New gTLD registries get $6 million refund

ICANN has offered new gTLD registries refunds totaling over $6 million after allegedly double-charging them for access to the Trademark Clearinghouse.
At the weekend, its board of directors resolved:

to provide a refund of $5,000, as soon as practicable, to the contracted registries or registry operators (including those that have terminated their contracts or whose TLD delegation has been revoked) that have paid to ICANN the one-time RPM access fee

The five grand fee was levied on each new gTLD as a way of funding the TMCH, which handles trademark validation for sunrise periods and other rights protection mechanisms.
But registries pointed out last October that this kind of thing was precisely what their original $185,000 applications fees were meant to cover.
The Registries Stakeholder Group said back then:

All other systems and programs related to the New gTLD Program were funded from application fees. The TMCH should have been no different and there was no reason to “double-charge” registries for this one piece of the program.

Eight months later, ICANN seems to have reluctantly agreed.
It appears that the refunds — which given over 1,200 TLDs would come to over $6 million in total — will be paid from the roughly $80 million in leftover application fees, rather than ICANN’s tightening operational budget.
While $5,000 isn’t life-changing money, it adds up to a substantial chunk of change for large portfolio registries such as Donuts, which stands to receive roughly $1.5 million.

No, I don’t get what’s going on with GDPR either

GDPR comes into effect next week, changing the Whois privacy landscape forever, and like many others I still haven’t got a clue what’s going on.
ICANN’s still muddling through a temporary Whois spec that it hopes will shield itself and the industry from fines, special interests are still lobbying for special privileges after May 25, EU privacy regulators are still resisting ICANN’s begging expeditions, and registries and registrars are implementing their own independent solutions.
So what will Whois look like from next Friday? It’s all very confusing.
But here’s what my rotting, misfiring, middle-aged brain has managed to process over the last several days.
1. Not even the ICANN board agrees on the best way forward
For the best part of 2018, ICANN has been working on a temporary replacement Whois specification that it could crowbar into its contracts in order to enforce uniformity across the gTLD space and avoid “fragmentation”, which is seen as a horrific prospect for reasons I’ve never fully understood (Whois has always been fragmented).
The spec has been based on legal advice, community and industry input, and slim guidance from the Article 29 Working Party (the group comprising all EU data protection authorities or DPAs).
ICANN finally published a draft (pdf) of the spec late last Friday, May 11.
That document states… actually, forget it. By the time the weekend was over it and I had gotten my head around it, it had already been replaced by another one.
Suffice it to say that it was fairly vague on certain counts — crucially, what “legitimate purposes” for accessing Whois records might be.
The May 14 version came after the ICANN board of directors spent 16 hours or so during its Vancouver retreat apparently arguing quite vigorously about what the spec should contain.
The result is a document that provides a bit more clarity about that it hopes to achieve, and gets a bit more granular on who should be allowed access to private data.
Importantly, between May 11 and May 14, the document started to tile the scales a little away from the privacy rights of registrants and towards towards the data access rights of those with the aforementioned legitimate purposes for accessing it.
One thing the board could agree on was that even after working all weekend on the spec, it was still not ready to vote to formally adopt it as a Temporary Policy, which would become binding on all registries and registrars.
It now plans to vote on the Temporary Policy tomorrow, May 17, after basically sleeping on it and considering the last-minute yowls and cries for help from the variously impacted parts of the community.
I’ll report on the details of the policy after it gets the nod.
2. ICANN seems to have grown a pair
Tonally, ICANN’s position seems to have shifted over the weekend, perhaps reflecting an increasingly defiant, confident ICANN.
Its weekend resolution asserts:

the global public interest is served by the implementation of a unified policy governing aspects of the gTLD Registration Data when the GDPR goes into full effect.

