Three more straggler new gTLDs coming soon

Three more new gTLDs from three different registries are set to launch this (northern hemisphere) summer.

Identity Digital is gearing up to launch .watches in June, while newcomer Digity will launch .case in July and Intercap will launch .box in August, according to ICANN records.

.watches was bought from luxury goods maker Richemont, which hadn’t used it, in 2020. It’s currently in sunrise and will go to general availability June 7.

Digity, which is affiliated with the registrar Sav, bought .case from CentralNic, which in turn bought it from industrial machinery maker CNH Industrial. It was a dot-brand, but will be repurposed as an open generic targeting the legal field.

Intercap is planning to start .box’s sunrise August 9 and go to general availability the following month, September 13. The gTLD was originally bought for $3 million before Intercap acquired it in 2020.

.org back-end contract up for grabs

Public Interest Registry has started vetting potential registry service provider replacements for Identity Digital, ahead of a formal request for proposals later this year.

The company said this week that in order to run .org’s back-end, which would have to support almost 11 million domains, an RSP would have to hit a list of high-end criteria.

Candidates will have to have seven years experience running an RSP across multiple TLDs, with at least three registry clients, over 500,000 domains, and at least 25 ICANN-accredited registrars on its books, among other items.

That narrows the field down to probably fewer than a dozen companies. The likes of GoDaddy, CentralNic, Verisign, ZDNS, Tucows and Nominet would all presumably qualify, along with Identity Digital itself.

If a transition to a new RSP were to happen, it would be the largest TLD back-end migration in history by a considerable margin. The largest to date was the 3.1 million names that moved from Neustar (now GoDaddy) to Afilias (now Identity Digital) in 2018.

The .org migration from Verisign to PIR in 2003 was when .org was substantially smaller, at 2.7 million names.

According to PIR’s most-recent tax return, Afilias was paid $15.6 million in 2021 for registry services.

PIR said in 2021 that it expects to issue the RFP in the second half of 2023.

Identity Digital hit by failure of Silicon Valley Bank

Identity Digital, which runs hundreds of gTLDs, has warned its network of registrars not to send payments to its Silicon Valley Bank account.

SVB, America’s 16th-largest bank, was shut down on Friday by US financial regulators after a run on deposits. The failure has been described as the largest since the 2008 financial crisis.

Identity Digital told registrars yesterday that it was an SVB customer, but said “our exposure is very limited and we remain committed to serving our customers, employees, and vendors without interruption.”

Nevertheless, it asked partners to direct payments instead to its HSBC bank account.

SVB also provided ID, then Donuts, with a $110 million credit facility in 2017, which it used to fund its $213 million acquisition of Rightside.

The failure of SVB was so worrying that US President Joe Biden yesterday morning took to the airwaves to reassure customers that their deposits were safe and the banking system stable.

Identity Digital to launch .watches this month

Identity Digital has announced the launch timetable for its .watches gTLD.

Sunrise will kick off on March 28, running for two months until May 27. This is the period where only registered trademark owners can apply for a name.

The Early Access Program, in which names carry a premium price that decreases every day for a week, will run from May 31 to June 7, immediately after which the gTLD will enter general availability.

Despite the fact that .watches has been live in the DNS since December 2015, there are no registered domains so far.

The original registry was luxury goods maker Richemont, an early proponent of new gTLDs that ultimately lost interest and offloaded its portfolio, including the Chinese version of .watches, over the years.

.watches was sold to Afilias in late 2020, shortly before that company is turn was acquired by Donuts, since rebranded Identity Digital.

IRP panel tells ICANN to stop being so secretive, again

ICANN’s dismal record of adverse Independent Review Process decisions continued last week, with a panel of arbitrators telling the Org to shape up its transparency and decision-making processes.

The panel has essentially ruled that ICANN did everything it could to be a secretive as possible when it decided to remove price controls from its .org and .info registry contracts in 2019.

This violated its bylaws commitments to transparency, the IRP panel found, at the end of a legal campaign by Namecheap commenced over three years ago.

