XYZ adds .tickets to its gTLD stable

XYZ.com has taken over the ICANN registry agreement for the gTLD .tickets, according to records.

It looks to be the registry’s 23rd TLD, the latest of XYZ’s acquisitions of unused or floundering new gTLDs.

In the case of .tickets, it’s picking up a low-volume, high-price TLD with some rather onerous registration restrictions.

The TLD was originally set up by UK-based Accent Media to provide a space where people going to music, theater and sporting events, for examples, could buy tickets in the assurance that the sellers were legit.

Would-be .tickets registrants have a five-day waiting period before their domains go live, while the registry manually verifies their identities from paper records such as passports or driving licenses.

That high-friction reg process is one reason the shelf price for a .tickets domain is well over $500 a year.

It’s also a reason why very few .tickets domains have been sold. The registry peaked at fewer than 1,200 names in its zone file in 2018 and has been on the decline ever since.

It had 769 names in its zone at the end of March this year.

Registry reports show that the majority of its names are registered via brand-protection registrars and are likely unused. Searches for active .tickets sites return fewer than 100 results.

XYZ might be able to turn this around by smoothing out the reg friction and lowering the price.

But even just 1,000 names at $500 a year could be considered a nice little earner as part of a portfolio with low overheads from economies of scale. XYZ already runs even higher-priced, lower-volume zones such as .cars and .auto.

EFF rages as Ethos closes Donuts buy

The Electronic Frontier Foundation thinks the acquisition of Donuts by “secretive” private equity group Ethos Capital represents a risk to free speech.

The deal, which sees Ethos buy a controlling stake from fellow PE firm Abry Partners, closed earlier this week, having apparently received no official objection from ICANN.

But the EFF now wants ICANN to force Donuts to change its gTLD registry contracts to make it harder for the company to engage in what it calls “censorship-for-profit”.

The group’s senior staff attorney, Mitch Stoltz, raised the issued at the Public Forum session of last week’s ICANN 70 virtual public meeting, and expanded upon his thinking in a blog post this week. He wrote:

Donuts already has questionable practices when it comes to safeguarding its users’ speech rights. Its contracts with ICANN contain unusual provisions that give Donuts an unreviewable and effectively unlimited right to suspend domain names—causing websites and other internet services to disappear.

He pointed to Donuts’ trusted notifier program with the Motion Picture Association, which streamlines the takedown of domains used for pirating movies, as an example of a registry’s power to censor.

Donuts runs gTLDs including ones with social benefit meanings that the EFF is particularly concerned about, such as .charity, .community, .fund, .healthcare, .news, and .university.

Stoltz also makes reference to the Domain Protected Marks List, a Donuts service that enables trademark owners to block their marks, and variants, across its entire portfolio of 240+ gTLDs.

In effect, this lets trademark holders “own” words and prevent others from using them as domain names, even in top-level domains that have nothing to do with the products or services for which a trademark is used. It’s a legal entitlement that isn’t part of any country’s trademark law, and it was considered and rejected by ICANN’s multistakeholder policy-making community.

The DPML is not unique to Donuts. Competitors such as UNR and MMX have similar services on the market for their gTLDs.

When Stoltz raised the EFF’s concerns at last week’s ICANN meeting, CEO Göran Marby basically shrugged them off, saying he didn’t understand why one PE firm buying an asset off another PE firm was such a big deal.

I have to say I agree with him.

Ethos came under a lot of scrutiny last year when it tried to buy .org manager Public Interest Registry, turning it into a for-profit entity, generating cash for Ethos’ still-undisclosed backers.

(This week, Ethos disclosed in a press release that its investors include massive hedge funds The Baupost Group and Neuberger Berman “among others”, which appears to be the first time these names have been mentioned in connection with the company).

But a pretty good case could be made that .org is a unique case, that has had a non-profit motive baked into its DNA for decades. That does not apply to Donuts, which was a profit-making venture from the outset.

It’s not entirely clear why the EFF is suddenly concerned that Donuts will start exercise its contractual right-to-suspend more frequently under Ethos than under Abry. Stoltz wrote:

As we learned last year during the fight for .ORG, Ethos expects to deliver high returns to its investors while preserving its ability to change the rules for domain name registrants, potentially in harmful ways. Ethos refused meaningful dialogue with domain name users, instead proposing an illusion of public oversight and promoting it with a slick public relations campaign. And private equity investors have a sordid record of buying up vital institutions like hospitals, burdening them with debt, and leaving them financially shaky or even insolvent.