For ICANN to state baldly, in a Resolved clause, that something is in the “global public interest” is notable, given what a slippery topic that has been in the past.
New language in the May 14 spec (pdf) also states, as part of its justification for continuing to mandate Whois as a tool for non-technical purposes: “While ICANN’s role is narrow, it is not limited to technical stability.”
The board also reaffirmed that it’s going to reject Governmental Advisory Committee advice, which pressured ICANN to keep Whois as close to its current state as possible, and kick off a so-called “Bylaws consultation” to see if there’s any way to compromise.
I may be reading too much into all this, but it seems to me that having spent the last year coming across as a borderline incompetent johnny-come-lately to the GDPR conversation, ICANN’s becoming more confident about its role.
3. But it’s still asking DPAs for a moratorium, kinda
When ICANN asked the Article 29 Working Party for a “moratorium” on GDPR enforcement, to give itself and the industry some breathing space to catch up on its compliance initiatives, it was told no such thing was legally possible.
Not to be deterred, ICANN has fired back with a long list of questions (pdf) asking for assurances that DPAs will not start fining registrars willy-nilly after the May 25 deadline.
Sure, there may be no such thing as a moratorium, ICANN acknowledges, but can the DPAs at least say that they will take into account the progress ICANN and the industry is making towards compliance when they consider their responses to any regulatory complaints they might receive?
The French DPA, the Commission Nationale de L’informatique & Libertés, has already said it does not plan to fine companies immediately after May 25, so does that go for the other DPAs too? ICANN wants to know!
It’s basically another way of asking for a moratorium, but one based on aw-shucks reasonableness and an acknowledgement that Whois is a tricky edge case that probably wasn’t even considered when GDPR was being developed.
4. No accreditation model, yet
There’s no reference in the new spec to an accreditation model that would give restricted, tiered access to private Whois data to the likes of security researchers and IP lawyers.
The board’s weekend resolution gives a nod to ongoing discussions, led by the Intellectual Property Constituency and Business Constituency (and reluctantly lurked on by other community members), about creating such a model:

The Board is aware that some parts of the ICANN community has begun work to define an Accreditation Model for access to personal data in Registration Data. The Board encourages the community to continue this work, taking into account any advice and guidance that Article 29 Working Party or European Data Protection Board might provide on the topic.

But there doesn’t appear to be any danger of this model making it into the Temporary Policy tomorrow, something that would have been roundly rejected by contracted parties.
While these talks are being given resource support by ICANN (in terms of mailing lists and teleconferencing), they’re not part of any formal policy development process and nobody’s under any obligation to stick to whatever model gets produced.
The latest update to the accreditation model spec, version 1.5, was released last Thursday.
It’s becoming a bit of a monster of a document — at 46 pages it’s 10 pages longer than the ICANN temporary spec — and would create a hugely convoluted system in which people wanting Whois access would have to provide photo ID and other credentials then pay an annual fee to a new agency set up to police access rights.
More on that in a later piece.
5. Whois is literally dead
The key technical change in the temporary Whois spec is that it’s not actually Whois at all.
Whois is not just the name given to the databases, remember, it’s also an aging technical standard for how queries and responses are passed over the internet.
Instead, ICANN is going to mandate a switch to RDAP, the much newer Registration Data Access Protocol.
RDAP makes Whois output more machine-readable and, crucially, it has access control baked in, enabling the kind of tiered access system that now seems inevitable.
ICANN’s new temporary spec would see an RDAP profile created by ICANN and the community by the end of July. The industry would then have 135 days — likely a late December deadline — to implement it.
Problem is, with a few exceptions, RDAP is brand-new tech to most registries and registrars.
We’re looking at a steep learning curve for many, no doubt.
6. It’s all a bit of a clusterfuck
The situation as it stands appears to be this:
ICANN is going to approve a new Whois policy tomorrow that will become binding upon a few thousand contracted parties just one week later.
While registries and registrars have of course had a year or so’s notice that GDPR is coming and will affect them, and I doubt ICANN Compliance will be complete assholes about enforcement in the near term, a week’s implementation time on a new policy is laughably, impossibly short.
For non-contracted parties, a fragmented Whois seems almost inevitable in the short term after May 25. Those of us who use Whois records will have to wait quite a bit longer before anything close to the current system becomes available.