Namecheap wanted the agreements with the two registries “annulled”, but the panel did not go that far, instead merely recommending that ICANN review its decision and possibly enter talks to put the price caps back.

But the decision contains some scathing criticisms of ICANN’s practice of operating without sufficient public scrutiny.

Namecheap had argued that ICANN broke its bylaws by not only not applying its policies in a non-discriminatory manner, but also by failing to adequately consult with the community and explain its decision-making.

The registrar failed on the first count, with the IRP panel ruling that ICANN had treated registry contract renegotiations consistently over the last 10 years — basically trying to push legacy gTLDs onto the 2012-round base Registry Agreement.

But Namecheap succeeded on the second count.

The panel ruled that ICANN overused attorney-client privilege to avoid scrutiny, failed to explain why it ignored thousands of negative public comments, and let the Org make the price cap decision to avoid the transparency obligations of a board vote.

Notably, the panel unanimously found that: “ICANN appears to be overusing the attorney-client privilege to shield its internal communications and deliberations.”

As one example, senior staffers would copy in the legal team on internal communications about the price cap decision in order to trigger privilege, meaning the messages could not be disclosed in future, the decision says.

ICANN created “numerous documents” about the thinking that went in to the price cap decision, but disclosed “almost none” of them to the IRP due to its “overly aggressive” assertion of privilege, the panel says.

As another example, staffers discussed cutting back ICANN’s explanation of price caps when it opened the subject to public comment, in order to not give too much attention to what they feared was a “hot” and “sensitive” topic.

ICANN’s failure to provide an open and transparent explanation of its reasons for rejecting public comments opposing the removal of price controls was exacerbated by ICANN’s assertion of attorney-client privilege with respect to most of the documents evidencing ICANN’s deliberations…

ICANN provided a fairly detailed summary of the key concerns about removing price caps, but then failed to explain why ICANN decided to remove price caps despite those concerns. Instead, ICANN essentially repeated the explanation it gave before receiving the public comments.

The panel, which found similar criticisms in the earlier IRP of Dot Registry v ICANN, nevertheless decided against instructing ICANN to check its privilege (to coin a phrase) in future, so the Org will presumably be free to carry on being as secretive as normal in future.

Namecheap also claimed that ICANN deliberately avoided scrutiny by allowing Org to remove the price caps without a formal board of directors resolution, and the panel agreed.

The Panel finds that of the removal of price controls for .ORG, .INFO, and .BIZ was not a routine matter of “day-to-day operations,” as ICANN has asserted. The Price Cap Decision was a policy matter that required Board action.

The panel notes that prior to the renewal of .org, .info and .biz in 2019, all other legacy gTLD contracts that had been renewed — including .pro, which also removed price caps — had been subject to a board vote.

“ICANN’s action transitioning a legacy gTLD, especially one of the three original gTLDs (.ORG), pursuant to staff action without a Board resolution was unprecedented,” the panel writes.

Quite why the board never made a formal resolution on the .org contract is a bit of a mystery, even to the IRP panel, which cites lots of evidence that ICANN Org was expecting the deal to go before the board as late as May 13, 2019, a month before the anticipated board vote.

The .org contract was ultimately signed June 30, without a formal board resolution.

(Probably just a coincidence, but Ethos Capital — which went on unsuccessfully to try to acquire .org registry Public Interest Registry from ISOC later that year — was formed May 14, 2019.)

The IRP panel notes that by avoiding a formal board vote, ICANN avoided the associated transparency requirements such as a published rationale and meeting minutes.

The panel in conclusion issued a series of “recommendations” to ICANN.

It says the ICANN board should “analyze and discuss what steps to take to remedy both the specific violations found by the Panel, and to improve its overall decisionmaking process to ensure that similar violations do not occur in the future”.

The board “should consider creating and implementing a process to conduct further analysis of whether including price caps in the Registry Agreements for .ORG and .INFO is in the global public interest”

Part of that process should involve an independent expert report into whether price caps are appropriate in .info and especially .org.

