Governments to focus on new gTLDs during ICANN’s new eight-day Toronto meeting

ICANN may have received a bit of flak for cancelling Fridays earlier this year, but as it turns out ICANN meetings are getting longer, not shorter.
The recently published schedule for next month’s Toronto meeting covers eight days, from Friday October 12 to Friday October 19.
The official start of the event will as always be on the Monday (with the work really starting on the Saturday) and the official end will be on Thursday for the second time in a row.
But this time there’s also going to be some special-interest sessions on both Fridays too.
In a change to the usual order of things, the Governmental Advisory Committee has scrapped some of its meetings with other ICANN advisory committees and supporting organizations.
Instead, word is that the GAC plans to focus almost entirely on developing its new gTLD Early Warnings — preliminary warnings about objectionable applications — during the Toronto meeting.
It’s replacing its smaller inter-committee sessions with a one-off High-Level Meeting with SO and AC heads, which we understand is designed to bring newly participating governments up to speed on how ICANN works.
Should we expect to see a bigger GAC in Toronto, now that governments have the opportunity to start complaining about specific applications? It certainly seems possible.

Tonkin says better new gTLD trademark protections could come in the first round

Groups pushing for stronger new gTLD trademark protection mechanisms could get some of their wishes if they present a unified, coherent position to ICANN.
That’s according to Melbourne IT chief strategy officer and ICANN vice chairman Bruce Tonkin, speaking to DI today about the company’s trademarks summit in Washington DC last week.
Tonkin said that the event identified five rough areas of consensus about changes to rights protection mechanisms, at least two of which could be made before new gTLDs start to go live (which he expects to happen in the fourth quarter of 2013).
The Business Constituency, IP Constituency and so-called “brand summit” are now talking about their areas of common ground and are expected to continue the conversation at the ICANN meeting in Toronto next month.
One area of apparent agreement is an extension to the Trademark Claims service – which alerts trademark owners when somebody registers a domain matching their mark – beyond the 60 days mandated by the Applicant Guidebook.
Trademark interests want the service made permanent, because cybersquatters don’t suddenly stop registering infringing domain names 60 days after a TLD hits general availability.
ICANN has resisted this change, as CEO Fadi Chehade explained last week, largely because several companies already offer commercial trademark watch services.
Many registries and registrars are also against such a move due to the potential cost considerations.
However, Tonkin does not appear to be convinced by either argument.
“Even though a single gTLD might be for 60 days, gTLDs will launch at a range of different times over a number of years. Registries and registrars will have to support that process over a couple of years,” he said. “The cost to industry to extend it over 60 days isn’t that high.”
While supporting the extension may seem like an own goal for Melbourne IT – one of the companies already selling brand monitoring services – Tonkin is not too concerned about losing business.
The value of such services is in the added intelligence, such as monitoring the usage of infringing domains and recommending recovery strategies, he said, not just supplying lists of domains.
“Just that raw data isn’t especially beneficial,” he said.
There’s also no service on the market today that, like Trademark Claims, alerts registrants about third-party trademark rights at the point of registration, Tonkin noted.
Extending Trademark Claims could be seen as a matter of implementation, rather than policy, and may be one of the easiest goals for the trademark community to achieve.
“With enough community support, GNSO advice or ALAC advice could be presented to the board, which could make changes to the Applicant Guidebook,” Tonkin said.
“But I think the board would be reluctant to do that unless it saw very clear support from the community,” he added.
A faster, cheaper Uniform Rapid Suspension system is something that could also be made to happen via “implementation” tweaks, he indicated.
Trademark owners are looking for URS to be priced in the $300-$500 range, which WIPO and the National Arbitration Forum don’t think is feasible the way it is currently structured.
ICANN plans to issue a Request For Proposals soon, according to chief of strategy Kurt Pritz, in order to see if any other provider can do it more cheaply, however.
Another request from trademark holders, to do registrant identity checking — such as email authentication — could be handled via the ongoing Registrar Accreditation Agreement talks, Tonkin suggest.
But other emerging consensus areas would be more suited to a full GNSO Policy Development Process, he said.
The IP community wants the Trademark Clearinghouse to include not only exact matches of their trademarks, but also mark+keyword records (such as googlesearch.tld or paypalpayments.tld).
While there’s agreement in principle among these constituencies, there are still some differences in the details, however.
Some say that the keywords should be limited to words included in the trademark registration, while others believe that mark+keywords won in UDRP cases should be included.
If the former approach is used, domains such as paypal-support.tld, to borrow the example repeatedly used at last week’s summit, would probably not be protected.
Tonkin said that last week’s summit seemed to produce agreement that an algorithmic approach would be too complex, and would generate far to many false positives, to be effective.
A PDP would also be likely be required to find agreement on a mandatory “blocking” system, along the lines of what ICM Registry created for its Sunrise B, Tonkin said.
The problem with PDPs is that they take a long time, and it’s very unlikely that they could produce results in time for the first new gTLD launches.
Tonkin, however, suggested that moving forward with a PDP would create a strong incentive for new gTLD registries to create and adhere to voluntary best practices.
He pointed out that many applicants plan to bring in stronger rights protection mechanisms than ICANN requires already.
While Tonkin is vice chairman of ICANN’s board, he’s not involved in any new gTLD decisions or discussions due to his conflict of interest as a senior executive at a major registrar.

