It’s worse than you thought: TAS security bug leaked new gTLD applicant data

The bug that brought down ICANN’s TLD Application System yesterday was actually a security hole that leaked data about new gTLD applications.
The vulnerability enabled TAS users to view the file names and user names of other applicants, ICANN said this morning.
COO Akram Atallah said in a statement:

We have learned of a possible glitch in the TLD application system software that has allowed a limited number of users to view some other users’ file names and user names in certain scenarios.
Out of an abundance of caution, we took the system offline to protect applicant data. We are examining how this issue occurred and considering appropriate steps forward.

Given the level of secrecy surrounding the new gTLD application process, this vulnerability ranks pretty highly on the This Is Exactly What We Didn’t Want To Happen scale.
It’s not difficult to imagine scenarios in which a TAS user name or file name contains the gTLD string being applied for.
This is important, competition-sensitive data. If it’s been leaked, serious questions are raised about the integrity of the new gTLD program.
How long was this vulnerability present in TAS? Which applicants were able to look at which other applicants’ data? Did any applicants then act on this inside knowledge by filing competing bids?
If it transpires that any company filed a gTLD application specifically in order to shake down applicants whose data was revealed by this vulnerability, ICANN is in for a world of hurt.

Facebook gTLD ruled out by ICANN director vote?

While Google recently confirmed its new top-level domain plans, an ICANN director has given a big hint that rival Facebook has not applied for any new gTLDs.
Director Erika Mann, head of EU policy at Facebook in Brussels, voted on ICANN’s “digital archery” method of batching new gTLD applications at the ICANN board meeting March 28.
Because ICANN’s new conflict of interest rules require directors to recuse themselves during votes on matters affecting their own businesses, this could be taken as a pretty strong indication that Facebook is not applying for a new gTLD.
If Mann was aware of a .facebook or other Facebook gTLD bid, I think there’s a pretty strong chance she would have not have participated in the digital archery decision.
At least one director whose employer is believed to have applied for a dot-brand gTLD, IBM’s Thomas Narten, did not attend the March 28 meeting.
Sébastien Bachollet, Steve Crocker, Bertrand de La Chapelle, Ram Mohan, George Sadowsky, Bruce Tonkin, Judith Vazquez, Suzanne Woolf and Kuo-Wei Wu also did not attend.
The March 28 board meeting was the first one with new gTLD program votes that Mann has participated in since the new conflict rules were introduced in December.
The news is obviously a couple of weeks old, but I think it’s worth mentioning now in light of the fact that social networking competitor Google revealed earlier this week that it will apply for some gTLDs.

ICM confirms three porn gTLD bids

ICM Registry has applied to ICANN for the new gTLDs .sex, .porn and .adult.
If its applications are successful, the company plans to automatically block any second-level domain that is already registered in .xxx, including the Sunrise B defensive registrations.
This means if you own example.xxx, the equivalent .sex, .porn and .adult domains would be reserved until you pay a “nominal” activation fee to activate them.
As well as trademark owners, that would probably be pretty good news for owners of “premium” .xxx domains.
According to ICM, the four domains will not be permanently linked, so if you own a good .xxx you’ll be able to pay a normal registration fee then activate and sell off the three “freebies”.
Because the domains would be permanently reserved, there would be no renewal fees until you choose to activate them, which could well be the same day you sell them.
There’s a good chance these gTLDs will be contested by other applicants and objected to by governments, of course.
I’ve written more on the announcement for The Register here.

TAS glitch “not an attack” says ICANN

ICANN’s decision this afternoon to shut down its TLD Application System until next Tuesday was not prompted by hackers, according to the organization.
“It’s not an attack,” a spokesperson told DI.
ICANN announced within the last hour that it has extended the window for new gTLD applications until next Friday as a result of unspecified “unusual behavior” in TAS.
Speculation as to the cause has already started on social media, with some pointing to the possibility of hacking, but according to ICANN we can rule out foul play.
The immediate reaction from stressed-out applicants has been split between those laughing, those crying, and those doing both.
TAS was down for scheduled maintenance for two hours last night. According to two applicants who logged in afterwards, it was running very slowly when it came back online.
UPDATE: ICANN has just confirmed: “No application data has been lost from those who have already submitted applications, so it should not pose problems for existing applicants.”

Breaking: ICANN extends new gTLD application window after technical glitch

ICANN has extended the deadline to file new generic top-level domain applications by more than a week after its TLD Application System experienced “unusual behavior”.
TAS will be down until next Tuesday while ICANN fixes the unspecified problem, ICANN said.
Here’s the meat of ICANN’s announcement:

Recently, we received a report of unusual behavior with the operation of the TAS system. We then identified a technical issue with the TAS system software.
ICANN is taking the most conservative approach possible to protect all applicants and allow adequate time to resolve the issue. Therefore, TAS will be shut down until Tuesday at 23:59 UTC – unless otherwise notified before that time.
In order to ensure all applicants have sufficient time to complete their applications during the disruption, the application window will remain open until 23:59 UTC on Friday, 20 April 2012.

What this means for the Big Reveal, currently scheduled for April 30, is not yet clear. More when we get it.

