Million-euro Tucows GDPR lawsuit may not be ICANN’s last

ICANN has filed a lawsuit against a Tucows subsidiary in Germany in an effort to resolve a disagreement about how new European privacy law should be interpreted, and according to ICANN’s top lawyer it may not be the last.
The organization said late Friday that it is taking local registrar EPAG to court in Bonn, asking that the registrar be forced to continue collecting administrative and technical contact information for its Whois database.
According to an English translation of the motion (pdf), and to conversations DI had with ICANN general counsel John Jeffrey and Global Domains Division president Akram Atallah over the weekend, ICANN also wants an injunction preventing Tucows from deleting these fields from current Whois records.
At its core is a disagreement about how the new General Data Protection Regulation should be interpreted.
Tucows plans to continue collecting the registrant’s personal information, but it sees no reason why it should also collect the Admin-C and Tech-C data.
Policy director Graeme Bunton argues that in the vast majority of cases the three records are identical, and in the cases they are not, the registrar has no direct contractual relationship with the named individuals and therefore no business storing their data.
ICANN counters that Admin-C and Tech-C are vital when domain owners need to be contacted about issues such as transfers or cyber-attacks and that the public interest demands such records are kept.
Its new Temporary Policy — which is now a binding contractual commitment on all registries and registrars — requires all this data to be collected, but Tucows feels complying with the policy would force it to break European law.
“Strategically, we wanted to make sure we don’t let the Whois and the pubic interest get harmed in a way that can’t be repaired,” Atallah said.
“The injunction is to actually stop any registrar from not collecting all the data and therefore providing the opportunity for the multistakeholder model to work and come up with a long-term plan for Whois,” he said. “”We don’t want to have a gap.”
Jeffrey said that the suit was also necessary because ICANN has not received sufficient GDPR guidance from data protection authorities in the EU.
EPAG is not the only registrar planning to make the controversial changes to data collection. There are at least two others, at least one of which is based in Germany, according to Jeffrey and Atallah.
The German ccTLD registry, DENIC, is not under ICANN contract but has also said it will no longer collect Admin-C and Tech-C data.
They may have all taken their lead from the playbook (pdf) of German industry group eco, which has been telling ICANN since at least January that admin and tech contacts should no longer be collected under GDPR.
That said, Tucows chief Elliot Noss is a vocal privacy advocate, so I’m not sure how much leading was required. Tucows was also a co-developer (pdf) of the eco model.
The injunction application was filed the same day GDPR came into effect, after eleventh-hour talks between ICANN legal and Tucows leadership including chief legal officer Bret Fausett hit an impasse.
Tucows has agreed to freeze its plan to delete its existing Admin-C and Tech-C stored data, however.
The suit has a nominal million-euro value attached, but I’m convinced ICANN (despite its budget crunch) is not interested in the money here.
It’s my sense that this may not be the last time we see ICANN sue in order to bring clarity to GDPR.
Recently, Jeffrey said that ICANN would not tolerate contracted parties refusing to collect full Whois data, and also that it would not tolerate it when they decline to hand the data over to parties with legitimate interests.
The German lawsuit does not address this second category of non-compliance.
But it seems almost certain to me that intellectual lawyers are just days or weeks away from starting to file compliance tickets with ICANN when they are refused access to this data, which could lead to additional litigation.
“Whether it would result in a lawsuit is yet to be determined,” Jeffrey told DI yesterday. “The normal course would be a compliance action. If people aren’t able to gain access to information they believe that they have a legitimate right to access they will file compliance complaints. Those compliance complaints will be evaluated.”
“If it’s a systematic decision not to provide that access, that would violate the [Temporary Policy],” he said. “If they indicated it was because of their interpretation of the law, then it could result in us asking questions of the DPAs or going to court if that’s the only action available.”
The injunction application is a “one-sided filing”, which Jeffrey tells me is a feature of German law that means the court could issue a ruling without requiring EPAG/Tucows to appear in court or even formally respond.
The dispute therefore could be resolved rather quickly — this week even — by the court of first instance, Jeffrey said, or it could be bounced up to the European Court of Justice.
Given how new GDPR is, and considering the wider implications, the latter option seems like a real possibility.