Delaware secretary of state opposes any corporate-themed new gTLDs

The secretary of state for Delaware has come out in opposition to new gTLD applications such as .inc, .corp and .ltd.
Jeff Bullock filed the comments with ICANN today, despite having previously suggested that some applications might have sufficient restrictions to make them acceptable.
Bullock wrote (emphasis added):

none of the applications contains a fully thought out, achievable, transparent and enforceable system for fully safeguarding that a firm remains legally registered with a company registry at all times.
…
none of the applications adequately safeguards consumers, legitimate businesses, the public at large, state regulators, and the internet itself from the risks that “company endings” are used for fraudulent or misleading purposes.
Therefore, at this stage of the gTLD process, I strongly believe that the public is best served if these company endings are not made available for use. There is no overriding public policy purpose or strong business case for making them available and the opportunity for fraud and abuse is very high.

There are a few dozen corporate-themed gTLD applications, including contests for: .inc, .corp, .llp, .ltd, .company and .gmbh.
Back in March, before any of the applications had been published, Bullock and other secretaries of state said that such gTLDs should only be approved with “restrictions that would attempt to protect legitimate businesses and consumers from confusion or fraud.”
His letter suggested that DOT Registry’s proposals might be adequate, but he’s apparently changed his mind after reading the applications.
Based on the March letters, I’d say there’s a strong possibility of objections being filed against some or all of these applications.
Delaware is of course the state most big US companies choose to register themselves in, due to its generous company laws.

New ICANN chief pours cold water on new gTLD trademark protection demands

Some of the enhanced trademark protection mechanisms being discussed currently by the IP lobby seem unlikely to be adopted by ICANN any time soon, if a response to Congress from new CEO Fadi Chehadé is any guide.
In a letter published tonight, Chehadé appears to rule out both the inclusion of ‘brand+keyword’ records in the Trademark Clearinghouse and an extension of the Trademark Claims service beyond 60 days.
These are two of the common demands to emerge recently from ICANN’s Business Consituency, Intellectual Property Constituency, and the so-called “brand summit” proposal.
The Chehadé letter was sent yesterday to the chairs and ranking members of the Judiciary Committees of both the House and Senate, in response to their August 7 letter.
On extending the Trademark Claims service — which alerts trademark owners when somebody registers a domain exactly matching their mark — beyond the current 60 days, he wrote:

For the first round of new gTLDs, ICANN is not in a position to unilaterally require today an extension of the 60-day minimum length of the trademark claims service. The 60-day period was reached through a multi-year, extensive process with the ICANN community. One reason for this is that there are existing IP Watch services that address this needs. Those community members that designed the Trademark Claims process were cognizant of existing protections and sought to fill gaps, not replace existing services and business models.

