Crunch Whois privacy talks kick off

ICANN volunteers are meeting this week to attempt to finalize their recommendations on the future of Whois privacy.
Most members of the Expedited Policy Development Process working group have gathered in Toronto for three days of talks on what will likely become, in May this year, new contractually binding ICANN policy.
Discussions are kicking off pretty much at the same time this article is published and will last until Friday afternoon local time.
The EPDP group is due to publish its final report by February 1, leaving enough time for GNSO consideration, public comments, and an ICANN board of directors vote.
Its initial report, which recommended some big changes to Whois output, was published in November. Public comments on this report will lead to largely modest changes to the policy this week.
The timing is tight because Whois policy is currently governed by a one-year Temporary Specification, created by the ICANN board, which expires May 25.
The bulk of the work today will focus on formalizing the “purposes” of Whois data, something that is needed if ICANN policy is to be compliant with the EU General Data Protection Regulation.
The more controversial stuff, where consensus will be extraordinarily difficult to find, comes tomorrow, when the group discusses policies relating to privileged access to private Whois data.
This is the area where intellectual property and security interests, which want a program that enables them to get access to private data, have been clashing with non-commercial stakeholders, which accuse their opponents of advocating “surveillance”.
It’s not expected that a system of standardized, unified access will be created this week or by February 1. Rather, talks will focus on language committing ICANN to work on (or not) such a system in the near future.
Currently, there’s not even a consensus on what the definition of “consensus” is. It could be slow going.
Gluttons for punishment Observers can tune in to the view/listen-only Adobe Connect room for the meetings here.

ICANN 45: Super-Fadi targets Trademark Clearinghouse and RAA talks

There can be no denying that ICANN’s new CEO was well received at the Toronto meeting last week.
From his opening speech, a sleeves-rolled-up address that laid out his management goals, and throughout the week, Fadi Chehadé managed to impress pretty much everybody I spoke to.
Now Chehadé has turned his attention to the formative Trademark Clearinghouse and the Registrar Accreditation Agreement talks, promising to bring the force of his personality to bear in both projects.
“I’m coming out of Toronto with two priorities for this year,” he said during an interview with ICANN’s media relations chief, Brad White, last Friday.
“The first one is obviously to get the Trademark Clearinghouse to work as best as possible, for all parties to agree we have a mechanism that can satisfy the interests of the parties.”
“The second one is the RAA,” he said. “Without question I’m going to be inserting myself personally into both these, including the RAA.”
These are both difficult problems.
Work on the TMCH hit a snag early last week when ICANN chief strategy officer Kurt Pritz told the GNSO Council that the “community consensus” implementation model proposed by registries presented a big problem.
The “live query model” proposed for the Trademark Claims service, which would require the TMCH to sit in the live domain registration path, should be taken “off the table”, he said.
ICANN is/was worried that putting a live database of trademark checks into the registration model that has functioned fairly well for the last decade is a big risk.
The TMCH would become a single point of failure for the whole new gTLD program and any unanticipated downtime, ICANN has indicated, would be hugely embarrassing for ICANN.
“I’m personally concerned that once you put the Clearinghouse in the path for that it’s very difficult to unring the bell, so I’d rather proceed in a way that doesn’t change that,” Pritz said.
His remarks, October 14, angered backers of the community model, who estimated that the live query model would only affect about 10% to 15% of attempted domain registrations.
“Taking it off the table is a complete mistake,” said Jeff Neuman of Neustar, one of the authors of the alternative “community” TMCH model.
“It is a proven fact that the model we have proposed is more secure and, we believe, actually looks out much more in favor of protecting trademark holders,” he said.
He noted that the community model was created in a “truly bottom-up” way — the way ICANN is supposed to function.
NetChoice’s Steve DelBianco, in a rare show of solidarity between the Business Constituency and the registries, spoke to support Neuman and the centralized community model.
“The BC really supports a centralized Trademark Clearinghouse model, and that could include live query,” DelBianco said. “I’m disturbed by the notion that an executive decision took it off the table.”
“My question is, was that the same executive decision that brought us the TAS and its glitches?” he added. “Was it the same executive decision process that gave us Digital Archery that couldn’t shoot straight?”
Pritz pointed out the logical flaw in DelBianco’s argument.
“The group that brought you TAS and Digital Archery… you want to put that in the critical path for domain names?” he said. “Our job here is to protect trademark rights, not change the way we register domain names.”
But Neuman and DelBianco’s dismay was short-lived. Within a couple of hours, in the same room, Chehadé had told the GNSO Council, in a roundabout sort of way, that the live query model was not dead.
Chehadé’s full remarks are missing from the official transcript (pdf), and what remains is attributed to GNSO Council chair Stephane Van Gelder, but I’ve taken a transcript from my own recording:

