domains

Indian ccTLD registry NIXI has thrown a life vest to the owners of some 73,000 .in domain names, giving them a way to transfer out of slowly sinking registrar Net 4 India.

NIXI also said that it will not cancel expired domains that registrants have been unable to renew due to Net4’s ongoing problems.

“NIXI has decided not to discontinue the .IN Services for those .IN domain end users whose renewal is due,” the company said in a statement (pdf).

It sounds rather like registrants will be able to renew directly with the registry. They’ll also be able to transfer to a new registrar by emailing NIXI from the address in the Whois or mailing proof of company identity.

Why NIXI has chosen to act now, when Net4’s troubles have been known for almost year, is not clear.

“In the recent days, NIXI was informed that Net 4 India, who is one of the registrars of NIXI for Country code domain “.IN” has some issues in maintaining domains,” its statement says.

Net4’s web site isn’t resolving right now, at least for me, which probably has something to do with it.

The company has been in insolvency proceedings since 2017, a fact ICANN discovered when it started missing payments two years ago, but it was not until mid-2020 that Net4’s customers started complaining en masse about problems renewing and transferring their domains.

ICANN has processed thousands of complaints since then.

The registrar was told last month that ICANN was terminating its accreditation to sell gTLDs. Registrants of names in .com for example should be pretty safe, with their names automatically transferred to a new registrar, should ICANN follow through on its threat.

The termination was challenged in the insolvency court shortly before it would have become effective two weeks ago.

While ICANN does not believe it is subject to the court’s jurisdiction, it has decided to wait for an official ruling on the matter.

ICANN rules out vaccine passports, kinda, but warns in-person meetings may be a long way off

The odds of a return to in-person ICANN meetings this year is “fifty-fifty”, but the Org has no plans to introduce so-called “vaccine passports” to hasten the process.

That’s what emerged during a session at ICANN 70, the fourth consecutive remote public meeting since the coronavirus pandemic began, yesterday.

ICANN’s mid-year meeting, originally slated for The Hague, was recently confirmed to be online-only this June, and the final meeting of the year, scheduled for October in-person in Seattle, is still far from certain.

Speaking to the Non-Commercial Stakeholders Group, CEO Göran Marby yesterday gave the odds of a Seattle meeting as 50:50, and said in-person meetings will only go ahead when global pandemic restrictions are at a point where people from all parts of the world are able to attend. He said:

We cannot go to a country or a region that sets up too many obstacles for ICANN people to travel there.

…

It could be technically possible for us to have a meeting somewhere with a very limited participation, but then we really have to ask “Should we have that?”, because if we can’t people into the meeting from different parts of the world, we probably shouldn’t do the meeting.

…

Since the beginning of this, we always said that the decisions are made by the people who come to the meetings, and if we can’t have enough participation from different stakeholder groups in different parts of the world, then there’s not going to be an ICANN meeting.

The return to normality will be dictated largely by vaccine roll-out worldwide, he indicated, but benchmarked against the slowest-to-jab nations.

While the US and UK are making rapid progress getting shots in arms, other nations are barely getting started with their programs.

But Marby ruled out the idea of ICANN-specific “vaccine passports”, saying: “It’s not for ICANN to set them up, it’s going to be the governments and the hotels and the airlines to set them up.”

The ICANN board and NCSG also acknowledged a certain degree of volunteer burnout and reduced participation over the last 12 months, which was broadly chalked down to the crippling time-zone problems online meetings entail.

Because ICANN rotates its meetings through broadly speaking three time zones (Americas, Europe, East Asia) with about eight hours between them, at any given meeting roughly two thirds of the community is going to be working well outside of their usual business hours for a week or more, which takes its toll.

IP lobby demands halt to Whois reform

Trademark interests in the ICANN community have called on the Org to freeze implementation of the latest Whois access policy proposals, saying it’s “not yet fit for purpose”.

The Intellectual Property Constituency’s president, Heather Forrest, has written (pdf) to ICANN chair Maarten Botterman to ask that the so-called SSAD system (for Standardized System for Access and Disclosure) be put on hold.