Whois working group imploding in GDPR’s wake

An ICANN working group devoted to Whois policy is looking increasingly dead after being trumped by incoming European Union privacy law.
Registration Data Services PDP working group chair Chuck Gomes threw in the towel late last week, resigning from the group shortly after cancelling proposed face-to-face meetings scheduled for the Panama ICANN meeting in June.
That followed his announcement last month that the WG’s teleconferences were to be put on hold while ICANN works out how to respond to the General Data Protection Regulation, which comes into effect May 25, 11 days from now.
The WG had been working on ICANN’s future Whois policy since November 2015 but faced the usual impasses that occur whenever the various sides of the ICANN community face off over privacy.
Gomes, a former Versign executive who retired almost a year ago but stuck around to chair the RDS group, said he’d originally expected its work to wrap up in 2017.
Now, with GDPR rendering much of the discussions moot, there’s a feeling among some WG volunteers that they’ve been wasting their time.
ICANN’s response to GDPR is expected to be an emergency, top-down policy, written by staff and approved by the board, that would stay in place for a year.
The GNSO would then have a year to rally the community, under its own emergency procedures, to make formal policy to replace it for the long term.
There’s an open question about whether the RDS WG could be re-purposed to take on this task, but it’s my sense it’s more likely that a new group would be formed.
It may prove more challenging to recruit volunteers to such a group given the experiences of the RDS crowd.
Gomes, a long-time ICANN veteran and former GNSO Council chair, plans to spend more time travelling around in his RV with his wife. We wish them well.

Have your say on single-character .com domains

ICANN wants your opinion on its plan to allow Verisign to auction off o.com, with a potential impact on the future release of other single-character .com domain names.
The organization has published a proposed amendment to the .com registry contract and opened it for public comment.
The changes would enable Verisign to sell o.com, while keeping all other currently unallocated single-character names on its reserved list.
The company would not be able to benefit financially from the auction beyond its standard $7.85 reg fee — all funds would be held by an independent third-party entity and distributed to undisclosed non-profit causes.
The arrangement would also see the buyer pay a premium renewal fee of 5% of the initial outlay, doubling the purchase price over the course of 25 years.
They would not be able to resell the domain without selling the registrant company itself.
It’s a pretty convoluted system being proposed, given that there may well end up only being one bidder.
Overstock.com, the online retailer, has been pressuring ICANN and Verisign to release o.com for well over a decade, and the proposed auction seems to be a way to finally shut it up.
The company has a US trademark on O.com, so any other bidder for the name would probably be buying themselves a lawsuit.
The proposed auction system does not address trademark issues — there’s no sunrise period of trademark claims period.
One party already known to be upset about lack of rights protection is First Place Internet, a search engine company that has a US trademark on the number 1.
It told ICANN (pdf) back in January that the o.com deal would “set a dangerous precedent” for future single-character name releases.
The ICANN public comment period, which comes after ICANN received the all-clear from US competition regulators, closes June 20.
As a matter of disclosure, several years ago I briefly acted as a consultant to a third party in support of the Verisign and Overstock positions, but I have no current interest in the situation one way or the other.

ICANN flips off governments over Whois privacy

ICANN has formally extended its middle finger to its Governmental Advisory Committee for only the third time, telling the GAC that it cannot comply with its advice on Whois privacy.
It’s triggered a clause in its bylaws used to force both parties to the table for urgent talks, first used when ICANN clashed with the GAC on approving .xxx back in 2010.
The ICANN board of directors has decided that it cannot accept nine of the 10 bulleted items of formal advice on compliance with the General Data Protection Regulation that the GAC provided after its meetings in Puerto Rico in March.
Among that advice is a direction that public Whois records should continue to contain the email address of the registrant after GDPR goes into effect May 25, and that parties with a “legitimate purpose” in Whois data should continue to get access.
Of the 10 pieces of advice, ICANN proposes kicking eight of them down the road to be dealt with at a later date.
It’s given the GAC a face-saving way to back away from these items by clarifying that they refer not to the “interim” Whois model likely to come into effect at the GDPR deadline, but to the “ultimate” model that could come into effect a year later after the ICANN community’s got its shit together.
Attempting to retcon GAC advice is not unusual when ICANN disagrees with its governments, but this time at least it’s being up-front about it.
ICANN chair Cherine Chalaby told GAC chair Manal Ismail:

Reaching a common understanding of the GAC’s advice in relation to the Interim Model (May 25) versus the Ultimate Model would greatly assist the Board’s deliberations on the GAC’s advice.