While this obviously does not rule out an extension of Trademark Claims, it’s pretty clear from the letter that ICANN has no plans to do so without some form of community consent.
On the matter of brand+keyword protections, seen by the trademark community as a crucial component of a strong anti-cybersquatting regime, Chehadé wrote:

It is important to note that the Trademark Clearinghouse is intended be a repository for existing legal rights, and not an adjudicator of such rights or creator of new rights. Extending the protections offered through the Trademark Clearinghouse to any form of name (such as the mark + generic term suggested in your letter) would potentially expand rights beyond those granted under trademark law and put the Clearinghouse in the role of making determinations as to the scope of particular rights.

He goes on to say that providing enhanced rights protection mechanisms is optional for new gTLD registries and may be one way that they can competitively differentiate themselves.
Indeed, large applicants such as Donuts, Uniregistry and Google say they will offer RPMs that go above and beyond what is required by ICANN.
Extended trademark claims and the brand+keyword protections are two of the changes to the current proposed mesh of mechanisms that the trademark community has found common ground on recently.
At the Melbourne IT trademark summit in Washington DC earlier this week, these two areas were among those that appeared to have the most consensus.
However, applicants for mass-market gTLDs are fervently opposed to changes being made to the Applicant Guidebook at this late stage.
Jon Nevett, co-founder of Donuts, said at the Melbourne IT event that “the Applicant Guidebook at this point should be deemed closed”.
He pointed out that, having paid ICANN about $350 million in application fees, applicants should be considered contracted parties and have their expectations respected.

Consumer Watchdog slams “outrageous” Google and Amazon keyword gTLD bids

Consumer Watchdog, a California-based consumer rights advocacy group, has attacked Google and Amazon’s new gTLD applications in a letter to an influential senator.
The organization has asked Sen. Jay Rockefeller, chair of the Senate Commerce, Science and Transportation Committee, to “thwart” the “outrageous” plans for single-registrant dictionary-word gTLDs.
Google and Amazon have separately applied for dozens of gTLDs — such as .music, .blog and .book — that they would exclusively use to market their own products and services.
Consumer Watchdog said in its letter (pdf):

If these applications are granted, large parts of the Internet would be privatized. It is one thing to own a domain associated with your brand, but it is a huge problem to take control of generic strings. Both Google and Amazon are already dominant players on the Internet. Allowing them further control by buying generic domain strings would threaten the free and open Internet that consumers rely upon. Consumer Watchdog urges you to do all that you can to thwart these outrageous efforts and ensure that the Internet continues its vibrant growth while serving the interests of all of its users.

As we reported yesterday, a number of domain name industry participants are planning to complain to ICANN about these applications on pretty much the same grounds.

Industry objection forming to Google and Amazon’s keyword gTLD land grab

Members of the domain name industry, led by Michele Neylon of Blacknight, plan to complain to ICANN about dozens of single-registrant new gTLD applications filed by Google and Amazon.
The signatories of a new letter are bothered by plans by these companies and others to hold dictionary word gTLDs for their own exclusive use, not allowing regular internet users to register domains.
While the letter does not call out applicants by name, it specifically mentions .blog, .music and .cloud as examples of potentially objectionable single-registrant gTLDs.
Google has applied for .blog and .cloud for its own use, among many others. Amazon has done the same for .cloud and .music and dozens of others. All three are heavily contested.
The letter is so far signed by 13 people, many of whom work for registrars. It states in part:

generic words used in a generic way belong to all people. It is inherently in the public interest to allow access to generic new gTLDs to the whole of the Internet Community, e.g., .BLOG, .MUSIC, .CLOUD. Allowing everyone to register and use second level domain names of these powerful, generic TLDs is exactly what we envisioned the New gTLD Program would do. In contrast, to allow individual Registry Operators to segregate and close-off common words for which they do not possess intellectual property rights in effect allows them to circumvent nation-states’ entrenched legal processes for obtaining legitimate and recognized trademark protections.