Pool.com offers $25k gTLD digital archery service

Domain name drop-catcher Pool.com hopes to make a quick buck out of ICANN’s new generic top-level domain application batching process.
The company has announced a Digital Archery Engine service, which it says could help new gTLD applicants get their applications near the top of the evaluation queue.
It’s based on Pool’s experience catching expiring names to auction, and ICANN’s controversial “digital archery” method of allocating applications into batches for processing.
Getting into the first batch of 500 applications is expected to knock at least five months off the wait time for new gTLD approval, delegation and launch. For many applicants, this time-to-market advantage is important.
But it’s not cheap. If Pool gets your application into the first batch it will set you back $25,000. If you’re in the top 50% of applications, the price tag is $10,000. Anything slower is free.

Three-way legal fight over .eco breaks out

Planet.eco, an emergent .eco gTLD applicant with a trademark on “.eco” is suing two rival applicants for trademark infringement and cybersquatting in a California court.
The company sued DotEco (affiliated with Minds + Machines and Top Level Domain Holdings), along with CEO Fred Krueger, and Canada-based Big Room on March 2.
It’s looking for millions of dollars of damages and an injunction preventing both rival applicants from applying for .eco.
In late March, DotEco filed a counter-suit, alleging that Planet.eco’s .eco trademark was fraudulently obtained and that the company is trying to illegally stifle competition for the .eco gTLD.
That’s the short version. It’s a complex story with a great deal of history and more than a little bogus behavior.
DomainIncite PRO subscribers can read the full DI analysis, along with more PDFs than you could ever possibly need, here.
(Thanks to reader Tom Gilles for the tip)

Google confirms new gTLD bids

Google will apply for several new generic top-level domains, according to a report in AdAge.
The company will apply for some dot-brands, and possibly some keywords, the report indicated.

“We plan to apply for Google’s trademarked TLDs, as well as a handful of new ones,” the spokeswoman said in an emailed statement.

AdAge speculates that .google and .youtube would be among the applications, which seems like a fair assumption.
The revelation comes despite the fact that Google engineers recently stated that there would be no guaranteed search engine optimization benefits from owning a gTLD.
However, I wouldn’t be surprised if keywords representing some of Google’s services, such as .search and .blog, are also among its targets.
The total cost to Google is likely to run into millions in ICANN application fees alone.
It will also be interesting to see which registry provider — if any — Google has selected to run its back-end.
Google is one of the few companies out there that could scratch-build its own registry infrastructure without breaking a sweat.
The AdAge report also quotes Facebook and Pepsi executives saying they will not apply.

States will object to .inc, .llc gTLDs

American secretaries of state will object to new gTLD applications for .inc, .corp, .llc and .llp unless they are restricted, the National Association of Secretaries of State has told ICANN.
In a March 30 letter, NASS president Beth Chapman wrote:

While we have concerns about the use of these extensions, if ICANN considers approving these extensions, our members respectfully request that they be approved with restrictions that would attempt to protect legitimate businesses and consumers from confusion or fraud.
…
The members of NASS believe these extension identifiers (.INC, .LLC, .CORP, .LLP) should only be extended to entities that are also legally and appropriately registered with the Secretaries of State, or the equivalent state agency. The entity purchasing a new domain name should be the same entity registered with a Secretary of State or equivalent state agency.

The sentiment was a repeat of views expressed in a March 20 letter from Jeffrey Bullock, secretary of state of corporation-friendly Delaware.
Bullock said that Delaware “would object to the granting of such strings without restrictions”.
Neither letter acknowledges that the corporate suffixes Inc, Corp and LLP are also used elsewhere in the world.
Both letters refer to DOT Registry, a start-up with plans to apply to ICANN for .inc, .corp and .llc.
DOT Registry plans to put restrictions in place to ensure only registered companies can register domains, Bullock wrote.
I’m not familiar with DOT Registry’s plans, but in general I’m not keen on this type of gTLD string. They strike me as pointless, more likely to create defensive registration revenue than any benefit.

First .blog new gTLD applicant revealed

Colombian domain name registrar My.co has become the first company to reveal that it will apply to ICANN for the .blog generic top-level domain.
Manager Gerardo Aristizabal told DI today that the application will be made through a company called Primer Nivel (“First Level” in Spanish).
My.co (officially Central Comercializadora de Internet) is the main partner in the bid. Other unspecified investors are also on board.
Qinetics, the Malaysian registry services provider that does business as RegistryASP, has been contracted to run the registry back-end.
My.co already uses Qinetics for its .co registrar gateway, which provides .co registration services to 20 other registrars, according to Aristizabal.
UK-based CommunityDNS has signed up to provide the DNS, while NCC Group has been named data escrow provider, he added.
“We believe .blog will provide a great address for establishing blogs online, and will become the Internet space for freedom of speech and information,” Aristizabal said.
It goes without saying that .blog will be a heavily contested – I would say probably the most heavily contested – gTLD.
Whenever anyone asks me what gTLD string I think stands the best chance of success, I always point to .blog.
It’s a no-brainer.
Media analysts NM Incite (great name) tracked 181 million blogs in 2011, up by about 25 million from 2010. A gTLD that could grab just 1% of that business would still be a nice little earner.
Not only is there an enormous potential market, but .blog doesn’t (as far as I know) have any of the legal baggage that will scare away potential applicants for strings such as .web or .music.
If .blog goes to auction, expect it to fetch eight figures.