Namecheap says it won legal fight over .org price caps
Namecheap claims to have won a fight against ICANN over the lifting of contractual price caps in .org and .info back in 2019.
The two parties have been battling it out for almost three years in an Independent Review Process case over ICANN’s decision to allow the .info and .org registries to increase their prices by as much as they want.
Namecheap now claims the decision has been delivered and “the IRP panel decided that ICANN had, indeed, violated its Bylaws and Articles of Incorporation and that ICANN’s decision to remove the price caps was invalid.”
The registrar also says it failed in its attempt to have a similar ruling with regrds the .biz TLD, but it’s not clear why.
Neither party has yet published the decision in full (ICANN is likely redacting it for publication as I type), and ICANN has yet to make a statement, so we only have Namecheap’s interpretation to go on.
It seems the IRP panel disagreed with ICANN that it was within its staff’s delegated powers to renegotiate the price provisions of the contracts without input from the board of directors.
Rather, there should be a open and transparent process, involving other stakeholders, for making such changes, the panel said according to Namecheap.
What the panel does not appear to have said is that the price caps can be unilaterally restored to the contracts. Rather, it seems to suggest a combination of voluntary reinstatements, expert competition reviews, and bilateral renegotiations.
The decision also seems to say that price controls are more important in .org than .info, due to its not-for-profit nature, which flies in the face of ICANN’s long-term push to standardize its contracts to the greatest extent possible.
The row over .org pricing emerged shortly before the ultimately unsuccessful takeover attempt of Public Interest Registry by for-profit private equity firm Ethos Capital was announced. Ethos had planned to raise prices, but PIR, still a non-profit owned by the Internet Society, to date has not.
Namecheap’s IRP claims related to ICANN’s handling of that acquisition attempt were thrown out in 2021.
.info was an Afilias TLD when the IRP was filed but is now Ethos-owned Identity Digital’s biggest gTLD following consolidation.
I’ll have more on this story after the full decision is made public.
PIR will launch .giving next month with unusual landrush rules
Public Interest Registry has revealed the launch dates for its recently acquired gTLD .giving, and it seems the former registry will also play a prominent role.
PIR has told ICANN it will run .giving’s sunrise period from October 13 to December 13. It’s an “end date” sunrise, where domains are only allocated at the end of the period, but the criteria for resolving competing claims is first-come-first-served.
The landrush period will run from December 20 to January 20, but there’s an unusual twist requiring registrants to buy, or at least “evaluate”, an e-commerce service:
As a condition to registering a domain name in the .GIVING during Landrush (December 20, 2022 through January 20, 2023), you agree that by registering your domain name, you represent and warrant that: (a) you currently use one of Blackbaud’s digital giving solutions or will evaluate the free Giving Checkout solution offered by JustGiving from Blackbaud available at this link and (b) you acknowledge and agree that the Registry or the registrar can cancel the registration of the domain name if your warranty is found to be untrue, incomplete, incorrect, or misleading.
Blackbaud is the company that operates JustGiving, a fund-raising web site chiefly popular in the UK. It was also the original registry for .giving, although of course it never actually launched the TLD.
PIR says general availability will begin January 20. It appears there will be six premium-price tiers, but renewals will be at the regular fee.
DNSAI to name most-abused registries, registrars
The DNS Abuse Institute is to start publishing monthly reports that name the registries and TLDs with the highest level of abuse.
The organization’s Intelligence service is expected to land in September, a little later than was previously expected, according to a blog post from director of policy and programs Rowena Schoo.
DNSAI has partnered with Kor Labs, a project out of the Grenoble Institute of Technology, to supply the data, which will cover phishing and malware domains and differentiate between malicious registrations and compromised sites.
The Institute doesn’t consider spam DNS abuse unless it is used as a delivery mechanism for other types of abuse, in line with ICANN’s definition.
The decision to actually name (and in some cases, we should assume, shame) registries and registrars is an unusual one. Other, similar efforts tend to keep the data anonymous.
“We want to understand abuse persistence and whether it has been appropriately mitigated by registrars,” Schoo wrote.
DNSAI is a project primarily backed by .org manager Public Interest Registry.
Three gTLDs to lose Donuts trademark protection
Three gTLDs are set to lose the trademark protection coverage at the end of the month, following their sale from Donuts to Public Interest Registry.
As noted by corporate registrar Com Laude recently, .charity, .gives and .foundation will no longer fall under Donuts’ Domain Protected Marks List service as of June 1.