Even with the acquisition passing through ICANN easily, the EFF wants Donuts to change its contracts to make it more difficult for the company to suspend domain names on a whim.

I believe the language causing the controversy comes from anti-abuse policies in the Public Interest Commitments found in almost all Donuts’ contracts with ICANN, which state in part:

Registry Operator reserves the right, at its sole discretion and at any time and without limitation, to deny, suspend, cancel, or transfer any registration or transaction, or place any domain name(s) on registry lock, hold, or similar status as it determines necessary for any of the following reasons:

a. to protect the integrity and stability of the registry;

b. to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process;

c. to comply with the terms of this Registry Agreement and the Registry Operator’s Anti-Abuse Policy;

d. registrant fails to keep Whois information accurate and up-to-date;

d. domain name use violates the Registry Operator’s acceptable use policies, or a third party’s rights or acceptable use policies, including but not limited to the infringement of any copyright or trademark; or

e. as needed during resolution of a dispute.

As a voluntary PIC, this language is unique to Donuts, though other registries have similar provisions in their registry agreements.

ICANN refuses to say why it allowed Donuts to buy Afilias

ICANN appears determined to make its decision-making process when it comes to industry consolidation as opaque as possible.

The Org has denied a request from two rival registries for information about how it approved the acquisition of Afilias by Donuts last December, apparently exploiting a loophole in its bylaws.

The transaction got the nod from ICANN after its December 17 board of directors meeting, at which the board discussed the deal and gave CEO Göran Marby the nod to go ahead and process the request.

What it didn’t do was pass a formal resolution approving the deal, which seems to have given it the room to wriggle out of its transparency requirements, such as publishing its rationale and briefing materials.

It’s a trick it also used last year when it decided to bar Ethos Capital from acquiring Public Interest Registry.

In response to a Documentary Information Disclosure Process request (pdf) last month, filed by Dot Hotel and Domain Venture Partners, ICANN said:

ICANN org makes available, as a matter of due course, on the ICANN website the resolutions taken, preliminary report, minutes, and the Board briefing materials for each Board meeting… ICANN org has already published all materials for the 17 December 2020 Board meeting.

No new information was published.

The DIDP was filed by two applicants for the new gTLD .hotel, which are competing with applications originally filed by both Donuts and Afilias.

They’d also asked for ICANN’s rationale for allowing Donuts to own two .hotel applications post-acquisition, but ICANN said it had no documents reflecting that rationale.

The .hotel contest is also the subject of an Independent Review Process case and a lawsuit, in which DVP is a plaintiff.

ShortDot bought another gTLD. Guess what .sbs stands for now?

Growing new gTLD portfolio registry ShortDot has acquired another unwanted dot-brand, .sbs, which it intends to repurpose as an open, generic TLD.

.sbs was originally owned by SBS, for Special Broadcasting Service, an Australian public-service broadcaster. But the company never used it.

Now, while launch plans are still in development, ShortDot intends to relaunch .sbs to mean something entirely different, much as it recently did with .cfd.

“.sbs will be branded as shorthand for ‘Side by Side’, perfect for social causes, charitable organizations and other philanthropic initiatives,” ShortDot COO Kevin Kopas told us.

That does not appear to be a meaning of the acronym in common usage.

ShortDot is currently two weeks away from general availability for its next most-recent acquisition, .cfd, which originally stood for the financial term “contracts for difference” but is now being marketed as “clothing and fashion design”.

The company, best known for high-volume .icu, which has sold and lost over five million registrations over the last two years, now has five gTLDs in its stable, including unused dot-brand .bond and .cyou.

.sucks mystery deepens. Who the hell is Pat Honeysalt?

Another two .sucks domain names registered by the gTLD’s most prolific registrant have been found to be cases of cybersquatting, but now the squatter’s true identity is becoming more opaque.

In two recently decided UDRP cases before WIPO, registrant Honey Salt Ltd was found to have cybersquatted by registering and offering for sale bfgoodrich.sucks, uniroyal.sucks and tetrapak.sucks.

While earlier cases filed with the Czech Arbitration Forum had identified Honey Salt as a Turks & Caicos company, the latest few WIPO cases say it is a UK-based company.

However, searches at UK Companies House do not reveal any company matching that name.

The latest WIPO cases also identify an individual allegedly behind said company as a respondent, one “Pat Honeysalt”.