Namecheap to bring millions of domains in-house next week

Namecheap is finally bringing its customer base over to its own ICANN accreditation.
The registrar will next week accept transfer of an estimated 3.2 million .com and .net domains from Enom, following a court ruling forcing Enom owner Tucows to let go of the names.
The migration will happen from January 8 to January 12, Namecheap said in a blog post today.
Namecheap is one of the largest registrars in the industry, but historically it mostly acted as an Enom reseller. Every domain it sold showed up in official reports as an Enom sale.
While it’s been using its own ICANN accreditation to sell gTLD names since around 2015 — and has around four million names on its own credentials — it still had a substantial portion of its customer base on the Enom ticker.
After the two companies’ arrangement came to an end, and Enom was acquired by Tucows, Namecheap decided to also consolidate its .com/.net names under its own accreditation.
After Tucows balked at a bulk transfer, Namecheap sued, and a court ruled in December that Tucows must consent to the transfer.
Now, Namecheap says all .com and .net names registered before January 2017 or transferred in before November 2017 will be migrated.
There may be some downtime as the transition goes through, the company warned.

Tucows revenue rockets after Enom buy

Tucows saw its revenue from domain names more than double in the second quarter, following the acquisition of rival Enom.
The company this week reported domain services revenue for the three months ending June 30 of $62.8 million, compared to $28.4 million a year ago.
That was part of overall growth of 78%, with revenue rising from $47.2 million in 2016 to $84.2 million this year.
Net income for the quarter was up 29% at $5.2 million.
Enom, which Tucows bought from Rightside for $76.7 million earlier this year, now accounts for a little under half of Tucows’ wholesale domains business, the larger portion going through its OpenSRS channel.
Sales from Tucows’ premium portfolio rose to $968,000 from $885,000 a year ago.
Its retail business, Hover, did $7.6 million of revenue, up from $3.6 million.

After price hike, now Tucows drops support for Uniregistry TLDs

Tucows is to drop OpenSRS support for nine Uniregistry gTLDs after the registry announced severe price increases.
The registrar told OpenSRS resellers that it will no longer support .audio, .juegos, .diet, .hiphop, .flowers, .guitars, .hosting, .property and .blackfriday from September 8, the date the increases kick in.
It’s the second major registrar, after GoDaddy, to drop support for Uniregistry TLDs in the wake of the pricing news.
“The decision to discontinue support for these select TLDs was made to protect you and your customers from unknowingly overpaying in a price range well beyond $100 per year,” OpenSRS told its resellers.
It will continue to support seven other Uniregistry gTLDs, including .click and .link, which are seeing more modest price increases and will remain at $50 and under.
While Tucows is a top 10 registrar in most affected TLDs, its domains under management across the nine appears to be under 3,000.
These domains will expire at their scheduled expiry date and OpenSRS will not allow their renewal after the September 8 cut-off. Customers will be able to renew at current prices for one to 10 years, however.
Tucows encouraged its roughly 40,000 resellers to offer to migrate their customers to other TLDs.
Uniregistry revealed its price increases in March, saying moving to a premium-pricing model was necessary to make the gTLDs profitable given the lack of volume.
Pricing for .juegos and .hosting is to go up from under $20 retail to $300. The other seven affected gTLDs will increase from the $10 to $25 range to $100 per year.
After GoDaddy pulled support for Uniregistry TLDs, the registry modified its plan to enable all existing registrations to renew at current prices.
That clearly was not enough for Tucows, which has sent a pretty clear message that it’s not prepared to be the public face of such significant price hikes.

Activist investor says eNom was sold too cheap

J Carlo Cannell, the activist investor who has been circling Rightside for the last year or so, was unimpressed with the company’s recent sale of eNom to Tucows.
In a letter published as a Securities and Exchange Commission filing last week, Cannell announced that he has started up a support group for fellow “concerned” investors.
In the distinctly loveless Valentine’s Day missive, Cannell called for Rightside to be acquired, go private or issue a big dividend to investors, and said he intends to campaign to have the board of directors replaced.
On the eNom sale, Cannell wrote that the $76.7 million deal “marks a step in the right direction” for the company, but that he was “not satisfied” with the price or the $4 million legal fees accrued. He wrote:

Conversations with management suggest that the Company took only two months to evaluate and close the transaction. Perhaps if they had been more patient and diligent, shareholders would have enjoyed more than the 0.5x 2016 revenues which they received in this “shotgun sale”.
This price was a fraction of Tucows’ own valuation of 2.6x 2016 estimated revenue. For the two trading sessions following the eNom transaction, NAME traded up 10% while TCX was up 32%, suggesting that investors believe it was a better deal for TCX shareholders than NAME shareholders.

The deal was described at the time by Tucows’ CEO Elliot Noss as an “individual opportunistic transaction”.
Noss later told analysts that the eNom business was floundering, “a flat, potentially even slightly negative-growth business”.
Cannell said last week he has formed Save NAME Group, named after Rightside’s ticker symbol, as a means to exert pressure on the board.
He said it is currently “difficult to justify” the company remaining publicly listed, and that the “sale of the entire company” or a “special and substantial dividend” could help appease shareholders.
He said Rightside agreed last August to let him name a new director, but has dragged its feet approving his suggestion, adding:

SNG intends to become more active and vocal in its efforts to force change at NAME. SNG has compiled a slate of qualified candidates. The names and identity of these candidates shall be disclosed periodically together with other neutral and reliable facts to support the contention of SNG that some or all of the board of NAME needs to be replaced.

