Net4 nightmare almost over as court rules ICANN can shut down chaotic registrar

ICANN is finally moving to shut down Net 4 India’s gTLD domains business, after months of upheaval and thousands of customer complaints.

An Indian insolvency court this week lifted its ban on ICANN terminating Net4’s registrar contract, after ICANN appealed to it with a wealth of evidence showing how critical services such as hospitals and train services were being harmed by registrants being unable to transfer their domains away.

ICANN has now invoked its De-Accredited Registrar Transition Procedure, which will see Net4’s tens of thousands of gTLD domains transferred to a different, more stable registrar, according to head of compliance Jamie Hedlund.

The Org had terminated Net4’s contract in February after hearing from thousands of customers whose names had ceased to work, expired, or were locked-in to Net4 due to its broken transfers function.

But the Delhi court handling the registrar’s insolvency asked ICANN in March to delay the termination at the behest of the resolution professional attempting to extract as much value as possible from Net4 in service of its creditors.

That order was lifted orally after a hearing on Tuesday, according to ICANN.

Under the DARTP, either the dying registrar picks a successor or ICANN picks one, either from a rotation of pre-approved registrars or by rolling out a full registrar application process.

Given the timing crisis, and Net4’s irresponsible behavior to date, it appears most likely that ICANN will hand-pick a gaining registrar from the pre-qualified pool.

Hedlund blogged that ICANN expects to name Net4’s successor within two weeks, after which the gaining registrar will reach out to registrants to inform them how to proceed.

Registrants will not be charged for the bulk transfer.

Net4 had over 70,000 gTLD domains under management at the end of 2020, but this number has likely decreased in the intervening time.

ccTLDs such as India’s .in will not be covered by the bulk transfer. It will be up to local registry NIXI to minimize disruption for Net4’s .in registrants.

Price caps on .org could return, panel rules

ICANN could be forced to reimpose price caps on .org, .biz and .info domains, an Independent Review Process panel has ruled.

The panel handling the IRP case filed by Namecheap against ICANN in February 2020 has decided to allow the registrar to continue to pursue its claims that ICANN broke its own bylaws by removing price controls from the three gTLD contracts.

Conversely, in a win for ICANN, the panel also threw out Namecheap’s demand that the IRP scrutinize ICANN’s conduct during the attempted takeover of .org’s Public Interest Registry by Ethos Capital in 2019.

The split ruling (pdf) on ICANN’s motion to dismiss Namecheap’s case came March 10 and was revealed in documents recently published by ICANN. The case will now proceed on the pricing issue alone.

The three-person panel decided that the fact that ICANN ultimately decided to block Ethos’ acquisition of PIR meant that Namecheap lacked sufficient standing to pursue that element of its case.

Namecheap had argued that ICANN’s opaque processing of PIR’s change of control request created uncertainty that harmed its business, because ICANN may approve such a request in future.

But the panel said it would not prejudge such an eventuality, saying that if another change of control is approved by ICANN in future, Namecheap is welcome to file another IRP complaint at that time.

“Harm or injury flowing from possible future violations by the ICANN Board regarding change of control requests that are not presently pending and that may never occur does not confer standing,” the panel wrote.

On the pricing issue, the panel disagreed with ICANN’s argument that Namecheap has not yet been harmed by a lack of .org price caps because PIR has not yet raised its .org prices.

It said that increased prices in future are a “natural and expected consequence” of the lack of price controls, and that to force Namecheap to wait for such increases to occur before filing an IRP would leave it open to falling foul of the 12-month statute of limitations following ICANN decision-making baked into the IRP rules.

As such, it’s letting those claims go ahead. The panel wrote:

This matter will proceed to consideration of Namecheap’s request for a declaration that ICANN must annul the decision that removed price caps in the .org, .info and .biz registry agreements. The Panel will also consider Namecheap’s request for a declaration that ICANN must ensure that price caps from legacy gTLDs can only be removed following policy development process that takes due account of the interests of the Internet user and with the involvement of different stakeholders. The Panel will consider Namecheap’s request for a declaration that “registry fees… remain as low as feasible consistet with the maintenance of good quality service” within the context of removal of price caps (not in the context of regulating changes of control).