If it concludes that price controls are good, ICANN should try to amend the two registry agreements to restore the caps. If it does not conduct the study, it should ask the two registries if they want to voluntarily restore them.

Finally, the panel wrote:

the Panel recommends that the Board consider revisions to ICANN’s decision-making process to reduce the risk of similar procedural violations in the future. For example, the Board could adopt guidelines for determining what decisions involve policy matters for the Board to decide, or what are the issues on which public comments should be obtained.

ICANN is on the hook to pay the panel’s fees of $841,894.76.

ICANN said in a statement that it is “is in the process of reviewing and evaluating” the decision and that the board “will consider the final declaration as soon as feasible”.

Namecheap says it won legal fight over .org price caps

Namecheap claims to have won a fight against ICANN over the lifting of contractual price caps in .org and .info back in 2019.

The two parties have been battling it out for almost three years in an Independent Review Process case over ICANN’s decision to allow the .info and .org registries to increase their prices by as much as they want.

Namecheap now claims the decision has been delivered and “the IRP panel decided that ICANN had, indeed, violated its Bylaws and Articles of Incorporation and that ICANN’s decision to remove the price caps was invalid.”

The registrar also says it failed in its attempt to have a similar ruling with regrds the .biz TLD, but it’s not clear why.

Neither party has yet published the decision in full (ICANN is likely redacting it for publication as I type), and ICANN has yet to make a statement, so we only have Namecheap’s interpretation to go on.

It seems the IRP panel disagreed with ICANN that it was within its staff’s delegated powers to renegotiate the price provisions of the contracts without input from the board of directors.

Rather, there should be a open and transparent process, involving other stakeholders, for making such changes, the panel said according to Namecheap.

What the panel does not appear to have said is that the price caps can be unilaterally restored to the contracts. Rather, it seems to suggest a combination of voluntary reinstatements, expert competition reviews, and bilateral renegotiations.

The decision also seems to say that price controls are more important in .org than .info, due to its not-for-profit nature, which flies in the face of ICANN’s long-term push to standardize its contracts to the greatest extent possible.

The row over .org pricing emerged shortly before the ultimately unsuccessful takeover attempt of Public Interest Registry by for-profit private equity firm Ethos Capital was announced. Ethos had planned to raise prices, but PIR, still a non-profit owned by the Internet Society, to date has not.

Namecheap’s IRP claims related to ICANN’s handling of that acquisition attempt were thrown out in 2021.

.info was an Afilias TLD when the IRP was filed but is now Ethos-owned Identity Digital’s biggest gTLD following consolidation.

I’ll have more on this story after the full decision is made public.

Identity Digital sees abuse up a bit in Q3

Identity Digital has published its second quarterly abuse review, showing abuse reports up slightly overall.

The report, which covers the third quarter 2022, also shows that the registry only released the private Whois information for a single domain during the period.

ID said it closed 3,225 abuse cases in Q3, up from 3,007 in Q2, covering 4,615 domains, up from 3,816. The vast majority — almost 93% — related to phishing. That’s in line with the previous quarter.

In about 1,500 cases, the domains in question where suspended by the registry or registrar in the first 24 hours, the report says. In 630 cases, the registry took action after the registrar failed to act within 72 hours.

The company received five complaints about child sexual abuse material from the Internet Watch Foundation during the period, up a couple on Q2, but all were remediated by the registrars in question.

It received four takedown notices from the Motion Picture Association under the registry’s Trusted Notifier Program, all of which resulted in suspended domains.

There were requests for private Whois information for 20 domains, three of which were intellectual property related, but only one resulted in disclosure. In 12 cases ID took the decision not to disclose.

The company has over 260 gTLDs in its stable and over 5.5 million registered domains.

The full slide deck can be viewed here (pdf).

Elon Musk chaos credited with surge in .social regs

Elon Musk’s chaotic takeover of Twitter has been credited with leading to a surge in .social domain registrations last month, according to registry Identity Digital.