That’s either a pseudonym, or we’ve found one of those people who have somehow managed to keep their name out of Google’s index despite being well-funded and tech-savvy.

Honey Salt is believed to be the registrant of thousands of .sucks domains, all matching the trademarks of big companies, which all point to Everything.sucks, a wiki-style web site comprising scraped third-party criticism targeting the brands in question.

Its defense in its UDRP cases to date has been that it is providing non-commercial free speech criticism, and that the inclusion of “.sucks” in the domain means users could not possibly believe the site is officially sanctioned by the brand.

All but one UDPR panel has so far not believed this defense, with panelists pointing out that the domains in question are usually listed for sale on the secondary market (sometimes at cost, sometimes at an inflated price).

They further point out that the criticism displayed on the Everything.sucks site was written by third parties, often prior to the registration of the domain in question, so Honey Salt cannot claim to be exercising its own free-speech rights.

Honey Salt is represented in its UDRP cases by the very large US-based law firm Orrick, Herrington & Sutcliffe, which also represents .sucks registry Vox Populi.

Universal Acceptance – making the internet work for everyone [Guest Post]

Editor’s note: this is a guest post written by Aman Masjide, head of compliance at new gTLD registry Radix.

Back in 2014, to foster innovation and to better the choice in domain names, ICANN introduced new generic top-level domains through its New gTLD Program. It was a monumental move that enabled businesses, individuals, and communities across the globe to mark their presence on the internet.

Allowing users to be present digitally in their chosen language (non-ASCII characters and scripts) gave opportunities to local businesses, civil societies, and governments to better serve their communities.

Analysys Mason conservatively estimates that there is scope of $9.8 billion growth in potential revenue from both; existing users who are using new domain names and from new internet users coming online through Internationalized Domain Names (IDNs).

To achieve this, Universal Acceptance of new gTLDs and IDNs is critical in making the Internet more accessible to the next billion users. Founded in February 2015, the Universal Acceptance Steering Group (UASG) undertakes activities to promote Universal Acceptance of all valid domain names and email addresses.

Through its ambassadorship and local Initiative programs, UASG promotes Universal Acceptance globally. Their efforts are divided and executed through five working groups that include:

• Technology Working Group
• Email Address Internationalization Working Group
• Communications Working Group
• Measurement Working Group
• Local Initiatives Working Group

Before we get into the acceptance of new domain extensions (nTLDs), we must first understand what acceptance means and how it’s measured.

The Universal Acceptance Steering Group’s mission sums up acceptance in one short statement: “All domain names and all email addresses work in all software applications.”

While this is a simple understanding of the concept, for an end user of an nTLD, this statement further branches out into multiple questions such as:

• Will my domain name work on all platforms/applications–online or offline?
• Will my email address on a new domain extension get accepted on all websites/platforms and pass all the validation tests?
• Will my emails on new domain extensions, once accepted, stop going into the junk folder?
• Will I be able to use all the features of a website/platform irrespective of my domain extensions? For example, will a social media platform accept a new domain extension in the bio, comments, posts, messenger, etc, and process it exactly like any other legacy TLD?

The Universal Acceptance (UA) of all domain names and email addresses requires that every piece of software is able to accept, validate, process, store, and display them correctly and consistently.

As a new domains registry, it was critical for us to understand what the gaps were and how to close them so that the internet operates the same for nTLD users as it does for the legacy TLD users.

Initial research concluded that UA readiness issues occur when applications are not able to handle the following categories of a domains name or email addresses:

Domain Names

• New short top-level domain names: example.fun, example.site
• New long top-level domain names: example.berlin, example.space
• Internationalized Domain Names: παράδειγμα.ευ

Email Addresses

• ASCII@ASCII; new short or long TLD: ekrem@misal.istanbul
• ASCII@IDN: john@société.org
• Unicode@ASCII: 测试@example.com
• Unicode@IDN: ईमेल@उदाहरण.भारत
• Unicode@IDN; right to left scripts: لیم@لاثم.عقوم ای

For Universal Acceptance to succeed, it needs to be examined holistically.

Over the years, UASG working group members have conducted several gap analysis on programming languages and frameworks, networking command-line tools, web browsers, websites, and have made great strides in acceptance of new domain extensions.