In other words, if Namecheap prevails, future price caps for pre-2012 gTLDs could be decided by the ICANN community, with an assumption that they should remain as low as possible.

That would be bad news for PIR, as well as .info registry Donuts and .biz registry GoDaddy.

But it’s important to note that the IRP panel has not ruled that ICANN has done anything wrong, nor that Namecheap is likely to win its case — the March 10 ruling purely assesses Namecheap’s standing to pursue the IRP.

The panel has also significantly extended the proposed timeline for the case being resolved. There now won’t be a final decision until 2022 at the earliest.

The panel last week delayed its final hearing in the case from August this year to January next year, according to a document published this week.

Other deadlines in the case have also been pushed backed weeks or months.

DNS genius and ICANN key-holder Dan Kaminsky dies at 42

Security researcher Dan Kaminsky, best known for uncovering the so-called “Kaminsky Bug” DNS vulnerability, has reportedly died at the age of 42.

It has been widely reported that Kaminsky’s niece confirmed his death from serious complications from his longstanding diabetes.

On Twitter, she rebutted emerging conspiracy theories that his death was linked to the coronavirus vaccine, which he had received April 12, saying her uncle would “laugh” at such views.

During his career as a white-hat hacker, Kaminsky worked for companies including Cisco, Avaya, and IOActive.

He occasionally spoke at ICANN meetings on security issues, and was since 2010 one of IANA’s seven Recovery Key Share Holders, individuals trusted to hold part of a cryptographic key that would be used to reboot root zone DNSSEC in the case of a massive disaster.

But he was best known for his 2008 discovery of a fundamental flaw in the DNS protocol that allowed cache poisoning, and therefore serious man-in-the middle attacks, across millions of name servers worldwide. He worked with DNS software vendors in private to help them with their patches before the problem was publicly disclosed.

His discoveries led in part to the ongoing push for DNSSEC deployment across the internet.

The vulnerability received widespread attention, even in the mainstream media, and quickly came to bear his name.

For me, my standout memory of Kaminsky is one of his series of annual “Black Ops” talks, at the Defcon 12 conference in Las Vegas in 2004, during which he demonstrated to a rapt audience of hackers how it was possible to stream live radio by caching small chunks of audio data in the TXT fields of DNS records and using DNS queries to quickly retrieve and play them in sequence.

As well as being a bit of a DNS genius, he knew how to work a stage: the crowd went mental and I grabbed him for an interview soon after his talk was over.

His death at such a young age is a big loss for the security community.

.gov TLD quietly changes hands

The .gov TLD used exclusively by governmental entities in the US has quietly changed managers.

On Friday, the IANA records for .gov changed from the General Services Administration to the Cybersecurity and Infrastructure Security Agency.

It was not unexpected. CISA announced the move in March.

But it’s less clear how the change request was handled. The ICANN board of directors certainly didn’t have a formal vote on the matter. IANA has not released a redelegation report as it would with a ccTLD.

CISA intends to make .gov domains more widely available to agencies at the federal, state, city and tribal level, and reduce the price to free or almost free.

Verisign currently manages the technical aspects of the domain, for $400 per domain per year.

ICANN asks registries to freeze Net 4 India’s expired domains

ICANN has asked all domain registries to exempt from deletion expired names registered via collapsed Indian registrar Net 4 India.

The company has been in receipt of an ICANN termination notice since the end of February, but it’s in insolvency proceedings and ICANN says the insolvency court is preventing it from carrying out the execution.

Net4’s customers have been plagued with problems such as the inability to renew or transfer their domains for well over half a year, and ICANN has issued three public breach notices since December.

ICANN says it has received more than 8,000 complaints related to the registrar — which does not even seem to have a functioning web site any more — since things got real bad last September.

Today, ICANN’s head of compliance Jamie Hedlund blogged:

While we await a final order from the insolvency court, ICANN has requested that all registries not delete expired domain names registered through Net 4 India that registrants have not been able to renew or transfer.

While this may not solve every technical issue experienced by Net4 customers, it should at least prevent them permanently losing their domains, assuming a high level of registry compliance with ICANN’s request.

