ICANN shuts down new gTLD portal after finding more security bugs

ICANN has closed down part of its new generic top-level domain portal after finding “potential vulnerabilities” that put “confidential applicant information” at risk.
The shutdown — which has been going on for at least 30 hours — affects the Customer Service and Knowledge Base parts of the site, but ICANN said it is so far not aware of any attacks against the system.
While it’s waiting for a patch, ICANN has decided to move the affected areas behind the unpopular Citrix remote terminal software used previously in the TLD Application System.
This notice was posted on the site:

ICANN performs ongoing monitoring and analysis of our systems, including the Customer Service system. As part of this work, we recently identified potential vulnerabilities in the system used for Customer Service and the Knowledge Base (containing new gTLD articles and information).
Patches are being provided to ICANN to address these issues.
In the mean time, given that use of the Customer Service system was recently expanded, and now includes confidential applicant information, the decision was taken to move the system behind Citrix. This will provide for additional security for applicant information.
We are now testing the installation. This should be completed in the next few days. This decision is a proactive measure. There have been no known compromises to the data, attacks or other actions by third parties (other than our own analysis).

Off the top of my head — and I may be under-counting — this is the fifth significant technical glitch to hit the new gTLD program since April.
There was the notorious TAS bug, which took the system offline entirely for six weeks while ICANN fixed a data leakage vulnerability and upgraded its system capacity.
There was the Reveal Day screw-up, during which Arab community members noticed that all the applied-for Arabic gTLDs were broadcast back-to-front in a presentation.
Then ICANN accidentally published the home addresses of many applicants’ officers and directors, something it had promised not to do. This was probably human error and it has since apologized.
Then the “digital archery” batching system was yanked, after it emerged that TAS performance still wasn’t up to the task and that the scoring results were unreliable.
Former new gTLD program director Michael Salazar resigned a month ago; it is widely believed that he was taking the fall for the gTLD system bugs to that point.
While the latest bug appears — so far — to have not compromised any data, some applicants have nevertheless been frustrated by the fact that the customer service portal has been offline for over a day.

Vignes out as CEO of OpenRegistry

OpenRegistry’s founding CEO, Jean-Christophe Vignes, left the position to join a Paris-based law firm last month.
He’s now senior counsel for the domain name practice at Caprioli & Associés.
Vignes said the change of jobs came as part of his family’s move to Paris and that he’s still a member of the OpenRegistry board of directors.
OpenRegistry (also known as Sensirius), which was selected as the back-end registry provider for 21 gTLD applications including .deloitte, .kpn and .schwarz, is based in Belgium.
It is believed that Hans Seeuws, Vignes’ former second in command, is now in charge at OpenRegistry.

.radio applicant slams GAC “conflict of interest”

BRS Media, one of the four applicants for the .radio generic top-level domain, claims ICANN’s Governmental Advisory Committee has a “direct conflict of interest” over the gTLD.
As DI reported two weeks ago, the European Broadcasting Union, another .radio applicant (the others are Afilias and Donuts), joined the GAC during ICANN’s public meeting in Prague.
While the EBU only has Observer status, and may not vote, it’s still able to participate in discussions. Whether these include discussions about GAC objections to new gTLDs is unclear.
BRS Media, which already runs the radio-themed .fm and .am ccTLDs, is not taking any chances, however. In a letter to GAC chair Heather Dryden, company CEO George Bundy wrote (pdf):

We believe these activities to be a direct Conflict of Interest, by the European Broadcasting Union within the New TLD Application process.

Optimistically, to say the least, BRS requests that the EBU “recuse itself from the New TLD process by withdrawing its applications immediately”.
While I can’t see that happening, it seems to me that the GAC does have to formally address the conflicts issue if it wants to avoid looking like a bunch of hypocrites.
The GAC does not appear to have a formal conflicts of interest policy, even though it pushed hard for similar provisions in the ICANN board.
Now that it has its hard-fought veto rights over new gTLD applications, some sort of safeguards seem appropriate.

Christian group opposes .sex, .porn, .adult

Morality In Media, one of the groups that fought the approval of .xxx for years, has launched a letter-writing campaign against the proposed .sex, .porn and .adult top-level domains.
ICANN has received a couple dozen comments of objection to the three gTLDs over the last couple of days, apparently due to this call-to-arms.
Expect more. MIM was one of the main religion-based objectors to .xxx, responsible for crapflooding ICANN with thousands of comments in the years before the gTLD was approved.
Now that .xxx has turned out to be less successful than ICM Registry hoped, MIM feels its key belief on the subject — that porn gTLDs lead to more porn — has been vindicated.
MIM president Patrick Trueman wrote in one of his comments:

During the years of this fight against the .xxx domain, we said many times that the establishment of a .xxx domain would increase, not decrease the spread of pornography on the Internet, causing even more harm to children, families and communities, and make ICANN complicit in that harm.
That prediction has been fulfilled because the porn sites on the .com domain have not vacated the .com and moved to .xxx. Rather, as we have seen, the .xxx has just added thousand of additional porn sites on the Internet and .com porn sites stayed put. ICANN bears responsibility for this. The .xxx was not needed.