Of the remaining two items of advice, ICANN agrees with one and proposes immediate talks on the other.
One item, concerning the deployment of a Temporary Policy to enforce a uniform Whois on an emergency basis, ICANN says it can accept immediately. Indeed, the Temporary Policy route we first reported on a month ago now appears to be a done deal.
ICANN has asked the GAC for a teleconference this week to discuss the remaining item, which is:

Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;

Basically, the GAC is trying to prevent the juicier bits of Whois from going dark for everyone, including the likes of law enforcement and trademark lawyers, two weeks from now.
The problem here is that while ICANN has tacit agreement from European data protection authorities that a tiered-access, accreditation-based model is probably a good idea, no such system currently exists and until very recently it’s not been something in which ICANN has invested a lot of focus.
A hundred or so members of the ICANN community, led by IP lawyers who won’t take no for an answer, are currently working off-the-books on an interim accreditation model that could feasibly be used, but it is still subject to substantial debate.
In any event, it would be basically impossible for any agreed-upon accreditation solution to be implemented across the industry before May 25.
So ICANN has invoked its bylaws fuck-you powers for only the third time in its history.
The first time was when the GAC opposed .xxx for reasons lost in the mists of time back in 2010. The second was in 2014 when the GAC overstepped its powers and told ICANN to ignore the rest of the community on the issue of Red Cross related domains.
The board resolved at a meeting last Thursday:

the Board has determined that it may take an action that is not consistent or may not be consistent with the GAC’s advice in the San Juan Communiqué concerning the GDPR and ICANN’s proposed Interim GDPR Compliance Model, and hereby initiates the required Board-GAC Bylaws Consultation Process required in such an event. The Board will provide written notice to the GAC to initiate the process as required by the Bylaws Consultation Process.

Chalaby asked Ismail (pdf) for a call this week. I don’t know if that call has yet taken place, but given the short notice I expect it has not.
For the record, here’s the GAC’s GDPR advice from its Puerto Rico communique (pdf).

the GAC advises the ICANN Board to instruct the ICANN Organization to:
i. Ensure that the proposed interim model maintains current WHOIS requirements to the fullest extent possible;
ii. Provide a detailed rationale for the choices made in the interim model, explaining their necessity and proportionality in relation to the legitimate purposes identified;
iii. In particular, reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;
iv. Distinguish between legal and natural persons, allowing for public access to WHOIS data of legal entities, which are not in the remit of the GDPR;
v. Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;
vi. Ensure that limitations in terms of query volume envisaged under an accreditation program balance realistic investigatory crossreferencing needs; and
vii. Ensure confidentiality of WHOIS queries by law enforcement agencies.
b. the GAC advises the ICANN Board to instruct the ICANN Organization to:
i. Complete the interim model as swiftly as possible, taking into account the advice above. Once the model is finalized, the GAC will complement ICANN’s outreach to the Article 29 Working Party, inviting them to provide their views;
ii. Consider the use of Temporary Policies and/or Special Amendments to ICANN’s standard Registry and Registrar contracts to mandate implementation of an interim model and a temporary access mechanism; and
iii. Assist in informing other national governments not represented in the GAC of the opportunity for individual governments, if they wish to do so, to provide information to ICANN on governmental users to ensure continued access to WHOIS.