Registrants won’t be fully safe until ICANN is able to carry out the termination and move Net4’s domains to a stable third-party registrar.

While ICANN disputes whether the Indian insolvency court has jurisdiction over it, it is nevertheless currently complying with its instruction to delay termination until further notice.

Hedlund wrote:

ICANN org is taking actions permitted by its agreements, policies, and law to protect registrants and to facilitate the bulk transfer of the Net 4 India registrations to a functioning registrar that can service its customers. ICANN also is being respectful of the [National Company Law Tribunal’s] processes with this case, which have not yet concluded.

He wrote that the next scheduled hearing of the NCLT is tomorrow, April 27. It appears to have been called due to Hedlund recently impressing upon the court the importance of the crisis.

Formerly massive drop-catcher faces ICANN probe

Pheenix, which used to operate a network of hundreds of accredited registrars, now faces potentially losing its last remaining accreditation, due to an ICANN probe.

ICANN told the US-based company in a breach notice last week that it faces additional action unless it fixes a bunch of problems related to domain transfers and Whois before May 14.

According to ICANN, for over a year Pheenix has been declining to provide data showing it is in compliance with the Expired Registration Recovery Policy and the Transfer Policy, related to dozens of domains.

Pheenix was told about at least one such disputed domain as far back as February last year, but ICANN says it’s been unresponsive to its outreach.

It’s also failed to implement an RDAP server, which ICANN has been nagging it about since October 2019. RDAP, the Registration Data Access Protocol, is the successor protocol to Whois.

A quick spot-check reveals that the disputed names are traffic domains once belonging to legitimate organizations, usually with inbound Wikipedia links, that were captured after the organization in question folded and its domains expired. Most were repurposed with low-quality content and advertising.

That fits in with Pheenix’s registrar business model. It was until a few years ago a huge drop-catching player, with over 500 shell accreditations it used to gain speedy access to dropping domains.

But it dumped almost 450 of these in November 2017, and another 50 the following April.

Since then, Pheenix’s primary IANA number (the coveted “888”) has been associated with fewer and fewer domains.

It had 6,930 domains under management at the end of 2020, down from a November 2017 peak of 71,592.

It hasn’t recorded any new domain adds in any gTLDs since April 2020.

According ICANN’s chronology of events, it’s sent dozens of emails, faxes and voicemails over the last year, related to multiple domain names, and it’s only received a single email in response. And that was in May 2020.

Decision on $135 million .web auction expected in weeks

ICANN, Verisign, Donuts, and the other applicants for .web will find out who gets to control the fiercely contested gTLD by the first week of June at the latest, according to Verisign’s CEO.

Jim Bidzos told analysts tonight that the Independent Review Process panel currently handling a complaint filed by Afilias declared its case closed April 7, and said that a decision will come within 60 days.

Afilias, now owned by Donuts, came second in an ICANN “auction of last resort” in which a Verisign-backed company called Nu Dot Co agreed to pay $135 million for the coveted string.

Afilias wants the auction declared invalid because ICANN, it claims, did not sufficiently pursue allegations that NDC was being secretly bankrolled by Verisign, which it says broke ICANN bylaws and new gTLD application rules.

This is denied by ICANN, as well as NDC and Verisign, which have filed legal documents with the IRP panel despite not being parties.

Afilias and others suspect that Verisign wants .web in order to bury it, keeping what could be a strong .com competitor weak, which Verisign also denies.

The IRP panel held a seven-day virtual hearing last August, but has continued to receive briefs from ICANN and Afilias since then.

Net4’s “complete breakdown” is bringing India to a screeching halt, and ICANN could have prevented it

Domains belonging to hospitals, power grids, public transit services, banks, and other critical services have gone offline due to the collapse of a major local registrar whose troubles ICANN has been aware of for years.

Net 4 India, which has been slowly imploding over the last year, saw a number of its name servers stop functioning last week, leading to customers’ web sites and email services ceasing to work.

Affected customers are not only domainers, web developers, mom-n-pop stores, and small businesses. We’re talking about major players in India’s physical infrastructure, some with billions of dollars of annual revenue.

Power Grid Corporation of India, for example, has complained to ICANN that its primary web site, at powergridindia.com, has gone down, and that its email at that domain is no longer working.