The very first week I was on the job, I was presented with a folder — a very nice little folder — and little yellow thing that said “Sign Here”.
So I looked at what I’m signing, as I normally do, and I saw that moving forward with a lot of activities related to the Trademark Clearinghouse as really what I’m being asked to move forward with.
And I’ll be frank with you, my first reaction was: do all the people who will be affected by this agreement… did we hear them all about this before we sign this? Are they all part of the decision-making that led us here?
And the answer was muddled, it was “Yes… and…”. I said: No, I want to make sure that we use the time we have in Toronto make sure we listen to everybody to make sure before I commit any party — any party — to anything, that this party is very much part of the process and part of the solution.

I know I wasn’t the only person in the room to wonder if the anecdote described an incident in which an ICANN executive attempted to pull a fast one on his new, green boss.
A day later, after private discussion with ICANN board and staff, supporters of the community TMCH model told me they were very encouraged that the live query model was still in play.
The problem they still face, however, is that the Intellectual Property Constituency — ostensibly representing the key customers of the TMCH — is publicly still on the fence about which model it prefers.
Without backing from the IPC, any TMCH implementation model would run the risk of appearing to serve contracted parties’ cost and risk requirements at the expense of brand owners.
Getting the IPC to at least take a view will likely be Chehadé’s first priority when it comes to the TMCH.
Finding common ground on the Registrar Accreditation Agreement could be an even more complex task.
While the bulk of the work — integrating requests from certain law enforcement agencies and the Governmental Advisory Committee into the contract — has been completed, Whois remains a challenge.
European registrars claim, in the light of correspondence from a EU privacy watchdogs, that implementing ICANN’s demanded Whois data re-verification and retention rules would make them break the law.
Registrars elsewhere in the world are less than impressed with ICANN’s proposed ‘opt-out’ solution, which would essentially create a two-tier RAA and may, they say, have some impact on competition.
Privacy advocates in Toronto told ICANN that if certain governments (largely, I suspect, the US) want their own local registrars to retain and re-verify Whois data, they should pass laws to that effect, rather than asking ICANN to enforce the rule globally.
The GAC told ICANN’s board of directors last Tuesday that the privacy letters emerging from the EU did not represent the views of the European Commission or the GAC, and nothing more was said on the matter.
How ICANN reacts to the European letters now seems to be rest with ICANN’s executive negotiating team.
While everyone at ICANN 45 seemed to be super-impressed by Chehadé’s competence and vision for sorting out ICANN, the other recurring meme is that actions speak louder than words.
During his first 40 days in the job he managed to persuade India into an about-face on its support for an intergovernmental replacement for ICANN, an impressive feat.
Can he chalk up more early wins by helping resolve the TMCH and RAA deadlocks?
“There’s frankly universal agreement that if I participate personally in these activities I would help these activities come to hopefully a reasonably conclusion that we can bank on,” he said in the White interview.