Cannell, who owns about 9% of Rightside, first emerged as a critic of the company a year ago.
At that time, he called for the company to ditch its “garbage” new gTLD registries in favor of a focus on its higher-margin eNom business.
He was supported by Uniregistry CEO Frank Schilling, then also a Rightside investor in addition to a competitor.

Tucows says eNom may be shrinking as Melbourne IT drives 2016 growth

Tucows yesterday reported an 11% increase in revenue for 2016, driven partly by an acquisition, but warned that its more recent acquisition, eNom, may be shrinking.
The company reported revenue for 2016 of $189.8 million, up from $171 million in 2015. Net income was up 41% at $16 million.
For the fourth quarter, revenue was up 9% year-on-year at $48.8 million. Net income was down 9% at $2.8 million.
In a conference call, executives linked some of the growth to the April 2016 acquisition of Melbourne IT’s reseller business, which added 1.6 million domains to Tucows’ DUM.
While Tucows also operates its Ting mobile phone service, the majority of its revenue still comes from domains and related services.
In the fourth quarter, revenue was $30 million for this segment. Of that, $23.1 million came from domains sold via its wholesale network and $3.8 million came from Hover, its retail channel.
CEO Elliot Noss noted that the acquisition of the eNom wholesale registrar business from Rightside last month made Tucows easily the second-largest registrar after GoDaddy, but made eNom sound like a neglected business.
“The eNom business is a flat, potentially even slightly negative-growth business in terms of gross margin dollars,” he told analysts.
eNom’s channel skews more towards European and North American web hosting companies, which are a growth challenge, he said. He added:

We acquired a mature retail business and associated customers which for the past few years has been more about maintaining and servicing eNom’s existing customers as opposed to growth. It has not been actively promoted and as a result has a flat to declining trajectory. It’s something we don’t intend to change in the short-term, but as we look under the hood and get a better sense of the platform as we will with all of the operations, the long-term plan might be different.

The acquisition was “overwhelmingly about generating scale and realizing cost efficiencies”, Noss said.
Tucows paid $83.5 million for eNom, which has about $155 million in annual revenue and is expected to generate about $20 million in EBITDA per year after efficiencies are realized.

Celebrity cybersquatting to feature in Super Bowl commercial [video]

Actor turned fashion designer John Malkovich is to feature in a Super Bowl commercial themed on cybersquatting.
The ad, for web host Squarespace, sees Malkovich complaining about the domain johnmalkovich.com belonging to some other guy by the same name.
In a roundabout way, this is also a commercial for Tucows, the newly-crowned second-largest domain registrar, which Squarespace acts as a reseller for.
Here’s the ad:

In reality, Malkovich owns the the .com of his full name. He sells clothes there.
However, he’s reportedly currently suing the owner of malkovich.com in France.
Clarification: a reader has asked me to clarify that using a domain in good faith isn’t strictly “cybersquatting”. Every DI reader already knows this, but apparently unless you spell it out every single time you risk incurring the anger of cretins.

Rightside sells eNom to Tucows for $83.5m

Tucows is to become “the second largest registrar in the world” by acquiring eNom from Rightside, paying $83.5 million.
The deal will give Tucows another 14.5 million domains under management and 28,000 resellers, giving it a total of 29 million DUM and 40,000 resellers.
That DUM number, which appears to include ccTLDs, makes Tucows the undisputed volume leader in the reseller world and the second-largest registrar overall.
GoDaddy, the DUM leader, had about 55 million domains just in gTLDs at the last count.
Tucows CEO Elliot Noss told analysts that the deal, along with the April 2016 acquisition of Melbourne IT’s reseller business, were “individual opportunistic transactions”.
He said that Tucows will take its time integrating the two companies, but expects to realize cost savings (presumably read: job losses as duplicate administrative positions are eliminated) over 24 months.
The reseller APIs will not change, and Tucows will not migrate names over to its own existing ICANN accreditations. This could help with reseller retention.
For Rightside, the company said the spin-off will allow it to focus on vertical integration between its gTLD registry business and its consumer-facing registrar, Name.com.
Rightside had come in for a certain amount of high-profile investor criticism for its dogged focus on new gTLDs at the expense of its eNom and Name.com businesses.
Activist investor J Carlo Cannell, supported by fellow investor and Uniregistry CEO Frank Schilling, a year ago accused Rightside of putting too much emphasis on “garbage” new gTLDs instead of its more profitable registrar businesses.
Since then, Rightside has rebuffed separate offers for some or all of its gTLDs by rivals Donuts and XYZ.com.
Last June, it also announced plans to modernize eNom, which Cannell and others had accused of looking stale compared to its competitors.

