Court denies ICANN’s GDPR injunction against Tucows

A German court has refused ICANN’s request for a GDPR-related injunction against Tucows’ local subsidiary EPAG, throwing a key prong of ICANN’s new Whois policy into chaos.
EPAG now appears to be free to stop collecting contact information for each domain’s administrative and technical contacts — the standard Admin-C and Tech-C fields.
The ruling may even leave the door open for registrars to delete this data from their existing Whois databases, a huge blow to ICANN’s Whois compliance strategy.
According to an ICANN-provided English translation of the ruling (pdf), the Bonn judges (whose names are redacted — another win for GDPR?) decided that the Admin-C and Tech-C records are unnecessary, because they can be (and usually are) the same person as the registrant.
The judges said that if the additional contact names were needed, it would have historically been a condition of registration that three separate people’s data was required.
They wrote that this “is proof that any data beyond the domain holder — different from him — was not previously necessary”.
“Against the background of the principle of data minimization, the Chamber is unable to see why further data sets are needed in addition to the main person responsible,” they wrote.
Data minimization is a core principle of GDPR, the General Data Protection Regulation, which came into force in the EU less than a week ago. Tucows and ICANN have different interpretations on how it should be implemented.
The judges said that the registrant’s contact information should be sufficient for any criminal or security-related investigations, which had been one of ICANN’s key claims.
They also said that ICANN’s attempt to compare Whois to public trademark databases was irrelevant, as no international treaties govern Whois.
If the ruling stands, it means registries and registrar in at least Germany could no longer have to collect Admin-C and Tech-C contacts.
Tucows had also planned to delete this data for its existing EPAG registrations, but had put its plan on hold ahead of the judge’s ruling.
The ruling also gives added weight to the part of ICANN’s registry and registrar agreements that require contracted parties to abide by local laws.
That’s at the expense of the new Temporary Policy governing Whois introduced two weeks ago, which still requires Admin-C and Tech-C data collection.
There was no word in ICANN’s statement on the ruling last night as to the possibility of appealing.
But the org seized on the fact that the ruling does not directly state that EPAG would be breaching GDPR rules by collecting the data. General counsel John Jeffrey is quoted as saying:

While ICANN appreciates the prompt attention the Court paid to this matter, the Court’s ruling today did not provide the clarity that ICANN was seeking when it initiated the injunction proceedings. ICANN is continuing to pursue the ongoing discussions with the European Commission, and WP29 [the Article 29 Working Party], to gain further clarification of the GDPR as it relates to the integrity of WHOIS services.

Tucows has yet to issue a statement on the decision.
It may not be the last time ICANN resorts to the courts in order to seek clarity on matters related to GDPR and its new Temporary Policy.

Million-euro Tucows GDPR lawsuit may not be ICANN’s last

ICANN has filed a lawsuit against a Tucows subsidiary in Germany in an effort to resolve a disagreement about how new European privacy law should be interpreted, and according to ICANN’s top lawyer it may not be the last.
The organization said late Friday that it is taking local registrar EPAG to court in Bonn, asking that the registrar be forced to continue collecting administrative and technical contact information for its Whois database.
According to an English translation of the motion (pdf), and to conversations DI had with ICANN general counsel John Jeffrey and Global Domains Division president Akram Atallah over the weekend, ICANN also wants an injunction preventing Tucows from deleting these fields from current Whois records.
At its core is a disagreement about how the new General Data Protection Regulation should be interpreted.
Tucows plans to continue collecting the registrant’s personal information, but it sees no reason why it should also collect the Admin-C and Tech-C data.
Policy director Graeme Bunton argues that in the vast majority of cases the three records are identical, and in the cases they are not, the registrar has no direct contractual relationship with the named individuals and therefore no business storing their data.
ICANN counters that Admin-C and Tech-C are vital when domain owners need to be contacted about issues such as transfers or cyber-attacks and that the public interest demands such records are kept.
Its new Temporary Policy — which is now a binding contractual commitment on all registries and registrars — requires all this data to be collected, but Tucows feels complying with the policy would force it to break European law.
“Strategically, we wanted to make sure we don’t let the Whois and the pubic interest get harmed in a way that can’t be repaired,” Atallah said.
“The injunction is to actually stop any registrar from not collecting all the data and therefore providing the opportunity for the multistakeholder model to work and come up with a long-term plan for Whois,” he said. “”We don’t want to have a gap.”
Jeffrey said that the suit was also necessary because ICANN has not received sufficient GDPR guidance from data protection authorities in the EU.
EPAG is not the only registrar planning to make the controversial changes to data collection. There are at least two others, at least one of which is based in Germany, according to Jeffrey and Atallah.
The German ccTLD registry, DENIC, is not under ICANN contract but has also said it will no longer collect Admin-C and Tech-C data.
They may have all taken their lead from the playbook (pdf) of German industry group eco, which has been telling ICANN since at least January that admin and tech contacts should no longer be collected under GDPR.
That said, Tucows chief Elliot Noss is a vocal privacy advocate, so I’m not sure how much leading was required. Tucows was also a co-developer (pdf) of the eco model.
The injunction application was filed the same day GDPR came into effect, after eleventh-hour talks between ICANN legal and Tucows leadership including chief legal officer Bret Fausett hit an impasse.
Tucows has agreed to freeze its plan to delete its existing Admin-C and Tech-C stored data, however.
The suit has a nominal million-euro value attached, but I’m convinced ICANN (despite its budget crunch) is not interested in the money here.
It’s my sense that this may not be the last time we see ICANN sue in order to bring clarity to GDPR.
Recently, Jeffrey said that ICANN would not tolerate contracted parties refusing to collect full Whois data, and also that it would not tolerate it when they decline to hand the data over to parties with legitimate interests.
The German lawsuit does not address this second category of non-compliance.
But it seems almost certain to me that intellectual lawyers are just days or weeks away from starting to file compliance tickets with ICANN when they are refused access to this data, which could lead to additional litigation.
“Whether it would result in a lawsuit is yet to be determined,” Jeffrey told DI yesterday. “The normal course would be a compliance action. If people aren’t able to gain access to information they believe that they have a legitimate right to access they will file compliance complaints. Those compliance complaints will be evaluated.”
“If it’s a systematic decision not to provide that access, that would violate the [Temporary Policy],” he said. “If they indicated it was because of their interpretation of the law, then it could result in us asking questions of the DPAs or going to court if that’s the only action available.”
The injunction application is a “one-sided filing”, which Jeffrey tells me is a feature of German law that means the court could issue a ruling without requiring EPAG/Tucows to appear in court or even formally respond.
The dispute therefore could be resolved rather quickly — this week even — by the court of first instance, Jeffrey said, or it could be bounced up to the European Court of Justice.
Given how new GDPR is, and considering the wider implications, the latter option seems like a real possibility.