According to UASG’s FY 2020 report, tests conducted on top websites showed that

• The acceptance rate of emails on short nTLDs has increased from 91% in 2017 to 98.3% in 2020.
• The acceptance rate of emails on long nTLDs has increased from 78% in 2017 to 84.8% in 2020.

Note: The table above compares the 2020 results to the earlier 2017 and 2019 testing results.

Two important caveats should be remembered in this case:

• Different email addresses were tested (but they were of the same type).
• The websites tested in 2020 were different from previous ones as they were the 50 most popular in the 20 countries rather than the 1,000 most popular globally.

However, these results may still be used to compare overall trends.

Universal Acceptance Readiness Report 2020 (pdf) also segregated test websites as per different categories such as eCommerce, government, education, etc and the results were promising.

Such studies help UASG ambassadors and advocates to identify and focus on websites of a specific category that require immediate attention. We conducted a similar study at Radix where we analysed top websites belonging to different categories. These were the results (click to enlarge):

While the acceptance rates for new short and new long cases is more than 80% under most categories, we see a drastic dip when a domain is on an IDN TLD. Such comparisons highlight problem areas and provide direction to ambassadors and members who are advocating for Universal Acceptance.

Radix’s contribution to UASG

UA is something that affects nTLD users the most. This is why it’s crucial to focus on the feedback that we receive from them. At Radix, we work closely with our users to ensure we have the first hand information on any UA related issues faced by the customer.

The feedback could be about linkification, validation or acceptance of emails on nTLDs on different websites and platforms. Radix also actively invests its resources in gap analysis by testing various websites and social media platforms. We are also part of the ambassadorship program promoting and supporting local and global UA initiatives.

Here are some of the UASG initiatives that Radix is part of:

• Participating in the Technical And Measurement working group
• Participating in workshops on Universal Acceptance such as:
  – India Internet Week 2020 Online Edition
  – FICCI – Bhashantara – Panel Discussions
• Sharing gaps and issues reported by customers to UASG

At Radix, our objective is to ensure that nTLDs are accepted across websites and platforms. To achieve this, we actively work with UASG and share as many issues and gaps noticed and reported by customers.

Contribution by other registries

A key objective for most registries is to ensure great customer experience when it comes to their nTLDs and I’ve always admired it when registry operators have actively taken initiative and participated in the five UASG groups mentioned above.

One of the ways to do this is to capture all the queries and complaints reported by their customers/registrar partners and share it with UASG. This will help their support team direct their resources in solving the problems and encouraging those websites to become UA compliant.

Contribution by registrars

When it comes to UA-related issues, registrars are the first in chain to receive a complaint or feedback from the user. Therefore, it’s crucial that their support teams have all the necessary information needed on how to best handle such complaints.

For now, they can:

• Inform the customer about the potential UA issue and raise a request on behalf of the customer with UASG. Issues can be logged at – https://uasg.tech/global-support-center/
• Report these instances to the Registry Operator so that they can connect and follow up with UASG.
• Join any of the five working groups and participate.

The path ahead

The UASG is consistently compiling and sharing all the important information needed for organizations and developers to become UA ready. This is not only about ensuring the readiness of a system to accept certain TLDs or emails, but also about realising the full potential of an organization by connecting with people and businesses that might not be even on it’s radar.

Every successful step taken by an organization towards UA readiness is also a step towards equality and inclusiveness on the internet.

Guest poster Aman Masjide leads compliance and abuse mitigation at Radix.

Correction: UNR’s trademark block service

The registry or registries that buy UNR’s portfolio of new gTLDs at its firesale auction next month will be obliged to honor domains blocked by subscribers to its UniEPS brand protection service.

That’s contrary to what I reported yesterday, which was pretty much the opposite. I apologize for the error.

I asked UNR CEO Frank Schilling for comment about the post-auction UniEPS service, but did not receive a reply. Today, I learned that Schilling had in fact sent a lengthy reply, but it wound up in my email spam folder. Apparently my emails to him also wound up in his spam folder. The filtering gods clearly do not approve of our relationship.

According to Schilling, bidders for each of the 23 auctioned TLDs have been told “blocked names have to remain blocked, banned, or reserved after acquisition, even if they do not participate in our blocking service”.

Registrars were told:

Should an auction winner elect to withdraw the Asset(s) from UNR’s blocking services, the blocked domains will have to remain blocked, reserved, or banned in the acquired Registries until the expiry dates below. This is no different than a new owner honoring prepaid domains under management with expiry dates in the future. Once a block expires, the associated domains can be released for any registrant to purchase (fees from future registrations will be paid to the new owner).