Van Gelder remembered in GNSO resolution

Former GNSO Council chair Stéphane Van Gelder, who died last month, has been remembered in a motion passed by the Council on Friday.
The motion noted that Van Gelder was “a well-respected and much liked” member of the ICANN community, “admired for his passion, his fairness, his ability to find the best in people and his true gift for uniting people.”
It recognizes the “significant contribution” he made to the GNSO, his “genuine passion, energy and commitment” to his role, and concludes by offering “heartfelt sympathies to his family and friends”.
I’m reproducing the whole motion, which was obviously passed unanimously, here:

Whereas:

1. 1. Stéphane Van Gelder first entered the domain name business in the late 1990s when he founded Indom, a registrar in France, which later become part of the GroupNBT based in the United Kingdom. It was while Stéphane was General manager of INDOM that he was elected to the GNSO Council by the Registrar Stakeholder Group.
2. 2. Stéphane served on the GNSO Council from 2008 through 2012, as an elected representative of the Registrars Constituency.
3. 3. Stéphane served as Vice Chair of the GNSO Council in 2010 and was elected and served two consecutive terms as Chair of the GNSO Council in 2011 and 2012.
4. 4. As Chair of the GNSO Council, Stéphane was an impartial and neutral facilitator on all issues. For Stéphane, remaining neutral was key to ensuring collective dialogue.
5. 5. Stéphane made significant contributions to ICANN and was a strong and respected community leader. During his tenure as GNSO Chair, Stéphane oversaw and shepherded the:
   1. a. completion of an extensive update of the GNSO’s operating procedures;
   2. b. establishment of the DNS Security & Stability Analysis working group jointly with the ALAC, ccNSO and NRO;
   3. c. completion of the Fast Flux, Post-Expiration Domain Name Recovery and Inter-Registrar Transfer Policy (IRTP) Part B Policy Development Processes (PDPs) and the joint ccNSO-GNSO Internationalized Domain Name working group;
   4. d. launch of the IRTP Part C, Thick WHOIS and Locking of Domain Names subject to Uniform Dispute Resolution Policy Proceedings PDPs; and (e) continuing work on WHOIS studies, registration abuse policies, and multiple other GNSO projects.
   5. e. the completion of the Applicant Guidebook for the 2012 New gTLD Program and the launch of the Program.
   6. f. Stéphane was a well-respected and much liked member of not only the GNSO, but of the broader ICANN Community. He was admired for his passion, his fairness, his ability to find the best in people and his true gift for uniting people.
   7. g. Stéphane’s passing is a great loss to the many people in the ICANN community that had the pleasure to work and interact with him, and for his many friends at ICANN the loss is significant.

Resolved:

1. 1. The GNSO Council wishes to recognize the significant contribution Stéphane made to the GNSO Council during his tenure and his notable achievements during this time.
2. 2. Stéphane’s genuine passion, energy and commitment to the Internet and all that it brought to the world was second to none and we will miss him dearly.
3. 3. On behalf of the current and previous GNSO Councils, we offer our deepest and heartfelt sympathies to his family and friends at this most difficult time.

Van Gelder died after an automobile accident, which also injured his wife, in Switzerland at the end of March.

$55 billion bank not paying its $6,250 ICANN fees

Kuwait Finance House has become the latest new gTLD registry to get slapped with an ICANN breach notice for not paying its quarterly fees.
The company is a 40-year-old, Sharia-compliant Kuwaiti bank managing assets of $55.52 billion, according to Wikipedia. It has annual revenue in excess of $700 million.
But apparently it has not paid its fixed ICANN dues — $6,250 per quarter — for at least six months, according to ICANN’s breach letter (pdf).
KFH runs .kfh and the Arabic internationalized domain name equivalent .بيتك (.xn--ngbe9e0a) as closed, dot-brand domains.
Neither appears to have any live sites, but both appear to be in their launch ramp-up phase.
ICANN has been nagging the company to pay overdue fees since November, without success, according to its letter.
They’re the third and fourth new gTLD registries to get deadbeat breach notices this month, after .qpon and .fan and .fans.