That’s a government-owned company that according to Wikipedia takes in $5.4 billion per year and is responsible for transmitting 50% of the electricity generated in India, a nation of almost 1.4 billion people.

“We are facing problems with DNS of Net4India and due to non availability of email service our operations would affect badly,” a Power Grid employee told ICANN, according to papers filed with Net4’s insolvency court at the weekend.

Others to inform ICANN of outages include:

• The Delhi Metro Rail Corporation, which with over four million passengers per day is India’s largest mass transit rail network.
• Multi-billion-dollar conglomerate Bharti Group, which has its fingers in pies such as telecoms, insurance and food, said its “email and other essential business services have been rendered defunct”.
• The Punjab National Bank, which had revenue of over $9 billion last year, named eight domains, seven of which were in gTLDs, that were with Net4 but no longer work.
• Global Hospitals India, a private healthcare provider that sees to 18,000 transplant surgeries per year, has seen its .com domain stop working and has been unable to secure an auth code for a transfer out.

I’ve not seen any reports of these internet-based problems spilling over into actual life-threatening issues such as power outages or failures of critical hospital functions, but one can only assume that not having functional email represents a risk of this kind of thing happening.

The customer testimonies cited above were part of a second batch (pdf) sent to the insolvency court handling Net4’s case by ICANN’s head of compliance, Jamie Hedlund, on Sunday.

And those are just a sampling of the over 2,400 complaints about Net4 that ICANN said it received between April 14 and April 16 last week.

Net4’s own web site appears to have been dark for most or all of this month.

And this is all happening as India’s struggle with the coronavirus pandemic hits a low point. Not only have many heavily-populated areas of the country been forced into lockdown in recent days, but the country seems to have spawned its own virus variant, which is raising concerns among scientists worldwide.

A major internet infrastructure crisis couldn’t come at a worse time, but ICANN not only could fix it now but could have prevented it years ago.

ICANN on February 26 told Net4 it would terminate the company’s Registrar Accreditation Agreement, after the company did not get its act together to fix three previous breach notices detailing its customers’ woes, the first of which was issued December 10.

That meant — or should have meant — that after March 13 ICANN would kick off its process of transferring Net4’s domains and customers to a third-party registrar, where none of this downtime nonsense would have occurred.

But the “resolution professional” trying to keep Net4 alive long enough to service its corporate creditors asked the insolvency court to ask ICANN to halt the termination, and the court complied.

Even though neither ICANN nor the court seems to be claiming that the court has any jurisdiction over a California non-profit and an RAA governed by California law, ICANN has nevertheless spent the last five weeks noticeably NOT terminating Net4 and saving its customers as promised.

Hedlund told the court (pdf) at the weekend:

Unfortunately, ICANN currently is not in a position to assist these individuals, businesses and organizations in transferring their domain names from Net 4 to another registrar because ICANN has no access to AuthInfo codes or the technical ability to generate them the way that registry operators, like the National Internet Exchange of India (NIXI), and registrars, like Net 4, can. Rather, ICANN can only assist these registrants by transitioning all of Net 4’s registrations to a functioning registrar through a bulk transfer in connection with ICANN’s termination of Net 4’s RAA, which ICANN has been prevented from doing as a result of this Hon’ble Tribunal’s Ad Interim Order of 16 March 2021

It’s not at all clear from the record why ICANN’s lawyers are allowing Net4’s customers to suffer — and its own compliance department to turn into a de facto replacement for Net4’s absentee customer service department — to abide by the suggestion of a court they claim has no power over it.

In fact, it’s not even clear why ICANN has been playing softball with Net4 since it first issued a breach notice against the firm in June 2019.

At that time, ICANN threatened to suspend Net4 for going into insolvency proceedings — the RAA gives it the right to do so unilaterally when “proceedings are instituted by or against Registrar under any bankruptcy, insolvency, reorganization or other laws relating to the relief of debtors”.

If it had wanted to, ICANN could have terminated Net4 and transferred its domains to a safe registrar in 2019, a year before its troubles (arguably exacerbated by the pandemic) started to cause serious problems for the registrar’s customers.