Schilling also said that UNR is forgoing revenue from UniEPS auto-renews after March 15 until the gTLDs change hands. The new owners will be able to cancel these free renewals, he said.

The new owners will be able to continue to use UniEPS if the gTLDs remain on its registry platform. They could also choose to migrate them to their own blocking service, should they have one.

UniEPS, like other products on the market, blocks trademarks and variants such as IDN homographs from registration. It works out cheaper than defensively registering domains, but the domains cannot be used.

UNR, the former Uniregistry, will auction all of its 23 gTLD contracts April 28, as the company refocuses on back-end registry services.

Everything.sucks, in losing UDRPs, puts the lie to the .sucks business model

The World Intellectual Property Organization has delivered its first UDRP decision concerning a .sucks domain name, ruling that the name sanofi.sucks is in fact cybersquatting.

The three-person panel ruled that the domain was identical or confusingly similar to a trademark owned by Sanofi, a French pharmaceuticals manufacturer involved in producing vaccines for the COVID-19 virus.

That was despite the fact that the registrant, affiliated with the Everything.sucks project, argued that nobody would think a domain name ending in “.sucks” would be affiliated with the trademark owner.

That argument flies in the face of official .sucks registry marketing from Vox Populi Registry, which positions .sucks as a place for brand owners to consolidate and manage customer criticism, feedback and support.

The sanofi.sucks case is one of two UDRP losses in the last few weeks for Honey Salt, a Turks and Caicos-based company that is believed to account for over a third of all .sucks registrations.

Honey Salt has registered thousands of brand names in .sucks, linking them to a wiki site operated by Everything.sucks Inc that contains criticism of the brands concerned copied from third-party web sites such as TrustPilot and GlassDoor.

There’s evidence that Everthing.sucks and Honey Salt are affiliated or share common ownership with Vox Pop, but the registry has denied this.

In the Sanofi case, Honey Salt mounted a free speech defense, saying it was providing a platform for legitimate criticism of the company and that Sanofi was using the UDRP to silence such criticism.

Sanofi claimed that the domain had in fact been registered for commercial purposes and to unfairly suggest an official connection to the company.

But what’s interesting is how Honey Salt argues that the domain itself, regardless of the associated web site’s content, is not confusingly similar to the Sanofi mark. The WIPO panelsts wrote, with my added emphasis:

The Respondent maintains that the disputed domain name is not identical or confusingly similar to a trademark in which the Complainant has rights. According to it, the “.sucks” gTLD is not like other generic TLDs, and its pejorative nature renders the disputed domain name as a whole nonidentical and prevents confusion, and the inclusion of “.sucks” in the disputed domain name makes clear that the associated website is not affiliated with the Complainant, but instead contains criticism of it and of its business.

In other words, if you visit a .sucks domain, you automatically will assume that the site is not associated with the brand owner.

Honey Salt seems to have made an identical argument in the UDRP case of cargotec.sucks, which it also lost at the Czech Arbitration Forum last month. The panelists in that decision summarized the company’s defense like this:

The TLD at issue here, however, .sucks, is not like other generic top level domains. Its pejorative nature renders the domain name as a whole nonidentical and prevents confusion… The inclusion of “.sucks” makes abundantly clear that the website is not affiliated with Complainant and instead contain criticism of its business.

Again, this is completely contrary to the stated goal of the .sucks registry.

Vox Pop has from the outset claimed that .sucks domains are a way for brands to aggregate customer feedback and criticism in one place, using a .sucks domain controlled by the brands themselves.

That purpose goes all the way back to its 2012 ICANN new gTLD application and continues to this day on its official web site and Twitter feed, which is primarily used to goad companies undergoing media controversies into registering and using their .sucks exact-match.

Hey, @WWE, everyone gets criticized, but not everyone has the stones to own it. You? I mean, you likely already control https://t.co/qHuEXjfVn5, why not use it? What do you think, @bleedingcool? https://t.co/Yv6b9OEaFp

— DotSucks (@dotsucks) January 24, 2021

Back in 2015, Vox Pop CEO John Berard told us:

A company would be smart to register its name because of the value that consumer criticism has in improving customer loyalty, delivering good customer service, understanding new product and service possibilities… They’re spending a lot more on marketing and customer service and research. This domain can another plank in that platform

Vox Pop even owns and uses voxpopuli.sucks and dotsucks.sucks, where it hosts a little-used forum welcoming criticism from people who say the company sucks.