For some reason, the complaints are only leveled at the three ICM Registry subsidiaries that are applying for porn-themed gTLDs, and not the other .sex applicant.
Uniregistry’s application for .sexy has not been targeted.
And MIM has apparently not read the applications it is complaining about; its call to action complains about non-porn companies having to pay “protection money” to defensively register in .sex.
However, the three ICM bids explicitly contemplate an extensive grandfathering program under which all current defensive registrations in .xxx would be reserved in .sex, .porn and .adult.

WIPO supported Draconian cybersquatting reform

Domain name owners who do not respond to cybersquatting complaints could automatically have their domains suspended, if the World Intellectual Property Organization gets its way.
That’s according to the latest ICANN documents to be released under its Documentary Information Disclosure Policy, following a request from the Internet Commerce Association.
The documents relate to the still controversial Uniform Rapid Suspension policy, a supplement to the existing UDRP for dealing with “clear cut” cases of cybersquatting.
The URS will be binding on all new gTLDs, but ICANN recently admitted that it’s been unable to find an organization willing to administer URS cases for the planned $300 to $500 filing fee.
Rather than implement URS with a $1,000 to $1,500 fee instead, ICANN plans to host two community summits to try to figure out ways to rearchitect the scheme to make it cheaper.
These changes could well mean fewer safeguards for domain registrants.
According to an email from WIPO released in response to ICA’s DIDP request, WIPO declined to host these summits unless ICANN agreed, in advance, to Draconian rules on default.
WIPO’s Erik Wilbers wrote (pdf):

it would seem unlikely that these stakeholders would now feel able to commit to the rather fundamental changes we believe to be in everyone’s interest – notably a shift to the proposed respondent-default basis without panel, subject to appropriate safeguards. We would consider an express prior commitment to such a shift, including the requisite Board support, as a pre-condition to a fruitful meeting on the URS.

In other words, WIPO thinks domain names should be suspended without expert review if the domain owner does not respond to a trademark owner’s URS complaint.
ICA counsel Phil Corwin is naturally not happy about this, writing in a blog post this weekend:

WIPO would only consent to hosting URS Summits if their result was largely pre-ordained – in which event, we ask, why bother holding the Summits at all? … This imperious demand should be dismissed out of hand by members of ICANN’s Board should it ever reach them.

That the structure of URS is still open for debate at this late stage of the game is an embarrassment, particularly given the fact that it’s been well-understood for some time that URS was unrealistically priced.
The new DIDP documents reveal that even the idea of summits to resolve the apparently intractable problems were a Band-Aid proposed almost accidentally by ICANN staff.
ICANN, it seems, is engaged in policy fire-fighting as usual.
The current hope is for URS to be finalized and a provider be in place by June 2013. It’s a plausible timetable, but I’m less convinced that a system can be created that is fair, useful and cheap.

Does this sexy .sx ad portend a clash with .sex?

In the occasional DI tradition of linkbaiting Domaining.com with promises of scantily clad eye candy, I humbly invite male readers to get their goggles around this beauty:

Phwoar! Eh?
Apologies.
Anyway, there’s a serious point here.
SX Registry, which is in the process of launching the new .sx ccTLD for the recently formed territory of Sint Maarten, distributed this flyer in the goody bags at ICANN 44 in Prague last week.
The marketing was aimed at registrars, presumably, but the company’s web site has similar imagery as well.
It’s pretty clear what angle SX Registry is going for, and it could portend a clash with .sex and .sexy, which have both been proposed by applicants under ICANN’s new gTLD program.
ICM Registry (.sex), Uniregistry (.sexy) and Internet Marketing Solutions Limited (.sex) may have a potential objector on their hands.

Three Google gTLD applications doomed to fail

Google has applied for three new generic top-level domains that will almost certainly be rejected because they are on ICANN’s list of banned geographic strings.
I reported the story for The Register yesterday.
The applications for .and, .are and .est are affected by the rule that prohibits the delegation of three-letter country codes appearing on the ISO 3166-1 alpha-3 list.
A fourth application by a different company, for .idn, is also impacted by the same rule.
Based on DI’s analysis, there are at least another 16 new gTLD applications that are not currently self-designated geographic but which are also protected (but not banned) as geographic terms.
English dictionary words, brands and acronyms are affected.
DI PRO subscribers can read the full analysis here.

