Registries propose PKI-based new gTLD sunrises

Neustar and ARI Registry Services have come up with an alternative to ICANN’s proposed new gTLDs sunrise period process, based on a secure Public Key Infrastructure.
The concept was outlined in a draft paper published today, following an intensive two-day tête-à-tête between domain companies and Trademark Clearinghouse providers IBM and Deloitte last month.
It’s presented as an alternative to the implementation model proposed by ICANN, which would use unique codes and was criticized for being inflexible to the needs of new gTLD registries.
The PKI-based alternative from Neustar and ARI would remove some of the cost and complexity for registries, but may create additional file-management headaches for trademark owners.
Under the ICANN model, which IBM and Deloitte are already developing, each trademark owner would receive a unique code for each of their registered trademarks and each registry would be given the list of codes.
If a trademark owner wanted a Sunrise registration, it would submit the relevant code to their chosen registrar, which would forward it to the registry for validation against the list.
One of the drawbacks of this method is that registries don’t get to see any of the underlying trademark data, making it difficult to restrict Sunrise registrations to certain geographic regions or certain classes of trademark.
If, for example, .london wanted to restrict Sunrise eligibility to UK-registered trademarks, it would have no easy way of doing so using the proposed ICANN model.
But IP interests participating in the development of the Trademark Clearinghouse have been adamant that they don’t want registries and registrars getting bulk access to their trademark data.
They’re worried about creating new classes of scams and have competitive concerns about revealing their portfolio of trademarks.
Frankly, they don’t trust registries/rars not to misuse the data.
(The irony that some of the fiercest advocates of Whois accuracy are so concerned about corporate privacy has not been lost on many participants in the TMCH implementation process.)
The newly proposed PKI model would also protect trademark owners’ privacy, albeit to a lesser extent, while giving registries visibility into the underlying trademark data.
The PKI system is rather like SSL. It used public/private key pairs to digitally sign and verify trademark data.
Companies would submit trademark data to the Clearinghouse, which would validate it. The TMCH would then sign the data with its private key and send it back to the trademark owner.
If a company wished to participate in a Sunrise, it would have to upload the signed data — most likely, a file — to its registrar. The registrar or registry could then verify the signature using the TMCH’s public key.
Because the data would be signed, but not encrypted, registrars/ries would be able to check that the trademark is valid and also get to see the trademark data itself.
This may not present a privacy concern for trademark owners because their data is only exposed to registries and registrars for the marks they plan to register as domains, rather than in bulk.
Registries would be able to make sure the trademark fits within their Sunrise eligibility policy, and would be able to include some trademark data in the Whois, if that’s part of their model.
It would require more file management work by trademark owners, but it would not require a unique code for each gTLD that they plan to defensively register in.
The Neustar/ARI proposal suggests that brand-protection registrars may be able to streamline this for their clients by enabling the bulk upload of trademark Zip files.
The overall PKI concept strikes me as more elegant than the ICANN model, particularly because it’s real-time rather than using batch downloads, and it does not require the TMCH to have 100% availability.
ICANN is understandably worried that about the potentially disastrous consequences for the new gTLD program if it creates a TMCH that sits in the critical registration path and it goes down.
The PKI proposal for Sunrise avoids this problem, as registries and registrars only need a stored copy of the TMCH’s public key in order to do real-time validation.
Using PKI for the Trademark Claims service — the second obligatory rights protection mechanism for new gTLD launches — is a much trickier problem if ICANN is to stick to its design goals, however.
ARI and Neustar plan to publish their Trademark Claims proposal later this week. For now, you can read the Sunrise proposal in PDF format here.

Big brands ask US for published list of known cybersquatters, other stuff

A public, published list of repeat cybersquatters was among the demands that the trademark lobby took to a meeting with the US government in Washington DC yesterday.
The summit, hosted by the Department of Commerce, was the latest stage in the US government’s response to the campaign for more new gTLD rights protection mechanisms kicked off by the Association of National Advertisers a little over a year ago.
About 30 big brand owners, along with several trade associations and campaign groups, took part.
The Internet Commerce Association somehow managed to blag an invitation too, and was the only representative of domain registrants, according to a blog post by ICA counsel Phil Corwin.
The companies, which included tech companies such as Microsoft, Facebook, AOL, Yahoo and eBay and offline brand owners such as Nike, Coca-Cola, Time Warner and News Corp, met in early June to formulate a set of recommendations to take to Commerce.
These recommendations are outlined in an August 29 letter (pdf), a copy of which DI has obtained.
Notably, the companies asked for a published list of “bad actors” who have repeatedly lost Uniform Rapid Suspension cases. The letter states:

Recidivist bad actors should be tracked via a list of common Respondents and that list should be published and publicly available.