But Honey Salt, its largest registrant by a significant margin, is now on-record stating that .sucks domains only imply ownership by third parties and could not possibly be confused with brand-owner ownership.

If the Many Worlds interpretation of quantum mechanics is correct, there exists a corner of the multiverse in which Honey Salt and Everything.sucks are just fronts for the entities that also control Vox Pop and its top registrar, Rebel.com. In that universe, it would be trippy indeed for the registry’s own affiliates to admit its entire stated business model is bullshit.

In our universe, that particular cat, which very probably has a goatee, is still firmly in the box, however.

Speculative forays into science fiction aside, Honey Salt’s record on UDRP is now three losses versus one win. It has six more cases pending at WIPO

Domain industry shrank in Q4, but as usual there’s a big BUT

The worldwide domain name count shrank in the fourth quarter, according to newly released Verisign data, but as usual the numbers were hugely impacted by big swings in just a few TLDs.

The latest Domain Name Industry Brief (pdf), which is mainly compiled from zone file counts, shows that 2020 ended with 366.3 million names, down by 4.4 million or 1.2% compared to the end of the third quarter.

It’s the free and almost-free TLDs that swung the math.

Remarkably, industry wild-card .tk actually shrank during the quarter. This is highly unusual, as the registry’s business model is based on giving out names for free, never deleting domains, and monetizing the traffic to expired or suspended names.

It saw domains down by 2.8 million names over the quarter, from 27.5 million to 24.7 million.

Another big dipper was .icu, which sells cheap (usually under $1) and appeals to speculators largely in China.

While it slipped out of the top 10 TLDs, meaning the DNIB no longer breaks out its numbers, DI’s own zone file counts show its zone decline from 5.3 million to 3.4 million during Q4, a 1.9 million decline.

Notably spammy new gTLD .top, which also costs next to nothing and is popular in China, also had a role to play. Its zone count was down by about 900,000 between September 30 and December 31.

Those three TLDs alone account for a loss of 5.6 million names, far more than the 4.4 million industry-wide quarterly drop calculated by Verisign.

The impact of .icu’s continued spiral downwards is likely to be felt in Q1 2021 also. It’s lost another 2.4 million zone file names since the start of the year.

Verisign said the the universe of ccTLD domains contracted by 1.7 million of 1% during the quarter, ending the year with 158.9 million names.

The .tk shrinkage of course more than accounts for this dip. Without it, ccTLDs would be up by 1.1 million names or 1.1%. The major, top-10 ccTLDs mostly showed six-figure growth, the DNIB reflects.

New gTLDs were down 4.2 million names or 13.8% sequentially, ending the quarter with 26 million.

In addition to the aforementioned .top and .icu, this figure appears to have been affected by six-figure losses in some of the highest-volume, lowest-priced new gTLDs, including .club, .site .work and .vip.

In the main legacy gTLDs, Verisign’s own .com grew by 1.5 million names, from 151.8 million to 150.3 million, during the quarter. Its .net was again flat at 13.4 million. Public Interest Registry’s .org gained a (rounded) 100,000 names, ending the year at 10.3 million.

The annual numbers across the industry for 2020 have better optics. The DNIB shows that domain volume was up by 4.0 million or 1.1% year over year.

That breaks down into a 6.3 million increase in .com, a 1.3 million increase across the ccTLDs, and a 3.3 million decrease in new gTLDs, not all of which can be explained away by factoring out .icu and .top.

Got beef with ICANN? Why you may not want to use the Ombudsman

Complaining to the independent Ombudsman may not be the best way to start a beef with ICANN, and that’s according to the Ombudsman himself.

Herb Waye told DI this week that consulting him as a first port of call may well lock complainants out of escalating their complaints through his office in future procedures.

Earlier this week, I reported on a lawsuit filed by three so-far unsuccessful .hotel gTLD applicants, which among other things alleges that ICANN’s Request for Reconsideration appeals process is a “sham”.

Reconsideration has quite a high barrier to success, and complaints are rarely successful. Requests are dealt with by the Board Accountability Mechanisms Committee, a subset of the very same board of directors that passed the resolution being complained about, advised by the same ICANN lawyers.

But RfRs are also automatically sent to the Ombudsman for a determination before the BAMC looks into them, which should provide a valuable and ostensibly independent second set of critical eyes.