GAC gives reprieve to four at-risk new gTLD bids

ICANN’s Governmental Advisory Committee has given four new gTLD applicants cause to breath a sigh of relief with its official advice following last week’s meeting in Toronto.
The last-minute reprieve comes in the form of a list of specially protected strings matching the names of intergovernmental organizations that is much shorter than previously demanded.
Led by a US proposal, the GAC has told ICANN to protect the name of any IGO that qualifies for a .int domain name.
As .int is the smallest, most restricted gTLD out there, it only has about 166 registrations currently. More IGOs are believed to qualify for the names but have not claimed them.
If ICANN eventually implements the GAC advice — which seems likely — these 166-plus strings could be placed on a second-level reserved list that all new gTLD registries would have to honor.
While some may object to such a move, it’s a much shorter list than requested by the United Nations and other agencies earlier this year.
In July, the UN and 38 other IGOs said that any name found on the so-called “6ter” list of Paris Convention organizations maintained by WIPO should be protected — over 1,100 strings in total.
The UN had also asked for protection at both top and second levels immediately, which would have killed off four paid-up applications.
Corporate Executive Board Company (.ceb), Platinum Registry Limited (.fit) Top Level Domain Holdings (.fit) and Dot Latin (.uno), all have applications for strings on the 6ter list.
Crucially, the Toronto GAC advice only asks for the names to be protected at the top level from the second round of new gTLD applications.
The Toronto communique states:

in the public interest, implementation of such protection at the second level must be accomplished prior to the delegation of any new gTLDs, and in future rounds of gTLDs, at the second and top level.

This means that applications for strings on the .int list are probably safe.
We ran a recent .int zone file against the DI PRO database of new gTLD applications and found three applications that would have been affected by a first-round prohibition on .int strings.
The two applications for .gdn (Guardian Media and Navigation Information Systems) and the one for .iwc (Richemont DNS) appear to be safe under the rules proposed by the GAC.

EU plays down “unlawful” Whois data worries

The European Commission yesterday gave short shrift to recent claims that ICANN’s proposed Whois data retention requirements would be “unlawful” in the EU.
A recent letter from the Article 29 Working Party — an EU data protection watchdog — had said that the next version of the Registrar Accreditation Agreement may force EU registrars to break the law.
The concerns were later echoed by the Council of Europe.
But the EC stressed at a session between the ICANN board of directors and Governmental Advisory Committee yesterday that Article 29 does not represent the official EU position.
That’s despite the fact that the Article 29 group is made up of privacy commissioners from each EU state.
Asked about the letter, the EC’s GAC representative said:

Just to put everyone at ease, this is a formal advisory group concerning EU data privacy protection.
…
They’re there to give advice and they themselves, and we as well, are very clear that they are independent of the European Union. That gives you an idea that this is not an EU position as such but the position of the advisory committee.

The session then quickly moved on to other matters, dismaying privacy advocates in the room.
Milton Mueller of the Internet Governance Project tweeted:

By telling ICANN that it can ignore Art 29 WG opinion on privacy, European commission is telling ICANN it can ignore their national DP [data privacy] laws

Registrars hopeful that the Article 29 letter would put another nail into the coffin of some of ICANN’s more unpalatable and costly RAA demands also expressed dismay.
ICANN’s current position, based on input from law enforcement and the GAC, is that the RAA should contain new more stringent requirements on Whois data retention and verification.
It proposes an opt-out process for registrars that believe these requirements would put them in violation of local law.
But registrars from outside the EU say this would create a two-tier RAA, which they find unacceptable.
With apparently no easy compromise in sight the RAA negotiations, originally slated to be wrapped up in the first half of this year, look set to continue for many weeks or months to come.

ICANN unleashes the transparency firehose with MyICANN portal

Worried that it can be hard to find useful information on its web sites, ICANN has opened up a new portal, MyICANN.
Part firehose, part sprinkler, MyICANN.org aggregates all of ICANN’s news feeds, many of them apparently new, and enables users to filter them by the topics or languages they’re interested in.
The portal was announced by CEO Fadi Chehade during his inaugural address at the opening of ICANN 45 here in Toronto this morning.
At first, the site is designed to make all the information ICANN publishes on daily basis more accessible, but Chehade said that it will evolve into a “full process management system”, enabling two-way participation.
I’ve been playing with a MyICANN demo all weekend, and it’s already thrown up a few sources of information that even I was not aware of.
It’s quite slick; basically a fancy RSS reader, but I think it could use a few additions.
The volume of information is high enough that the ability to mark items as “read” would be handy. Also, while items are dated I think a more granular timestamp would be useful.