DPML is a blocking services whereby the registry reserves trademarked strings across its whole portfolio of almost 300 gTLDs in exchange for a fee that is a big discount on defensive registrations.
gTLDs not in the portfolio will naturally enough no longer qualify, but Com Laude reported that existing subscriptions will be honored and PIR will offer DPML users the chance to change to a full registration.
Donuts announced the sale of the three TLDs to PIR last December.
PIR doesn’t have its own DPML equivalent. Its portfolio is small and its biggest deal is .org, where the defensive blocking horse bolted decades ago.
DNS Abuse Institute names free tool NetBeacon, promises launch soon
NetBeacon has been picked as the name for the DNS Abuse Institute’s forthcoming free abuse-reporting tool.
The tool is expected to launch in early June, after software was donated by CleanDNS accelerated the development cycle, according to Institute director Graeme Bunton.
The system was previously using the working title CART, for Centralized Abuse Reporting Tool, as I blogged in February.
CleanDNS CEO Jeff Bedser is also on the board of Public Interest Registry, which funds DNSAI. Bunton wrote that PIR approved the use of the CleanDNS software under its conflict of interest policy, with Bedser recusing himself.
NetBeacon is expected to provide a way for authenticated abuse reporters to file complaints in a normalized fashion, potentially streamlining the workflow of registrars that subsequently have to deal with them.
Bunton has said that the service will be free at both ends, funded by non-for-profit PIR.
.org price caps: ICANN chair denies “secret” meetings
ICANN chair Maarten Botterman has denied that the board of directors approved the removal of price caps in .org, .biz and .info in “secret” meetings in 2019.
In written testimony (pdf) recently filed as part of Namecheap’s two-year-old Independent Review Process proceeding, Botterman scoffed at the idea that ICANN secretly gave the nod to the removal of price caps in 2019:
I understand that Namecheap is claiming that the Board acted in secret when deciding to go forward with the 2019 Registry Agreements. Nothing about the Board’s conduct occurred in secret. The Board did not convene a “secret” annual, regular, or special Board meeting and did not make any “secret” formal decisions or “secret” resolutions. Instead, the Board was briefed by ICANN staff regarding contract renewals that were well within their delegated authority to negotiate and execute.
Namecheap is claiming in its IRP that ICANN broke its bylaws when it renewed the .org, .info and .biz contracts without the historical price caps that all three had in place for the better part of 20 years.
It wants those decisions annulled, potentially enabling the reinstatement of the caps.
Part of its case is that ICANN failed in its transparency obligations, with Namecheap saying that the decision to remove caps was “entirely opaque” and made with “no analysis whatsoever”.
The .info, .org and .biz contracts were renewed without the ICANN board making a formal resolution or discussing them during a session that was being recorded and minuted.
Botterman, along with declarations from with fellow director Becky Burr and VP Russ Weinstein and outside lawyers’ filings, says that the extent of the board’s involvement was two briefings that occurred at workshops in January and June 2019.
ICANN staff explained to the board why it intended to go ahead with signing the cap-free contracts, and the board “saw no reason to intervene”, Botterman wrote. Staff have delegated authority to deal with contract stuff, he said.
Now, it could be argued that these meetings were not “secret” as such — ICANN board workshops are a standard event, happening in the few days leading up to each of ICANN’s thrice-yearly public meetings.
ICANN’s chair (then Cherine Chalaby) even blogs about them, posting a rough agenda beforehand and a summary of discussions a few weeks later.
In the case of the January 2019 pre-workshop post, there’s no mention whatsoever of any contract renewals. Nor is there in the post-workshop summary.
The June 2019 post-workshop post fails to mention the fact that the board had essentially given the nod to the lifting of caps at that meeting.
The pre-workshop post makes a passing, blink-and-you’ll-miss-it reference to “Göran will update the Board on the renewal of some registry agreements”, which substantially played down what was actually going on.
At that time, ICANN was well-aware that there was huge public interest in at least the .org renewal, where over 3,300 comments had been submitted, mostly objecting to the removal of price caps.
It’s possible that the first time ICANN disclosed that the discussions had even taken place was when a spokesperson told me how the .org decision was made, in July that year.
You don’t have to be a conspiracy theorist to wonder why ICANN pretty much skimmed over the whole issue in its public disclosures, even though it was the hottest topic in town at the time.
Even now, Botterman and Burr are both invoking attorney-client privilege to limit their testimony about what happened at these two workshops.
You don’t have to think anything untoward was going on to ask whether this is all paints a picture of ICANN acting “to the maximum extent feasible in an open and transparent manner”, as its bylaws requires.