The ICANN Applicant Guidebook gives certain special privileges to single-registrant gTLDs.
In its discretion, ICANN can release such registries from the Code of Conduct, which obliges them to treat all accredited registrars on a non-discriminatory basis.
The condition for this exception is that “all domain name registrations in the TLD are registered to, and maintained by, Registry Operator for its own exclusive use”.
The measure was designed to capture dot-brand gTLDs such as .google and .amazon, where only the registry itself controls the second-level domain names.
But Google seems to want to benefit from the exception to the Code of Conduct while still offering second-level domains for use by its customers, at least in some applications.
In its .blog application, for example, it states:

Charleston Road Registry [the applying Google subsidiary] intends to apply for an exemption to ICANN’s Registry Operator Code of Conduct and operate the proposed gTLD with Google as the sole registrar and registrant. The proposed gTLD will specifically align with Blogger, an existing Google product, and will provide users with improved capabilities that meet their diverse needs.
The specialization goal of the proposed gTLD is to provide a dedicated second-level domain space for the management of a userʹs Blogger account.

However, the same application also states:

The mission of the proposed gTLD is to provide a dedicated domain space in which users can publish blogs. All registered domains in the .blog gTLD will automatically be delegated to Google DNS servers, which will in turn provide authoritative DNS responses pointing to the Google Blogger service. The mission of the proposed gTLD is to simplify the Blogger user experience. Users will be able to publish content on a unique .blog domain (e.g., myname.blog) which will serve as a short and memorable URL for a particular Blogger account.

“Google want .blog to be only for Blogspot users, which is insane,” Neylon told DI. “No one company should have control of a generic name space like that.”
“The new TLD project spent thousands of hours working on protecting IP rights, and then you get big companies blatantly abusing the system,” he said.
It’s not at all clear whether Google’s plan for .blog is a permitted use case. Does Google’s plan for .blog and other gTLDs mean third parties will be “controlling” and/or “using” .blog domains?
Or is its plan more akin to a dot-brand offering its customers vanity URLs, such as kevin.barclays or john.citi?
I err to the former interpretation.
When a new gTLD applicant asked ICANN for clarity on this matter last December, ICANN’s response was:

“Exclusive use” has its common meaning. The domain name must be exclusively used by the Registry Operator, and no unaffiliated (using the definition of “Affiliate” in the Registry Agreement) third-party may have control over the registration or use of the domain name.

Neylon said he plans to send the letter to ICANN management, board and new gTLD program Independent Objector next week. There’s no target number of signatures.

ICANN plans meeting on URS amid calls for RFP

ICANN wants to try to put the unresolved issues surrounding the Uniform Rapid Suspension system to bed and is planning a meeting in a couple of weeks time to solicit community input.
According to an email from chief of strategy Kurt Pritz to the GNSO Council and At-Large Advisory Committee, ICANN plans to hold a webinar, with a possible face-to-face option, in about two weeks.
The aim is to sort out the problems with URS, which was originally conceived as a faster, cheaper version of UDRP for clear-cut cases of cybersquatting that don’t require much thought to decide.
It’s currently neither fast enough for the trademark lobby’s liking, nor as cheap as ICANN had hoped.
ICANN had targeted a $300 to $500 fee to file URS complaints, but following conversations with the World Intellectual Property Organization and National Arbitration Forum it realized that the true cost was likely to be as much as triple that amount, more in line with UDRP fees.
The higher than expected costs are largely due to the additional registrant protections that were negotiated into the URS procedure over the last few years, which complicate matters.
At a session at the ICANN meeting in Prague this June, community members tried to figure out ways to make URS cheaper without compromising these protections.
Pritz’s email suggested that some of these ideas might work, but others might run counter to established policy.
Many parties on both side of the fence are coming to the realization that unless URS is in place, new gTLD registries that are contractually obliged to abide by it may not be able to launch.
Yesterday, at Melbourne IT’s summit on trademark protection in Washington DC, there were some calls for ICANN to just issue a request for proposals and see which provider offers the best price.
There are plenty of UDRP lawyers/panelists who believe URS cases can easily be handled in 15 minutes at $200, assuming most of the process is automated and the complaints are kept to a word limit.