ICANN says EU registrars could be exempt from stringent new Whois rules

Registrars based in the European Union could be let off the hook when it comes to the Whois verification requirements currently under discussion at ICANN.
That’s according to ICANN CEO Fadi Chehade, who this week responded to privacy concerns expressed by the Article 29 Working Party, a EU-based quasi-governmental privacy watchdog.
The Working Party said last month that if ICANN forced EU registrars to re-verify customer data and store it for longer than necessary, they would risk breaking EU privacy law.
Those are two of the many amendments to the standard Registrar Accreditation Agreement that ICANN — at the request of governments and law enforcement — is currently pushing for.
In reply, Chehade noted that ICANN currently plans to give registrars an opt-out:

ICANN proposes to adapt the current ICANN Procedures for Handling Whois Conflicts with Privacy Law, to enable registrars to seek an exempton from these new RAA WHOIS and data protection obligations in the even that the obligations would cause registrars to violate their local laws and regulations.

He also said that the Governmental Advisory Committee has “endorsed” the provisions at question, and encouraged the Working Party to work via the GAC to have its views heard.
I understand that registrars based in the US and elsewhere would not respond favorably to what would essentially amount to a two-tier RAA.
Some of the RAA changes would have cost implications, so there’s an argument that to exempt some registrars and not others would create an un-level competitive playing field.
The Article 29 Working Party is an advisory body, independent of the European Union, comprising one representative from the data privacy watchdogs in each EU state.
Some GAC representatives said during the ICANN meeting in Prague this June that they had already factored privacy concerns into their support for the RAA talks.
It’s going to interesting to see how both registrars and the GAC react to the Article 29 developments at the Toronto meeting, which begins this weekend.

Downtime emerges as key barrier to Trademark Clearinghouse changes

The risk of embarrassing technical glitches is now the major stumbling block in discussions about the best way to deploy the forthcoming Trademark Clearinghouse for new gTLDs.
ICANN is worried about the “reputational implications” of the TMCH going offline if, as proposed by domain name registries, it is in the “critical path” of the live registration process.
The concerns emerged in a letter earlier this week, and were discussed during an ICANN conference call yesterday.
The TMCH is expected to be a big database of trademarks, used to support the Trademark Claims and Sunrise periods that new gTLD registries will have to offer.
The policy behind both rights protection mechanisms is settled (essentially), but the actual technical implementation is still open to question.
While ICANN and its two contractors — IBM and Deloitte — have been quietly working on their favored model for some months, the registries that will support most new gTLDs have their own model.
Neustar, ARI Registry Services, Verisign and Demand Media have proposed a TMCH design that they say would be less costly to registries (and therefore brand owners) as well as having certain security benefits.
The problem with the registry’s plan is that it calls for real-time interactions between registrars, registries and the TMCH during the Trademark Claims phase of new gTLD launches.
This would require the Clearinghouse to operate with 100% up-time, which makes ICANN very nervous. It said in its letter this week:

Though requirements for resiliency to guard against such failures will be in place, the risk and impact of a failure incident in a centralized live query system are significant and have an impact on the reputation and, therefore, the effectiveness of the rights protection mechanisms supported by the Trademark Clearinghouse. Such an event could have reputational implications for the Clearinghouse and the New gTLD Program.