Tucows pays $6.5 million for Melbourne IT’s channel

Canadian registrar Tucows has acquired the reseller network of Australian rival Melbourne IT for up to $6.5 million.
The company said the deal will “add hundreds of resellers and approximately 1.6 million domains under management to Tucows’ OpenSRS wholesale domain business.”
Melbourne IT said that the low-margin business was a “drag” on the performance of its core business as a retail registrar focused on small and medium sized businesses.
The price, the Aussie company said, will be between AUD 8.1 million and AUD 8.5 million, depending on exchange rates. That’s as much as $6.5 million.
Tucows did not disclose the price, saying it was “immaterial”.

Registrars open floodgate of Whois privacy outrage

A letter-writing campaign orchestrated by the leading domain registrars has resulted in ICANN getting hit with over 8,000 pro-privacy comments in less than a week.
It’s the largest volume of comments received by ICANN on an issue since right-wing Christian activists deluged ICANN with protests about .xxx, back in 2010.
The comments — the vast majority of them unedited template letters — were filed in response to the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.
That report attempts to bring privacy and proxy services, currently unregulated by ICANN, under ICANN’s contractual wing.
There are two problematic areas, as far as the registrars are concerned.
The first is the ability of trademark and copyright owners to, under certain circumstances, have the registrant of a privately registered name unmasked.
Upon receiving such a request, privacy services would have 15 days to obtain a response from their customer. They’d then have to make a call as to whether to reveal their contact information to the IP owner or not.
Possibly the most controversial aspect of this is described here:

Disclosure cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

In other words, the privacy services (in most cases, also the registrar) would be forced make a judgement on whether web site content is illegal, in the absence of a court order, before removing Whois privacy on a domain.
The second problematic area is an “additional statement” on domains used for commercial activity, appended to the PPSAI report, penned by MarkMonitor on behalf of Facebook, LegitScript, DomainTools, IP attorneys Smith, Gambreall & Russell, and itself.
Those companies believe it should be against the rules for anyone who commercially transacts via their web site to use Whois privacy.
Running ads on a blog, say, would be fine. But asking for, for example, credit card details in order to transact would preclude you from using privacy services.
The PPSAI working group didn’t even approach consensus on this topic, and it’s not a formal recommendation in its report.
Regardless, it’s one of the lynchpins of the current registrar letter-writing campaigns.
A page at SaveDomainPrivacy.org — the site backed by dozens of registrars big and small — describes circumstances under which somebody would need privacy even though they engage in e-commerce.
Home-based businesses, shelters for domestic abuse victims that accept donations, and political activists are all offered up as examples.
Visitors to the site are (or were — the site appears to be down right now (UPDATE: it’s back up)) invited to send a comment to ICANN supporting:

The legitimate use of privacy or proxy services to keep personal information private, protect physical safety, and prevent identity theft
The use of privacy services by all, for all legal purposes, regardless of whether the website is “commercial”
That privacy providers should not be forced to reveal my private information without verifiable evidence of wrongdoing

The content of the site was the subject of a sharp disagreement between MarkMonitor and Tucows executives last Saturday during ICANN 53. I’d tell you exactly what was said, but the recording of the relevant part of the GNSO Saturday session has not yet been published by ICANN.
Another site, which seems to be responsible for the majority of the 8,000+ comments received this week, is backed by the registrar NameCheap and the digital civil rights groups the Electronic Frontier Foundation and Fight For The Future.
NameCheap appears to be trying to build on the reputation it started to create for itself when it opposed the Stop Online Piracy Act a few years ago, going to so far as to link the Whois privacy reforms to SOPA on the campaign web site, which says:

Your privacy provider could be forced to publish your contact data in WHOIS or even give it out to anyone who complains about your website, without due process. Why should a small business owner have to publicize her home address just to have a website?
We think your privacy should be protected, regardless of whether your website is personal or commercial, and your confidential info should not be revealed without due process. If you agree, it’s time to tell ICANN.

The EFF’s involvement seems to have grabbed the attention of many reporters in the general tech press, generating dozens of headlines this week.
The public comment period on the PPSAI initial report ends July 7.
If it continues to attract attention, it could wind up being ICANN’s most-subscribed comment period ever.
Do geeks care about privacy more than Christians care about porn? We’ll find out in a week and a half.