Botterman says in his declaration:
The Bylaws are clear that ICANN must “operate to the maximum extent feasible in an open and transparent manner.” But I have never understood this Bylaws provision to require that every time the Board needs to get work done, or every time the Board receives a briefing from ICANN staff on a specific topic, it must do so in public or at a annual, regular or special Board meeting. Nor would such a requirement be feasible.
PIR to offer industry FREE domain abuse clearinghouse
The DNS Abuse Institute will soon launch a free service designed to make it easier to report abuse and for registries and registrars to act upon it.
The Institute, which is funded by .org manager Public Interest Registry, is working on a system provisionally called CART, for Centralized Abuse Reporting Tool, an ambitious project that would act as a clearinghouse for abuse reports across the industry.
The plan is to offer the service for free to reporters and registrars alike, with a beta being offered to registrars late next month and a public launch hopefully before ICANN 74 in June.
DNSAI director Graeme Bunton said that CART is meant to solve the “mess” of current abuse reporting systems.
For abuse reporters, the idea is to give them a one-stop shop for their reports, across all gTLDs and registrars. CART would take their complaints, normalize them, furnish them with additional information from sources such as Whois records and domain block-lists, and shunt them off to the registrar of record.
“Registrars get boatloads of abuse reports every day,” Bunton said. “Hundreds to thousands. They’re often duplicative, often unevidenced — almost always. There’s no standardization. So they’re having to spend a lot of time reading and parsing these abuse reports.”
“They’re spending a huge amount of time triaging tickets that don’t make the internet any better,” he said. “It felt like trying to solve this problem across every individual registry and registrar was not going to work, and that a centralizing function that sits in the middle and absorbs a lot of the complexity would make a real difference, and we’ve been working towards that.”
CART reporters would be authenticated, and their reports would be filed through forms that normalized the data to make them easier for registrars to understand. There will be “evidence requirements” to submit a report.
“It’s a common lament that the abuse@ email that registrars have to publish are filled with garbage,” Bunton said. “This is intended to clean that up, as well as make it easier for reporters.”
Registrars will be able to white-label these forms on their own sites, replacing or adding to existing reporting mechanisms, which will hopefully drive adoption of the tool, Bunton said.
Registrars will be able to use an API to pull the abuse feed into their existing ticketing workflows, or simply receive the reports via email.
The plan is to send these enhanced reports to registrars’ publicly listed abuse@ addresses, whether they opt into the CART system or not, Bunton said.
One feature idea — possibly in a version 2 release — is to have a reputation-scoring function in which registrars can flag reporters as reliable, facilitating on-the-fly “trusted notifier” relationships.
While the DNSAI is focusing to the industry definition of “DNS abuse” — phishing, pharming, malware, botnets and a subset of spam — the plan is to not limit reporters to just those categories.
Copyright infringement claims, for example, would be acceptable forms of abuse report, if the registrar enables that option when they embed the CART forms on their own sites.
CART will most likely be renamed to something with “better mass-market appeal” before it launches, Bunton said, but there will be no charge to reporters or registrars.
“This is all free, with no plans to do cost-recovery or anything like that,” he said.
While Bunton didn’t want to comment, I think it’s unlikely that these projects would be going ahead, at least not for free, had PIR been turned into a for-profit company under its proposed acquisition by Ethos Capital, which was blocked by ICANN a couple of years ago.
A second project DNSAI is working on is called Intelligence.
This will be somewhat similar to ICANN’s own Domain Abuse Activity Reporting (DAAR) system, but with greater granularity, such as giving the ability to see abuse trends by registry or registrar.
The current plan is to have a preview of Intelligence available in June, with a launch in July.
Verisign and PIR join new DNS abuse group
The domain name industry has just got its fourth (by my count) DNS abuse initiative, with plans for work on “trusted notifier” programs and Public Interest Registry and Verisign as members.
topDNS, which announced itself this week, is a project out of eco, the German internet industry association. It said its goals are:
the exchange of best practices, the standardisation of abuse reports, the development of a trusted notifier framework, and awareness campaigns towards policy makers, decision-makers and expert groups
eco’s Thomas Rickert told DI that members inside and outside the industry had asked for such an initiative to combat “the narrative that industry is not doing enough against an ever-increasing problem”.
He said there’s a “worrying trend” of the domain industry being increasingly seen as an easy bottleneck to get unwelcome content taken down, rather than going after the content or hosting provider.
“There is not an agreed-upon definition of what constitutes DNS abuse,” he said.