ICANN sets deadline to sort out Olympic shambles

ICANN’s board of directors has set itself a deadline to come to a decision on special new gTLD protections for the International Olympic Committee and Red Cross.
It’s looking rather like the IOC, Red Cross and Red Crescent are going to get more of the concessions they’ve been asking for for the last few years, including protection at the second level.
In a resolution passed last week, the ICANN board urged the Generic Names Supporting Organization to make recommendations before January 31 next year, and indicated that it would take matters into its own hands if GNSO consensus cannot be found.

Resolved, the Board thanks the GNSO for its continued attention and ongoing work on this topic, and requests that the GNSO continue its work on a policy recommendation on second-level protections for the IOC and Red Cross/Red Crescent names on an expedited basis.
Resolved (NG2012.09.13.01), if it is not possible to conclude the policy work prior to 31 January 2013, the Board requests that the GNSO Council advise the Board by no later than that date if it is aware of any reason, such as concerns with the global public interest or the security or stability of the DNS, that the Board should take into account in making its decision about whether to include second level protections for the IOC and Red Cross/Red Crescent names

The GNSO has a working group looking at the problem, which is currently deciding whether to recommend starting a formal Policy Development Process.
Given that new gTLDs are expected to start launching in less than a year, and given that PDPs take forever to wrap up, if they ever do, it’s also trying to decide whether to recommend that the IOC/RC/RC marks should be protected in the interim.
Exact matches of the Olympic and Red Cross names, as well as a limited number of translations, would be “reserved” or otherwise removed from sale by each new gTLD registry.
The ICANN board appears to be leaning towards granting these interim protections. In last week’s resolution, it stated:

the Board favors a conservative approach, that restrictions on second-level registration can be lifted at a later time, but restrictions cannot be applied retroactively after domain names are registered.

The IOC/RC/RC debate has been going on since June 2011, when the ICANN board gave the organizations temporary top-level protection in new gTLDs and then passed the hot potato to the GNSO.
The GNSO working group tasked with sorting through the resulting policy mess was subsequently hindered by procedural posturing and acrimony at the Council level and an unreceptive board.
There’s a parallel argument going on at the moment with intergovernmental organizations demanding the same or greater protection, too. Expect IGOs to react with further (mock?) outrage if the IOC/RC/RC get special treatment.
Recently unredacted ICANN board briefing documents reignited the IGO debate last week.

Registries propose PKI-based new gTLD sunrises

Neustar and ARI Registry Services have come up with an alternative to ICANN’s proposed new gTLDs sunrise period process, based on a secure Public Key Infrastructure.
The concept was outlined in a draft paper published today, following an intensive two-day tête-à-tête between domain companies and Trademark Clearinghouse providers IBM and Deloitte last month.
It’s presented as an alternative to the implementation model proposed by ICANN, which would use unique codes and was criticized for being inflexible to the needs of new gTLD registries.
The PKI-based alternative from Neustar and ARI would remove some of the cost and complexity for registries, but may create additional file-management headaches for trademark owners.
Under the ICANN model, which IBM and Deloitte are already developing, each trademark owner would receive a unique code for each of their registered trademarks and each registry would be given the list of codes.
If a trademark owner wanted a Sunrise registration, it would submit the relevant code to their chosen registrar, which would forward it to the registry for validation against the list.
One of the drawbacks of this method is that registries don’t get to see any of the underlying trademark data, making it difficult to restrict Sunrise registrations to certain geographic regions or certain classes of trademark.
If, for example, .london wanted to restrict Sunrise eligibility to UK-registered trademarks, it would have no easy way of doing so using the proposed ICANN model.
But IP interests participating in the development of the Trademark Clearinghouse have been adamant that they don’t want registries and registrars getting bulk access to their trademark data.
They’re worried about creating new classes of scams and have competitive concerns about revealing their portfolio of trademarks.
Frankly, they don’t trust registries/rars not to misuse the data.
(The irony that some of the fiercest advocates of Whois accuracy are so concerned about corporate privacy has not been lost on many participants in the TMCH implementation process.)
The newly proposed PKI model would also protect trademark owners’ privacy, albeit to a lesser extent, while giving registries visibility into the underlying trademark data.
The PKI system is rather like SSL. It used public/private key pairs to digitally sign and verify trademark data.
Companies would submit trademark data to the Clearinghouse, which would validate it. The TMCH would then sign the data with its private key and send it back to the trademark owner.
If a company wished to participate in a Sunrise, it would have to upload the signed data — most likely, a file — to its registrar. The registrar or registry could then verify the signature using the TMCH’s public key.
Because the data would be signed, but not encrypted, registrars/ries would be able to check that the trademark is valid and also get to see the trademark data itself.
This may not present a privacy concern for trademark owners because their data is only exposed to registries and registrars for the marks they plan to register as domains, rather than in bulk.
Registries would be able to make sure the trademark fits within their Sunrise eligibility policy, and would be able to include some trademark data in the Whois, if that’s part of their model.
It would require more file management work by trademark owners, but it would not require a unique code for each gTLD that they plan to defensively register in.
The Neustar/ARI proposal suggests that brand-protection registrars may be able to streamline this for their clients by enabling the bulk upload of trademark Zip files.
The overall PKI concept strikes me as more elegant than the ICANN model, particularly because it’s real-time rather than using batch downloads, and it does not require the TMCH to have 100% availability.
ICANN is understandably worried that about the potentially disastrous consequences for the new gTLD program if it creates a TMCH that sits in the critical registration path and it goes down.
The PKI proposal for Sunrise avoids this problem, as registries and registrars only need a stored copy of the TMCH’s public key in order to do real-time validation.
Using PKI for the Trademark Claims service — the second obligatory rights protection mechanism for new gTLD launches — is a much trickier problem if ICANN is to stick to its design goals, however.
ARI and Neustar plan to publish their Trademark Claims proposal later this week. For now, you can read the Sunrise proposal in PDF format here.