However, we understand that this request is a low-priority item, discussed only briefly yesterday, and that Commerce representatives did not immediately embrace it.
The bulk of the discussions related to tweaks trademark owners want to see in the Trademark Claims service — which alerts them and the registrant when somebody tries to register a potentially infringing domain name — and the URS.
The brand owners want Trademark Claims, which new gTLD registries are only obliged to offer for the first 60 days of general availability, extended for a longer period, possibly up to three years.
On the face of it, this is among the most reasonable longstanding demands from the IP crowd, but ICANN has resisted it to date as it’s worried about creating a monopoly in the pre-existing market for trademark monitoring services.
If the Trademark Clearinghouse is alerting you every time somebody registers a domain name with your brand in it, why pay MarkMonitor or Melbourne IT for the same service?
The letter also says that Trademark Claims should cover brand+keyword registrations, and domains containing registered trademarks, rather than just exact matches.
The worrisome aspect of this request is that there’s quite a high risk of false positives due to run-on words, very short trademarks, acronyms and dictionary words.
Non-commercial ICANN stakeholders dislike this due to the possibility of a chilling effect on free speech, while registries and registrars don’t like anything that puts unnecessary obstacles in the registration path.
With URS, the trademark owners want a full loser-pays system, though they acknowledge that it could raise the filing fee, which is something they don’t want.
To keep costs down, they want a lower filing fee for cases where the registrant does not respond and a URS panelist is not appointed, which seems like a reasonable idea.
The idea of ICANN (and, ultimately, registrants) subsidizing URS fees has also been put forward.
Finally, the trademark owners want registries to implement defensive blocking systems with one-time fees, modeled on the Sunrise B process that ICM Registry used with the launch of .xxx.
Some of the ideas — such as lower filing fees for uncontested URS cases — seem fairly reasonable and I can see them gaining traction.
Others, such as the brand+keyword protections, seem harder to implement and less likely to pass through ICANN unchallenged.
So what happens next? According to ICA’s Corwin:

For their part, the hosts of the meeting [Commerce] listened politely but did not to endorse any of the suggestions, although they did commit to follow-up interagency discussions. It was pointed out that some of the proposals have been raised before and went nowhere within ICANN, and questions were raised about what process would be utilized to place them before the broader ICANN community and its Board. It was also indicated that the U.S. would be reluctant to undertake any unilateral communications on these matters to ICANN’s Board.

Given this reluctance, I wouldn’t be surprised to see some of these ideas bubbling up through the Governmental Advisory Committee instead, as ideas from the US trademark lobby are wont to do.
As with every ICANN meeting, expect to see further discussions in Toronto next month.