.social leaped into the top 10 of the company’s most-registered TLDs at number five internationally and number two in North America, second only to legacy .info, the company reported this week.

ID said that month-over-month .social regs increased 435% in the first two weeks of November.

It’s a pretty small TLD, so the boost only equated to an increase of about 5,000 domains in November, according to zone files, which put the current count at about 35,000.

Musk closed his acquisition in late October, and he started Trussing it into the ground the following week, laying off thousands of employees and cack-handedly attempting to monetize the “blue check mark”.

ID reckons this is behind the increase in .social sales, with CEO Akram Atallah saying in a press release: “Volatility in social platforms that people rely on leads users to take action to own their digital identity and content, which often starts with finding a domain name.”

He pointed to Twitter alternative Mastadon, which is a decentralized, open-source platform and uses a .social domain, as a driver for the growth. Some of the new .social regs point to Mastadon installs, ID said.

ID also sold premium names arts.social, lol.social and justice.social during the month, but no .social domains appear on its top 20 sales in its most-recent monthly report.

Taliban seizing domains to silence journalists

The Taliban is attempting to close down independent media outlets in Afghanistan by deleting their .af domain names.

The Ministry of Communications and Information Technology tweeted that the sites of Hasht-e Subh Daily and Zawia News were “taken down” for publishing “unbalanced reports and fake news”.

د هشت صبح او زاویه نیوز خبري شبکو وېبسايټونه د مخابراتو او معلوماتي ټکنالوجۍ وزارت له لوري وټړل شول.
هشت صبح او زاویه نیوز خبري شبکې چې د افغانستان اسلامي امارت مشرانو پورې یې دروغجن تورونه تړل، بې توازنه راپورونه او کاذب خبرونه یې خپرول د یوې فیصلې پر بنسټ یې وبسایټونه ؤتړل شول pic.twitter.com/cexPduvMjT

— Anayatullah Alokozay (@Anayatalokozay) October 3, 2022

.af’s registry is government-run.

According to the Committee to Protect Journalists, the two sites have been reporting by Afghans in exile since the Taliban retook the country over a year ago.

Both outlets have now switched domains to TLDs based in the US — Verisign and Identity Digital, where presumably they’re pretty safe from the Taliban’s reach. They’re now using zawiamedia.com and 8am.media instead of the original .af names.

Identity Digital publishes treasure trove of abuse data

Identity Digital, the old Donuts, has started publishing quarterly reports containing a wealth of data on reported abuse and the actions it takes in response.

The data for the second quarter, released (pdf) at the weekend, shows that the registry receives thousands of reports and suspends hundreds of domains for DNS abuse, but the number of domains it takes down for copyright infringement is quite small.

ID said that it received 3,007 reports covering 3,816 unique domains in the quarter, almost 93% of which related to phishing. The company said the complaints amounted to 0.024% of its total registered domains.

Most cases were resolved by third parties such as the registrar, hosting provider, or registrant, but ID said it suspended (put on “protective hold”) 746 domains during the period. In only 11% of cases was no action taken.

The company’s hitherto opaque “Trusted Notifier” program, which allows the Motion Picture Association and Recording Industry Association of America to request takedowns of prolific piracy sites resulted in six domain suspensions, all as a result of MPA requests.

The Internet Watch Foundation, which has similar privileges, resulted in 26 domains being reported for child sexual abuse material. Three of these were suspended, and the remainder were “remediated” by the associated registrar, according to ID.

The report also breaks down how many requests for private Whois data the company received, and how it processed them. Again, the numbers are quite low. Of requests for data on 44 domains, 18 were tossed for incompleteness, 23 were refused, and only three resulted in data being handed over.

Perhaps surprisingly, only two of the requests related to intellectual property. The biggest category was people trying to buy the domain in question.

This is a pretty cool level of transparency from ID and it’ll be interesting to see if its rivals follow suit.