What the hell happened to Go Daddy last night?

Thousands — possibly millions — of Go Daddy customers suffered a four-hour outage last night, during a suspected distributed denial of service attack.
The company has not yet revealed the cause of the downtime, which started at 1725 UTC last night, but it bears many of the signs of DDoS against the company’s DNS servers.
During the incident, godaddy.com was inaccessible. DI hosts with Go Daddy; domainincite.com and secureserver.net, the domain Go Daddy uses to provide its email services, were both down.
The company issued the following statement:

At 10:25 am PT, GoDaddy.com and associated customer services experienced intermittent outages. Services began to be restored for the bulk of affected customers at 2:43 pm PT. At no time was any sensitive customer information, such as credit card data, passwords or names and addresses, compromised. We will provide an additional update within the next 24 hours. We want to thank our customers for their patience and support.

Several Go Daddy sites I checked remained accessible from some parts of the world initially, only to disappear later.
Others reported that they were able to load their Go Daddy webmail, but that no new emails were getting through.
This all points to a problem with Go Daddy’s DNS, rather than with its hosting infrastructure. People able to view affected sites were likely using cached copies of DNS records.
Close to 34 million domains use domaincontrol.com, Go Daddy’s primary name server, for their DNS. The company says it has over 10 million customers.
Reportedly, Go Daddy started using Verisign’s DNS for its home page during the event, which would also point to a DNS-based attack.
The outage was so widespread that the words “GoDaddy” and “DNS” quickly became trending topics on Twitter.
The web site downforeveryoneorjustme.com, which does not use Go Daddy, also went down as thousands of people rushed to check whether their web sites were affected.
Some outlets reported that Anonymous, the hacker group, had claimed credit for the attack via an anonymous (small a) Twitter account.
Companies the size of Go Daddy experience DDoS attacks on a daily basis, and they build their infrastructure with sufficient safeguards and redundancies to handle the extra traffic.
This leads me to believe that either yesterday’s attack was either especially enormous, or that somebody screwed up.
The fact that the company has not yet confirmed that external malicious forces were at work is worrying.
Either way it’s embarrassing for Go Daddy, which is applying for three new gTLDs which it plans to self-host.
Several reports have already speculated that the attack could be revenge for one or more of Go Daddy’s recent PR screw-ups.
The company has promised an update later today.