ICANN cancels registrar audit as GDPR headaches loom

ICANN has decided to call off a scheduled audit of its registrar base, to enable registrars to focus on sorting out compliance with the General Data Protection Regulation.
The biannual audit, carried out by ICANN Compliance, was due to start in May. As you likely know by now, May 25 is GDPR Day, when the EU’s privacy law comes into full effect.
In a letter (pdf) to registrars, senior VP of compliance Jamie Hedlund said: “The April 2018 registrar audit round is on hold.”
He added: “We are reviewing the schedule, resources and risks associated with holding a single, larger audit round in autumn of 2018, as well as considering alternative approaches.”
His letter came in response to a plea (pdf) from Registrar Stakeholder Group chair Graeme Bunton, who said an audit that clashed with GDPR deadline would be an “enormous undertaking” for affected registrars.
The audits, which have been running for a few years, randomly select a subset of registries and registrars to spot-check compliance with their Registrar Accreditation Agreements and Registry Agreements.
The program looks at 20-odd areas of compliance, one of which is Whois provision.

Iceland breaks ranks on Whois, will publish emails

Iceland’s ccTLD has become what I believe is the first registry to state that it will continue to publish email addresses in public Whois records after the General Data Protection Regulation comes into effect.
The move seems to put the registry, ISNIC, in direct conflict with the opinions of European data protection authorities.
The company said in a statement last week that after GDPR comes into effect May 25 it will stop publishing almost all personal information about .is registrants in the public Whois.
However, it broke ranks with other European ccTLDs and the likely ruleset for ICANN-regulated gTLDs, by saying it would not expunge email addresses:

ISNIC will however, at least for the time being, continue to publish email addresses, country and techincal information of all NIC-handles associated with .is domains. Those customers (individuals) who have recorded a personally identifiable email address, and do not want it published, will need to change their .is WHOIS email address to something impersonal.

Registrants will be able to opt in to having their full details published.
ISNIC appears to be taking a principled stand against the Draconian regulation. It said in a statement:

Assuming that GDPR directive applies fully to the “WHOIS” service provided for decades by most ccTLD registries, these new restrictions will lead to less transparency in domain registrations and less trust in the domain registration system in general. ISNIC, as many others, strongly disagrees with the view of the European parlament [sic] in this matter and warns that GDPR, as it is being implemented, will neither lead to better privacy nor a safer network environment.

It’s a surprising decision, given that privacy regulators have indicated that they agree that email addresses are personal data that should not be published.
The Article 29 Working Party told ICANN earlier this month that it “welcomed” a proposal to replace email addresses with anonymized emails or web-based contact forms.

Muslim world still thinks .islam isn’t kosher

The Organization of Islamic Cooperation has repeated its objection to the gTLDs .islam and .halal ever seeing the light of day.
OIC Secretary General Yousef Al-Othaimeen wrote to ICANN earlier this month to declare that its position on the two controversial applications has not changed since it initially objected to them in 2013.
The OIC comprises the foreign ministers from 57 majority-Muslim countries and these ministers recently voted unanimously to re-adopt the 2013 objection, Al-Othaimeen said (pdf).
The group “maintain the position that the new gTLDs with Islamic identity are extremely sensitive in nature as they concern the entire Muslim nature” he wrote.
He reiterated “official opposition of the OIC Member states towards the probable authorization that might allow the use of these gTLDs .islam and .halal by any entity.”
This puts ICANN between a rock an a hard place.
The applicant for both strings, Turkish outfit Asia-Green IT Systems (AGIT), won an Independent Review Process case against ICANN last November.
The IRP panel ruled that ICANN broke its own bylaws when it placed .islam and .halal into permanent limbo — an “On Hold” status pending withdrawal of the applications or OIC approval — in 2014.
ICANN’s board accepted the ruling and bounced the decision on whether to finally approve or reject the bids to its Board Accountability Mechanisms Committee, which is currently mulling over the problem.
Technically, it’s “non-consensus Governmental Advisory Committee advice”, which means the board has some wriggle room to simply accept the advice and reject the applications.
But AGIT’s lawyer disagrees, recently telling ICANN (pdf) its options are to approve the bids or facilitate dialogue towards their approval, rather like ICANN is doing with .amazon right now.