Digital archery looked “silly” but had “minor risks”, ICANN board was told

While ICANN staff acknowledged that digital archery was perceived as “silly”, it told the board of directors that it was “straightforward” and “unambiguous and easy to execute”.
That’s according to the latest delayed release of meeting minutes and briefing documents detailing board-level discussions between the Costa Rica and Prague meetings.
There was significant debate at the board level about digital archery prior to its approval in March, with directors generally favoring an auction model instead, these documents reveal.
Digital archery as a method of batching new gTLD applications was approved by ICANN at the end of March. It was then suspended two weeks ago and finally killed off last Wednesday.
Back in March, the board of directors’ new gTLD program committee was presented with a strong case in favor of archery by ICANN staff.
According to March 28 briefing document (pdf):

Implementation of the auction model at this late date presents significant risk of: program delay, legal action and significant reputational impact as described below. Board working group members tend to agree with this viewpoint but there is a split of opinion. The digital archery model presents minor risks; primarily a minor reputational risk from the perceived awkwardness of the model.
Analysis indicates that the legal risk raised by a random selection program will be satisfactorily addressed. This is true even though the results appear to have an element of randomness.
…
Implementation of the digital archery model is essentially completed. It presents no schedule risk. Its operation is straightforward.

Hindsight is a wonderful thing, and it reveals in this case that digital archery was far from straightforward in its operation, and did in fact present schedule risk.
The new gTLD program is currently in semi-limbo while ICANN tries to figure out a way to sequence the processing of applications in a fair and timely way.
Other documents published following Prague include the lengthy minutes of a May 29 committee meeting at which directors argued with staff about how to geographically weight batches.
Staff pushed for a proportional system – where if 10% of applications came from a specific region, 10% of the first batch would be drawn from that region – the minutes reveal.
But several directors argued and won the case for the “round robin” scenario, which would have given advantage to applicants from under-represented regions instead.
Newly published minutes from May 6 also reveal that ICANN considered offering 1% interest on refunds to applicants that withdrew their applications before Reveal Day.

Digital archery is dead, but uncertainties remain

ICANN has killed off its unpopular “digital archery” scheme, which it had planned to use to rank and batch new top-level domain applications for evaluation.
But the organization has not yet replaced it with anything, leaving gTLD applicants without their much-sought-after certainty for at least the next three weeks.
In a resolution yesterday, ICANN’s New gTLD Program Committee approved the following resolution:

Resolved (2012.06.27.NG06), the New gTLD Program Committee directs the President and CEO to terminate the Digital Archery process as approved in Resolutions 2011.12.08.04-2011.12.08.07.

Given the discussions between the ICANN board and the rest of the community here at ICANN 44 in Prague this week, it would have been more surprising if archery had survived.
Not everyone is happy to see it go, of course.
Richard Schreier, CEO of erstwhile digital archery service provider Pool.com, took to the mic at the ICANN public forum this afternoon to ask that ICANN sticks to its decisions in future.
He further noted that the decision to scrap archery had been made without the input of applicants who are not in attendance at the meeting.
Now that archery has gone, the ICANN board has left a vacuum – nobody knows how applications will be prioritized for processing and evaluation.
Committee chair Cherine Chalaby said that ICANN will now open a comment period for all applicants, in order to help build a “roadmap” to “detail the next steps and timelines”.
This roadmap is due, it seems before the new gTLD committee’s next meeting, which is due to take place approximately three weeks from now.
This does not necessarily mean the program has been delayed, however. ICANN senior vice president Kurt Pritz said a few times this week that evaluators will start looking at apps July 12.

ICANN: new gTLDs will not kill the internet

One of ICANN’s Governmental Advisory Committee’s ongoing inexplicable obsessions is that the introduction of new top-level domains risks toppling the internet.
One or more GAC members have raised the topic of DNS root zone scalability at pretty much every meeting the GAC has had with ICANN’s board of directors for the last couple of years.
It’s the reason why ICANN has committed to delegate no more than 1,000 new gTLDs – a fairly arbitrarily chosen number – to the root per year.
I’m not entirely sure where the GAC’s concerns originated, but they’ve been dismissed as red herrings on multiple occasions by ICANN and third-party technical experts.
And now ICANN has published yet another report – this one written by its own IANA staff – making the point that the risk to root stability is query volume, not database size.
Here’s the gist:

Having twice as many TLDs does not mean that the average Internet user visits twice as many web pages, or writes twice as many emails. Rather, Internet usage is driven by growth in overall Internet adoption. Having more TLDs available does not directly incur increased usage of the DNS; rather it will exchange a subset of their query load from existing TLDs to new TLDs.

You can download the full report here.