“There are groups interested in defining DNS abuse very broadly, because it’s more convenient for them I guess to go to a registrar or registry and ask for a domain takedown rather than trying to get content taken down with a hosting company,” he said.
topDNS has no plans to change the definition of “DNS abuse” that has already been broadly agreed upon by the legit end of the industry.
The DNS Abuse Framework, which was signed by 11 major registries and registrars (now, it’s up to 48 companies) in 2019 defines it as “malware, botnets, phishing, pharming, and spam (when it serves as a delivery mechanism for the other forms of DNS Abuse)”.
This is pretty much in line with their ICANN contractual obligations; ICANN itself shudders away from being seen as a content regulator.
The big asterisk next to “spam” perhaps delineates “domains” from “content”, but the Framework also recommends that registries and registrars should act against content when it comprises child sexual abuse material, illegal opioid sales, human trafficking, and “specific and credible” incitements to violence.
Rickert said the plan with topDNS is to help “operationalize” these definitions, providing the domain industry with things like best practice documents.
Of particular interest, and perhaps a point of friction with other parties in the ecosystem in future, is the plan to work on “the development of a trusted notifier framework”.
Trusted notifier systems are in place at a handful of gTLD and ccTLD registries already. They allow organizations — typically law enforcement or Big Content — a streamlined, structured path to get domains taken down when the content they lead to appears to be illegal.
The notifiers get a more reliable outcome, while the registries get some assurances that the notifiers won’t take the piss with overly broad or spammy takedown requests.
topDNS will work on templates for such arrangements, not on the arrangements themselves, Rickert said. Don’t expect the project to start endorsing certain notifiers.
Critics such as the Electronic Frontier Foundation find such programs bordering on censorship and therefore dangerous to free speech.
While the topDNS initiative only has six named members right now, it does have Verisign (.com and .net) and PIR (.org), which together look after about half of all extant domains across all TLDs. It also has CentralNic, a major registrar group and provider of back-end services for some of the largest new gTLDs.
“Verisign is pleased to support the new topDNS initiative, which will help bring together stakeholders with an interest in combating and mitigating DNS security threats,” a company spokesperson said.
Unlike CentralNic and PIR, Verisign is not currently one of the 48 signatories of the DNS Abuse Framework, but the spokesperson said topDNS is “largely consistent” with that effort.
Verisign has also expressed support for early-stage trusted notifier framework discussions being undertaken by ICANN’s registry and registrar stakeholder groups.
PIR also has its own separate project, the DNS Abuse Institute, which is working on similar stuff, along with some tools to support the paperwork.
DNSAI director Graeme Bunton said: “I see these efforts as complementary, not competing, and we are happy to support and participate in each of them.” He’s going to be on topDNS’s inaugural Advisory Council, he and Rickert said.
Rickert and Bunton both pointed out that topDNS is not going to be limited to DNS abuse issues alone — that’s simply the most pressing current matter.
Rickert said issues such as DNS over HTTP and blockchain naming systems could be of future interest.
.org back-end deal will come up for re-bid, PIR says as it acquires four new gTLDs
The industry’s most lucrative back-end registry services contract will be rebid, Public Interest Registry said today.
The deal, which sees PIR pay Afilias $18.3 million a year to run .org, according to tax records, will see a request for proposals issued in the back half of 2023, according to PIR.
Given that’s two years away, it’s strange timing for the announcement, which came at the bottom of a press release and blog post announcing that the company is acquiring four new gTLDs, three of which belong to Afilias’ new owner, Donuts.
PIR said Donuts is to transfer control of .charity, .foundation and .gives, which will be “reintroduced” to the market. .foundation currently has about 20,000 registered domains; the other two have a few thousand each.
It’s also acquiring the unlaunched gTLD .giving from a company called Giving Ltd.
All four are on-message for PIR’s not-for-profit portfolio, which also includes the barely-used .ngo and .ong for non-governmental organizations.
Those two gTLDs are getting decoupled, allowing registrants to register one without having to buy the other, PIR also said today.
The last time the PIR back-end contract came up for renewal, in 2015, Afilias was also the incumbent but increased competition — it was up against 20 rivals — meant that its slice of .org revenue was cut in half.
PIR poaches new CTO from Verisign
Public Interest Registry has announced the hiring of Rick Wilhelm as its new chief technology officer.
Wilhelm comes from Verisign, where he was VP of platform management. He’s also previously worked for Network Solutions and Neustar and sat on ICANN’s Security and Stability Advisory Committee.
He replaces Joe Abley, who quit for a job at Neustar in August.
Wilhelm started today, and reports to CEO Jon Nevett.
Recent Comments