But ICANN did not act at that time. Instead, court filings and other documents suggest, it chose to cooperate with Net4 and the resolution professional, allowing Net4 to continue to market itself to new customers as an accredited registrar.

Hindsight is a wonderful thing, and it’s something ICANN didn’t have in June 2019.

But now that we do have that luxury, surely we can say that the Net4 debacle is going to have to go down as one of ICANN’s all-time most humiliating and potentially dangerous failures.

Facebook gunning for Web.com in latest $27 million-plus cybersquatting lawsuit

Facebook has sued what it believes is a Web.com subsidiary, claiming the company has been engaged in wholesale cybersquatting for well over a decade.

The complaint, filed in a Pennsylvania District Court, alleges that New Venture Services Corp current owns 74 domains, and has previously owned 204 more, that infringe its Facebook, Instagram and WhatsApp trademarks.

While no other named defendants are listed, the complaint makes it abundantly clear that it believes NVSC is a subsidiary of Web.com and a sister of Network Solutions, Register.com, SnapNames and Perfect Privacy.

Facebook is suing partly under the Anti-Cybersquatting Consumer Protection Act, allowing it to claim $100,000 damages per infringing domain, so we’re looking at a floor of $27.8 million of potential damages should the lawsuit be successful.

But it’s also looking for NVSC to hand over any profits it’s made from the domains in question, which are generally parked with ads and listed for sale via the SnapNames network for premium fees.

While NVSC is registered in the British Virgin Islands and uses a Pennsylvania post office box as its mailing address, there’s a wealth of evidence going back to 2007 that it’s been affiliated first with NetSol and then Web.com.

Web.com’s last regulatory filing before it went private in 2017 lists NVSC as a subsidiary, which is probably the most compelling piece of evidence establishing ownership.

It appears that NVSC is a shell company that Web.com uses to hold potentially valuable or traffic-rich domains that its customers have allowed to expire. The names are then parked and put up for resale.

Example domains listed in the complaint include httpinstagram.com, faceebbok.com, facebooc.net, instagram-login.com, and installwhatsapps.com.

One would have to assume these names were captured using a fully automated process; even a cursory human review would clock that they’re useful only to bad actors.

The lawsuit is the latest in Facebook’s crusade against mainstream registrars it believes are profiting by infringing its trademarks, which has already ensnared Namecheap a year ago and OnlineNIC in October 2019.

Namecheap recently filed a counterclaim in which it tries to get some of Facebook’s trademarks cancelled.

Facebook has all but admitted that putting legal pressure on registrars is part of its strategy when it comes to getting the policies it wants out of ICANN on privacy and Whois access, where there’s currently an impasse.

Here’s the complaint (pdf).

Verisign says it needs .web because .com is running out of names

Verisign’s affinity for cognitive dissonance has emerged yet again — it’s now claiming that it needs to be awarded the .web gTLD because it’s running out of .com domains to sell.

In legal documents released by ICANN yesterday, Verisign’s lawyers say: “The undisputed evidence is that Verisign needs a TLD like .WEB for growth given the decreased name availability in .COM”.

The admission/claim/lie (delete according to preference) came in a joint post-hearing filing by Verisign and Nu Dot Co, the .web applicant to which Verisign loaned $135 million to bid for the gTLD on its behalf at a record-breaking ICANN auction in 2016.

Afilias, now owned by Donuts, was the second-highest bidder and since November 2018 has been trying to get the auction result cancelled via ICANN’s quasi-judicial Independent Review Process.

The IRP’s final hearing was held over seven days last June, and we’ve been waiting with baited breath for a ruling ever since.

At some point over the last 48 hours, ICANN published three sets of post-hearing arguments — one from itself, one from complainant Afilias and an amicus (non-party, friend of the court) filing from Verisign/NDC.