SSAD gives interested parties such as brands a standardized pathway to get access to private Whois data, which has been redacted by registries and registrars since the EU’s Generic Data Protection Regulation came into force in 2018.

But the proposed policy, approved by the GNSO Council last September, still leaves a great deal of discretion to contracted parties when it comes to disclosure requests, falling short of the IPC’s demands for a Whois that looks a lot more like the automated pre-GDPR system.

Registries and registrars argue that they have to manually verify disclosure requests, or risk liability — and huge fines — under GDPR.

The IPC has a few reasons why it reckons ICANN should slam the brakes on SSAD before implementation begins.

First, it says the recommendations sent to the GNSO Council lacked the consensus of the working group that created them.

Intellectual property, law enforcement and security interests — the likely end users of SSAD — did not agree with big, important chucks of the working group’s report. The IPC reckons eight of the 18 recommendations lacked a sufficient degree of consensus.

Second, the IPC claims that SSAD is not in the public interest. If the entities responsible for “policing the DNS” don’t think they will use SSAD due to its limitations, then why spend millions of ICANN’s money to implement it?

Third, Forrest writes that emerging legislation out of the EU — the so-called NIS2, a draft of a revised information security directive —- puts a greater emphasis on Whois accuracy

Forrest concludes:

We respectfully request and advise that the Board and ICANN Org pause any further work relating to the SSAD recommendations in light of NIS2 and given their lack of community consensus and furtherance of the global public interest. In light of these issues, the Board should remand the SSAD recommendations to the GNSO Council for the development of modified SSAD recommendations that meet the needs of users, with the aim of integrating further EU guidance.

It seems the SSAD proposals will be getting more formal scrutiny than previous GNSO outputs.

When the GNSO Council approved the recommendations in September, it did so with a footnote asking ICANN to figure out whether it would be cost-effective to implement an expensive — $9 million to build, $9 million a year to run — system that may wind up being lightly used.

ICANN has now confirmed that SSAD and the other Whois policy recommendations will be one of the first recipients of the Operational Design Phase (pdf) treatment.

The ODP is a new, additional layer of red tape in the ICANN policy-making sausage machine that slots in between GNSO Council approval and ICANN board consideration, in which the Org, in collaboration with the community, tries to figure out how complex GNSO recommendations could be implemented and what it would cost.

ICANN said this week that the SSAD/Whois recommendations will be subject to a formal ODP in “the coming months”.

Any question about the feasibility of SSAD would be referred back to the GNSO, because ICANN Org is technically not supposed to make policy.

Donuts adds another TLD to its stable as Richemont finally bows out of new gTLD program

Luxury goods maker Richemont, an early and strong proponent of the new gTLD concept, has got rid of the final string of the 14 it originally applied for.

According to ICANN records, the registry agreement for .watches was officially transferred to Afilias at the end of December, one day before it was in turn acquired by Donuts.

The domain nic.watches current resolves to a placeholder bearing the Afilias branding.

Richemont, the company behind luxury brands such as Cartier and Piaget, now has no TLDs left.

It had applied for nine dot-brands, along with five generic dictionary terms that it at first intended to maintain as single-registrant spaces, before that use case was banned by ICANN.

At the start of the decade, the company was an enthusiastic endorser of new gTLDs, even sending speakers to conferences to promote the concept.

Richemont was also the first registrant of second-level domains in third-party new gTLDs, when it registered Arabic versions of some of its famous brands in December 2013.

But its enthusiasm waned gradually over the last eight years.

Its dot-brands were discarded in tranches, either during the application process or after contracting. Donuts beat it to .jewelry at auction, and it terminated its contracts for Chinese versions of .jewelry and .watches last year.

There’s not much money in internationalized domain names, so now it seems likely these Chinese IDNs were shopped around but failed to find a buyer.

.watches, however, is right in Donuts’ wheelhouse, a niche generic English string related to a specific product or service.