However, in practice this has almost never happened since the provision was added to the ICANN bylaws five year ago.

The .hotel plaintiffs tallied up the 14 RfRs related to the new gTLD program since 2017 and found that the Ombudsman had recused himself, without detailed explanation, on every single occasion. Their complaint in California Superior Court reads:

Neither ICANN nor the Ombudsman has provided any intelligible reason for this gross flouting of ICANN’s bylaws and the Ombudsman’s dereliction of duty, other than a naked and vague claim of “conflict of interest”. The lack of any Ombudsman process not only violates ICANN’s bylaws and its contracts with Plaintiffs, but it renders the promise of a fair and independent Reconsideration process null and illusory, and the notion of true accountability a farce.

The ICANN bylaws state that the Ombudsman must recuse himself from considering RfRs “involving matters for which the Ombudsman has, in advance of the filing of the Reconsideration Request, taken a position while performing his or her role as the Ombudsman”.

According to Waye’s explanation, this is a very broad standard indeed. He told DI in an email:

it is not just me but over 18(?) years of Office of the Ombudsman involvement in complaints or investigations. So I need to go back through the archives when I receive an RR to make sure neither Chris [LaHatte] nor Frank [Fowlie] have made a determination (it doesn’t have to be a public report (or position) or a report to the Board to qualify for recusal).

Among other factors, it also doesn’t have to be a past determination directly involving the RR requestor either… if the substance of the RR has been reviewed by the Office in the past, or if the RR is about an issue similar to one that has been the subject of a complaint and a determination, then recusal is also required to avoid inconsistencies or perceived bias.

He consults with his “independent outside counsel”, Dave Marglin, when figuring out whether recusal is necessary, he said.

Waye published an explanation of his role in Reconsideration on page 19 of the Ombusdman’s most-recent annual report (pdf).

I wondered whether a 2015 decision by Waye predecessor LaHatte related to the new gTLD program’s controversial Community Priority Evaluation might account for the spate of recusals over the last few years, but Waye would not be drawn.

“I can’t identify specifics about each recusal as I must at all cost avoid identifying past complainants or subjects of complaints,” he said. “As I mentioned, some published reports may be the reason for a recusal but it may also be the result of the RfR issue having passed through my Office prior to the RfR being filed as a complaint; which may or may not be a known fact, so I err on the side of caution and treat all recusals the same.”

Given that the Ombudsman also deals with sensitive interpersonal interactions, including sexual harassment complaints, a code of confidentiality could be a good thing.

But it also means that there are an unknown number of undisclosed topics, dating back the best part of two decades, that the Ombudsman is apparently powerless to address via the Reconsideration process.

And that list of untouchable topics will only get longer as time goes by, incrementally weakening ICANN’s accountability mechanisms.

It seems to me that for companies with no interest in confidentiality but with serious complaints against an ICANN board action, complaining to the Ombudsman as the first port of call in a case that would likely be escalated to Reconsideration, Cooperative Engagement Process and Independent Review Process may be a bad idea.

Not only would they be locking the Ombudsman out of their own subsequent RfR, but they’d be preventing him or her getting involved in related RfRs for eternity.

Waye does not disagree. He said:

I think anyone considering bringing a complaint to the Office of the Ombuds should now consider their desired outcome if there is any possibility the issue may be something that could eventually take the RfR route. Do they want an informal (potentially confidential) determination from the Ombuds or do they want something more “public” from the Ombuds in the form of a substantive evaluation made directly to the BAMC. It’s still a new process and my participation in the RfR accountability mechanism is still a work in progress for the people considering using the RfR. But it’s what the community wanted and we will make it work.

It strikes me that the Reconsideration policy outlined in the ICANN bylaws is, by accident or design, self-terminating and opaque. It becomes less useful the more often it is used, as the range of topics the Ombudsman is permitted to rule on are slowly whittled away in secret.

It also occurs to be that it might be open to abuse and gaming.

Worried that a rival company will try to use Reconsideration to your disadvantage? Why not file a preemptive Ombudsman complaint on the same topic, forcing him to recusing himself and leaving the eventual RfR in the hands of the far-from-objective BAMC and ICANN board?

Waye said:

I suppose it would be possible, though it would require me making a determination or taking a position of sorts related to the eventual RfR… a complaint doesn’t automatically mean recusal. And of course it would mean me and my counsel not seeing through the “gaming” agenda and declining the complaint at the outset.