ICANN tells Congressmen to chillax

ICANN senior vice president Kurt Pritz has replied in writing to great big list of questions posed by US Congressmen following the two hearings into new gTLDs last month.
The answers do what the format of the Congressional hearings made impossible – provide a detailed explanation, with links, of why ICANN is doing what it’s doing.
The 27-page letter (pdf), which addresses questions posed by Reps. Waxman, Eshoo and Dingell, goes over some ground you may find very familiar, if you’ve been paying attention.
These are some of the questions and answers I found particularly interesting.
Why are you doing this?
Pritz gives an overview of the convoluted ICANN process responsible for conceiving, creating and honing the new gTLD program over the last few years.
It explains, for example, that the original GNSO Council vote, which set the wheels in motion back in late 2007, was 19-1 in favor of introducing new gTLDs.
The “lone dissenting vote”, Pritz notes, was cast by a Non-Commercial Users Constituency member – it was Robin Gross of IP Justice – who felt the program had too many restrictions.
The letter does not mention that three Council members – one from the Intellectual Property Constituency and two more from the NCUC – abstained from the vote.
Why aren’t the trademark protection mechanisms finished yet?
The main concern here is the Trademark Clearinghouse.
New gTLD applicants will not find out how the Clearinghouse will operate until March at the earliest, which is cutting it fine considering the deadline for registering as an applicant is March 29.
Pritz, however, tells the Congressmen that applicants have known all they need to know about the Clearinghouse since ICANN approved the program’s launch last June.
The Clearinghouse is a detail that ideally should have been sorted out before the program launched, but I don’t believe it’s the foremost concern for most applicants or trademark owners.
The unresolved detail nobody seems to be asking about is the cost of a Uniform Rapid Suspension complaint, the mechanism to quickly take down infringing second-level domain names.
ICANN has said that it expects the price of URS – which involves paying an intellectual property lawyer to preside over the case – to be $300 to $500, but I don’t know anyone who believes that this will be possible.
Indeed, one of the questions asked by Rep. Waxman starts with the premise “Leading providers under Uniform Dispute Resolution Policy (UDRP) have complained that current fees collected are inadequate to cover the costs of retaining qualified trademark attorneys.”
UDRP fees usually start at around $1,000, double what ICANN expects the URS – which I don’t think is going to be a heck of a lot simpler for arbitration panels to process – to cost trademark owners.
Why isn’t the Trademark Claims service permanent?
The Trademark Claims service is a mandatory trademark protection mechanism. One of its functions is to alert trademark holders when somebody tries to register their mark in a new gTLD.
It’s only mandatory for the first 60 days following the launch of a new gTLD, but I’m in agreement with the IP community here – in an ideal world, it would be permanent.
However, commercial services already exist that do pretty much the same thing, and ICANN doesn’t want to anoint a monopoly provider to start competing with its stakeholders. As Pritz put it:

“IP Watch” services are already provided by private firms, and it was not necessary for the rights protection mechanisms specific to the New gTLD Program to compete with those ongoing watch services already available.

In other words, brands are going to have to carry on paying if they want the ongoing benefits of an infringement notification service in new gTLDs.
When’s the second round?
Nothing new here. Pritz explains why the date for the second round has not been named yet.
Essentially, it’s a combination of not knowing how big the first round is going to be and not knowing how long it will take to conduct the two (or three) post-first-round reviews that ICANN has promised to the Governmental Advisory Committee.
I tackle the issue of second-round timing in considerable detail on DomainIncite PRO. My feeling is 2015.
On Whois verification
Pritz reiterates what ICANN CEO Rod Beckstrom told the Department of Commerce last week: ICANN expects that many registrars will start to verify their customers’ Whois data this year.
ICANN is currently talking to registrars about a new Registrar Accreditation Agreement that would mandate some unspecified degree of Whois verification.
This issue is at the top of the law enforcement wish list, and it was taken up with gusto by the Governmental Advisory Committee at the Dakar meeting in October.
Pritz wrote:

ICANN is currently in negotiations with its accredited registrars over amendments to the Registrar Accreditation Agreement. ICANN is negotiating amendments regarding to the verification of Whois data, and expects its accredited registrars to take action to meet the rising call for verification of data. ICANN expects that the RAA will incorporate – for the first time – Registrar commitments to verify Whois data.

He said ICANN expects to post the amendments for comment before the Costa Rica meeting in mid-March, and the measures would be in place before the first new gTLDs launch in 2013.
I’ve heard from a few registrars with knowledge of these talks that Whois verification mandates may be far from a dead-cert in the new RAA.
But by publicly stating to government, twice now, that Whois verification is expected, the registrars are under increased pressure to make it happen.
IF Whois verification is not among the RAA amendments, expect the registrars to get another dressing down from the GAC at the Costa Rica meeting this March.
On the other hand, ICANN has arguably handed them some negotiating leverage when it comes to extracting concessions, such as reduced fees.
The registrars were prodded into these talks with the GAC stick, the big question now is what kind of carrots they will be offered to adopt an RAA that will certainly raise their costs.
ICANN expects to post the proposed RAA changes for public comment by February 20.