Namecheap to bring millions of domains in-house next week

Namecheap is finally bringing its customer base over to its own ICANN accreditation.
The registrar will next week accept transfer of an estimated 3.2 million .com and .net domains from Enom, following a court ruling forcing Enom owner Tucows to let go of the names.
The migration will happen from January 8 to January 12, Namecheap said in a blog post today.
Namecheap is one of the largest registrars in the industry, but historically it mostly acted as an Enom reseller. Every domain it sold showed up in official reports as an Enom sale.
While it’s been using its own ICANN accreditation to sell gTLD names since around 2015 — and has around four million names on its own credentials — it still had a substantial portion of its customer base on the Enom ticker.
After the two companies’ arrangement came to an end, and Enom was acquired by Tucows, Namecheap decided to also consolidate its .com/.net names under its own accreditation.
After Tucows balked at a bulk transfer, Namecheap sued, and a court ruled in December that Tucows must consent to the transfer.
Now, Namecheap says all .com and .net names registered before January 2017 or transferred in before November 2017 will be migrated.
There may be some downtime as the transition goes through, the company warned.

Tucows revenue rockets after Enom buy

Tucows saw its revenue from domain names more than double in the second quarter, following the acquisition of rival Enom.
The company this week reported domain services revenue for the three months ending June 30 of $62.8 million, compared to $28.4 million a year ago.
That was part of overall growth of 78%, with revenue rising from $47.2 million in 2016 to $84.2 million this year.
Net income for the quarter was up 29% at $5.2 million.
Enom, which Tucows bought from Rightside for $76.7 million earlier this year, now accounts for a little under half of Tucows’ wholesale domains business, the larger portion going through its OpenSRS channel.
Sales from Tucows’ premium portfolio rose to $968,000 from $885,000 a year ago.
Its retail business, Hover, did $7.6 million of revenue, up from $3.6 million.

After price hike, now Tucows drops support for Uniregistry TLDs

Tucows is to drop OpenSRS support for nine Uniregistry gTLDs after the registry announced severe price increases.
The registrar told OpenSRS resellers that it will no longer support .audio, .juegos, .diet, .hiphop, .flowers, .guitars, .hosting, .property and .blackfriday from September 8, the date the increases kick in.
It’s the second major registrar, after GoDaddy, to drop support for Uniregistry TLDs in the wake of the pricing news.
“The decision to discontinue support for these select TLDs was made to protect you and your customers from unknowingly overpaying in a price range well beyond $100 per year,” OpenSRS told its resellers.
It will continue to support seven other Uniregistry gTLDs, including .click and .link, which are seeing more modest price increases and will remain at $50 and under.
While Tucows is a top 10 registrar in most affected TLDs, its domains under management across the nine appears to be under 3,000.
These domains will expire at their scheduled expiry date and OpenSRS will not allow their renewal after the September 8 cut-off. Customers will be able to renew at current prices for one to 10 years, however.
Tucows encouraged its roughly 40,000 resellers to offer to migrate their customers to other TLDs.
Uniregistry revealed its price increases in March, saying moving to a premium-pricing model was necessary to make the gTLDs profitable given the lack of volume.
Pricing for .juegos and .hosting is to go up from under $20 retail to $300. The other seven affected gTLDs will increase from the $10 to $25 range to $100 per year.
After GoDaddy pulled support for Uniregistry TLDs, the registry modified its plan to enable all existing registrations to renew at current prices.
That clearly was not enough for Tucows, which has sent a pretty clear message that it’s not prepared to be the public face of such significant price hikes.