Last month, I reported that Donuts had acquired .markets, .forex, .broker and .trading from Boston Ivy as it exited the new gTLD game, while letting the less-attractive .spreadbetting die on the vine.

As .gov changes hands, would Verisign run it for free?

The .gov top-level domain is moving for the first time since 1997, and the new owner is promising some pricing changes from next year.

The US General Services Administration has been running .gov, one of the original gTLDs, for almost a quarter-century, but next month it will be taken over by the Cybersecurity and Infrastructure Security Agency.

No changes have been made at IANA yet, but CISA is talking of the handover as if it is a done deal.

It will be the first time ICANN has been asked to redelegate what is essentially an uncontracted gTLD with some of the characteristics of a ccTLD. To be honest, I’ve no idea what rules even apply here.

The move was mandated by the DOTGOV Act of 2019, which was incorporated in a recently passed US spending bill.

Legislators wanted to improve .gov’s usefulness by increasing its public profile and security.

The bill was quite adamant that .gov domains should be priced at “no cost or a negligible cost”, but there’s a catch — Verisign runs the technical infrastructure for the domain, and currently charges $400 per domain per year.

According to CISA, “The way .gov domains are priced is tied closely with the service contract to operate the TLD, and change in the price of a domain is not expected until next year.”

So we’re looking at either a contract renegotiation or a rebid.

Frankly, given the really rather generous money-printing machine the US government has granted Verisign with its perpetual right to run .com and increase its profit margins in most years, it seems to me the company should be running it for free.

The .gov zone currently has domains measured in the low thousand.

ICANN 71 is online-only, because of course it is

ICANN has called off plans to conduct its 71st public meeting in the Netherlands this June.

Blaming the ongoing coronavirus pandemic, the risk to safety and travel restrictions, ICANN confirmed last week that the venue will again be Zoom, rather than The Hague.

It will be the fifth consecutive meeting to go online-only.

The dates will remain the same — June 14 to June 17 — and the European time zone of course means that folks at ICANN HQ in Los Angeles will once again be working throughout the night.

ICANN 70, relocated from Cancun, begins next Monday.

ICANN 70 has virtual schwag, other new stuff

It may not make up for the lack of sun, sea, sand and sexual abstinence, but the ICANN 70 meeting, taking place this month on Zoom instead of Cancun, Mexico, does have a few new enticements that may tickle your fancy.

It’s also beginning to look like ICANN 70 won’t be the last of ICANN’s public meetings this year to be online-only.

At the trivial end of the spectrum, attendees get a virtual schwag bag containing unsponsored, printable collectibles including: two versions of a do-not-disturb door sign, a name badge, and two types of origami paper airplanes.

Equally trivially, ICANN appears to trying to foster a sense of remote community by encouraging attendees to take photographs of their food and post them to social media with the hashtag #icannchef. Because it’s 2009, apparently.

A bit more substance comes with the promise of private breakout rooms, which ICANN described in a blog post.

Apparently attendees will be able to create their own private rooms, containing multiple parties, whether it’s for social or business or policy-making purposes.

While ICANN 70 Prep Week started this week, that feature doesn’t appear to be live yet, or is so well-hidden that I couldn’t find it.

I can see this being potentially useful for meetings that take longer than the time allotment Zoom gives you for free, but I’m not sure I’d want to hold any super-sensitive meetings on a platform configured by ICANN, given its track record.

Other new features include the ability to listen in to live interpretation in the supported languages during the supported sessions, natively via the Zoom interface.

ICANN’s also turning on Zoom’s often hilarious, automated real-time transcription service, for sessions that don’t receive the usual human-assisted scribe service.

The Org has been adding features to its online platform bit-by-bit since the coronavirus pandemic forced the community into virtual mode a year ago.

It’s unlikely to be the last time ICANN meets in an online-only fashion. The board of directors is to meet tomorrow to consider the fate of ICANN 71, which is currently scheduled to take place in The Hague in June.

While some countries may well be approaching some level of pre-pandemic normality by then, ICANN is an international organization and the maxim “Nobody’s safe until we’re all safe” probably applies here.