If the Clearinghouse went down, the argument goes, it would prevent domain names being registered in new gTLDs.
This would look very bad for ICANN, which has already experienced a few embarrassing technical problems with the program. How its policies and processes perform with live gTLDs will be scrutinized intensely.
But the registries say they’ve mitigated the problem as much as they can in their centralized model.
“It only puts the Trademark Clearinghouse in the critical path for registration for a limited number of registrations,” Neustar vice president Jeff Neuman said on yesterday’s call.
“In our model if a domain name does not match a trademark in the Clearinghouse then the Clearinghouse never sees it, it doesn’t matter if the Clearinghouse is up or down,” he said.
The negative impact of downtime in this scenario is that registrars would not be able to show would-be registrants Trademark Claims notices. But it would not necessarily enable cybersquatting.
Neuman further argued that the TMCH should be covered by the same kinds of service level agreements and data escrow requirements as contracted gTLD registries, minimizing the risk of downtime.
The second major hurdle to the implementation talks is the relative lack to date of input from brand owners.
The intellectual property community has previously expressed reservations about any TMCH model that would enable data mining by bad actors or opportunistic registrars and registries.
Yes, it’s a data privacy issue. Brand owners are worried that the contents of the Clearinghouse could be used by competitors to find holes in their trademark protection strategies, or by scammers.
While yesterday’s call had more input from the trademark community, the real work will come next Wednesday during a session at ICANN 45 in Toronto.

GNSO Chair contest is Rickert v Robinson

Two candidates for the soon-be-vacated chair of the Generic Names Supporting Organization have been put forward.
Jonathan Robinson has been nominated by the contracted parties house (registries and registrars), while Thomas Rickert has been put forward by the non-contracted parties.
Rickert, an IP lawyer, is director of names and numbers at Eco, a German internet industry association. He was appointed to the GNSO Council by the ICANN Nominating Committee last year.
UK-based Robinson is a longstanding member of the domain name industry and a registries rep on the Council. He’s a director of Afilias and runs IProta, the startup that managed ICM Registry’s sunrise last year.
The two men will be voted on by the GNSO Council before the chairman’s seat, currently occupied by Stephane Van Gelder, is vacated at the end of the Toronto meeting next month.
Van Gelder is coming to the end of his term on the Council after two years in the chair, hence the need for a replacement.

Governments to focus on new gTLDs during ICANN’s new eight-day Toronto meeting

ICANN may have received a bit of flak for cancelling Fridays earlier this year, but as it turns out ICANN meetings are getting longer, not shorter.
The recently published schedule for next month’s Toronto meeting covers eight days, from Friday October 12 to Friday October 19.
The official start of the event will as always be on the Monday (with the work really starting on the Saturday) and the official end will be on Thursday for the second time in a row.
But this time there’s also going to be some special-interest sessions on both Fridays too.
In a change to the usual order of things, the Governmental Advisory Committee has scrapped some of its meetings with other ICANN advisory committees and supporting organizations.
Instead, word is that the GAC plans to focus almost entirely on developing its new gTLD Early Warnings — preliminary warnings about objectionable applications — during the Toronto meeting.
It’s replacing its smaller inter-committee sessions with a one-off High-Level Meeting with SO and AC heads, which we understand is designed to bring newly participating governments up to speed on how ICANN works.
Should we expect to see a bigger GAC in Toronto, now that governments have the opportunity to start complaining about specific applications? It certainly seems possible.

Microsoft, Yahoo and others involved in new dot-brand gTLD group

HSBC, Microsoft, Yahoo and jewelry maker Richemont have told ICANN they plan to form a new GNSO stakeholder group just for single-registrant gTLD registries.
The group would comprise dot-brand registries and — potentially — other types of single-user gTLD manager.
A letter (pdf) to ICANN chair Steve Crocker, signed by executives from the four companies, reads in part:

As a completely new type of contracted party, we do not have a home to represent our unique community. In addition, the existence of conflicts with other contracted parties makes it challenging for us to reside within their stakeholder group.

Combined, the companies have applied for about 30 single-registrant gTLDs, mostly corresponding to brands.
Richemont, which is applying for dot-brands including .cartier, is also applying for the keywords .jewelry and .watches as single-user spaces.
The group plans to discuss formalizing itself at the next ICANN meeting, in Toronto this October.
During the just-concluded Prague meeting, the GNSO’s existing registries stakeholder group accepted several new gTLD applicants — I believe mainly conventional registries — into the fold as observers.
How the influx of new gTLD registries will affect the GNSO’s structure was a hot topic for the Governmental Advisory Committee during the meeting too. I guess now it has some of the answers it was looking for.