The Verisign filing (pdf) attempts to rubbish Afilias’ claims across the board, but its rebuttal of the argument that it only wants .web in order to bury it and protect .com’s dominance is particularly interesting:

Verisign Has Every Incentive To Grow .WEB Aggressively. Afilias’ Amended IRP Request asserts without evidence that Verisign seeks to acquire .WEB in order to eliminate a potential competitor for .COM and that Afilias would make a better operator of .WEB. Afilias presented no evidence to support this claim prior to the IRP, and none was presented at the hearing. In fact, the evidence before this Panel refutes Afilias’ claims. The undisputed evidence is that Verisign needs a TLD like .WEB for growth given the decreased name availability in .COM. Even Afilias’ own experts concede that the .COM TLD now has limited name availability. Moreover, the undisputed evidence establishes that Verisign is well-positioned to maximize .WEB’s potential, while Afilias’ recent track record suggests that it would be a less effective operator of .WEB.

In June last year, Verisign had submitted to the IRP panel:

Verisign needs a new TLD like .WEB for growth. Verisign’s growth rate has declined in recent years, largely due to many names in .COM already having been taken and increased competition from new gTLDs and ccTLDs that have superior name availability.

Even Afilias’ own experts concede that the .COM name space effectively is taken. Numerous other industry participants have noted that most of the “good” names in .COM already are taken.

While Verisign had a applied for a few non-English transliterations of .com in the 2012 new gTLD application round, it had avoided getting involved with potential competitors to .com.

But, according to its brief, in 2014 it had just sold off the remainder of its non-domain businesses and, realizing its growth now needed to come from a pure domains strategy, tasked VP Paul Livesay with figuring out how it could worm its way back into the new gTLD program.

Many of the details of Livesay’s research and decision making have been redacted by ICANN (purportedly at Verisign’s request), but it seems he came to the conclusion that the best way to benefit from the program long after the application window closed would be to secretly financially back NDC’s participation in the .web auction, with the provision that the .web contract would be transferred to Verisign should it win.

Quite apart from its regular postings touting .com availability over the last few years, the same year that Verisign was coming to the conclusion that .com was becoming saturated and it needed new growth opportunities in other TLDs, it sued XYZ.com for false advertising for having the gall to suggest that it was hard to find available .com domains. It lost.

Because Verisign apparently enjoys nothing more than holding two diametrically opposed positions simultaneously, its October amicus filing also claims that .web isn’t nearly as awesome as Afilias and others claim.

On the same page that it insists that .web is needed to drive growth, Verisign poo-poos the notion that .web could be a significant competitor to .com, relying on an “expert report” commissioned by Verisign and compiled by University of Chicago economist Kevin Murphy.

(Murphy’s report is redacted in its entirety (pdf) by ICANN, but his 1,119 pages of unredacted exhibits (pdf) prominently include screenshots from this blog, so I feel the need to point out that he’s a different Kevin Murphy — he’s not me, and I’d never even heard of the dude until this morning. On a personal level, the fact that I’m apparently not even the best Kevin Murphy when it comes to the .web story that I’ve been covering for the last two decades is, as you might imagine, as depressing to me as it is presumably amusing to you.)

While his report is redacted, reading around the edges it appears that Murphy reckons .web will not be an exceptional competitor to .com.

Verisign’s October filing states:

.WEB’s Valuation Shows It is Not Particularly Competitively Significant. The Murphy Report models multiple economic scenarios to assess Afilias’ claim that the $135 million price paid for .WEB at the public auction shows that .WEB will be a substantial competitor. None of these scenarios indicate that .WEB is likely to gain a significant market share. Instead, each scenario shows that .WEB is likely to have no more than a 2–3% market share.

Because of the redactions, it’s not clear what market Murphy was referring to, but a 3% market share of the current universe of domain names across all TLDs works out to over 10 million domains. In other words, .web could be a top-five gTLD, up alongside the likes of .org.

But elsewhere in its IRP filings, Verisign cites Murphy to support its argument that .web will have “registrations in the low single digit millions”. That would still be enough to make it one of the best-selling new gTLDs.

This relatively low expected turnout of course begs the question of why Verisign needs .web to grow. It added 4 million net new names across .com and .net last year alone, with .net pretty static, according to its financial filings.

I’m no Kevin Murphy, but here’s a table I’ve thrown together showing Verisign’s domain growth over the last decade.

[table id=64 /]

Its revenue has consistently grown year over year, from $681 million in 2010 to $1.27 billion in 2020. It’s considered one of the most profitable companies in the world, and its share price has tripled since 2011.

And that was without .web.