Activist investor says eNom was sold too cheap

J Carlo Cannell, the activist investor who has been circling Rightside for the last year or so, was unimpressed with the company’s recent sale of eNom to Tucows.
In a letter published as a Securities and Exchange Commission filing last week, Cannell announced that he has started up a support group for fellow “concerned” investors.
In the distinctly loveless Valentine’s Day missive, Cannell called for Rightside to be acquired, go private or issue a big dividend to investors, and said he intends to campaign to have the board of directors replaced.
On the eNom sale, Cannell wrote that the $76.7 million deal “marks a step in the right direction” for the company, but that he was “not satisfied” with the price or the $4 million legal fees accrued. He wrote:

Conversations with management suggest that the Company took only two months to evaluate and close the transaction. Perhaps if they had been more patient and diligent, shareholders would have enjoyed more than the 0.5x 2016 revenues which they received in this “shotgun sale”.
This price was a fraction of Tucows’ own valuation of 2.6x 2016 estimated revenue. For the two trading sessions following the eNom transaction, NAME traded up 10% while TCX was up 32%, suggesting that investors believe it was a better deal for TCX shareholders than NAME shareholders.

The deal was described at the time by Tucows’ CEO Elliot Noss as an “individual opportunistic transaction”.
Noss later told analysts that the eNom business was floundering, “a flat, potentially even slightly negative-growth business”.
Cannell said last week he has formed Save NAME Group, named after Rightside’s ticker symbol, as a means to exert pressure on the board.
He said it is currently “difficult to justify” the company remaining publicly listed, and that the “sale of the entire company” or a “special and substantial dividend” could help appease shareholders.
He said Rightside agreed last August to let him name a new director, but has dragged its feet approving his suggestion, adding:

SNG intends to become more active and vocal in its efforts to force change at NAME. SNG has compiled a slate of qualified candidates. The names and identity of these candidates shall be disclosed periodically together with other neutral and reliable facts to support the contention of SNG that some or all of the board of NAME needs to be replaced.

Cannell, who owns about 9% of Rightside, first emerged as a critic of the company a year ago.
At that time, he called for the company to ditch its “garbage” new gTLD registries in favor of a focus on its higher-margin eNom business.
He was supported by Uniregistry CEO Frank Schilling, then also a Rightside investor in addition to a competitor.

Tucows says eNom may be shrinking as Melbourne IT drives 2016 growth

Tucows yesterday reported an 11% increase in revenue for 2016, driven partly by an acquisition, but warned that its more recent acquisition, eNom, may be shrinking.
The company reported revenue for 2016 of $189.8 million, up from $171 million in 2015. Net income was up 41% at $16 million.
For the fourth quarter, revenue was up 9% year-on-year at $48.8 million. Net income was down 9% at $2.8 million.
In a conference call, executives linked some of the growth to the April 2016 acquisition of Melbourne IT’s reseller business, which added 1.6 million domains to Tucows’ DUM.
While Tucows also operates its Ting mobile phone service, the majority of its revenue still comes from domains and related services.
In the fourth quarter, revenue was $30 million for this segment. Of that, $23.1 million came from domains sold via its wholesale network and $3.8 million came from Hover, its retail channel.
CEO Elliot Noss noted that the acquisition of the eNom wholesale registrar business from Rightside last month made Tucows easily the second-largest registrar after GoDaddy, but made eNom sound like a neglected business.
“The eNom business is a flat, potentially even slightly negative-growth business in terms of gross margin dollars,” he told analysts.
eNom’s channel skews more towards European and North American web hosting companies, which are a growth challenge, he said. He added:

We acquired a mature retail business and associated customers which for the past few years has been more about maintaining and servicing eNom’s existing customers as opposed to growth. It has not been actively promoted and as a result has a flat to declining trajectory. It’s something we don’t intend to change in the short-term, but as we look under the hood and get a better sense of the platform as we will with all of the operations, the long-term plan might be different.

The acquisition was “overwhelmingly about generating scale and realizing cost efficiencies”, Noss said.
Tucows paid $83.5 million for eNom, which has about $155 million in annual revenue and is expected to generate about $20 million in EBITDA per year after efficiencies are realized.

Celebrity cybersquatting to feature in Super Bowl commercial [video]

Actor turned fashion designer John Malkovich is to feature in a Super Bowl commercial themed on cybersquatting.
The ad, for web host Squarespace, sees Malkovich complaining about the domain johnmalkovich.com belonging to some other guy by the same name.
In a roundabout way, this is also a commercial for Tucows, the newly-crowned second-largest domain registrar, which Squarespace acts as a reseller for.
Here’s the ad:

In reality, Malkovich owns the the .com of his full name. He sells clothes there.
However, he’s reportedly currently suing the owner of malkovich.com in France.
Clarification: a reader has asked me to clarify that using a domain in good faith isn’t strictly “cybersquatting”. Every DI reader already knows this, but apparently unless you spell it out every single time you risk incurring the anger of cretins.

Rightside sells eNom to Tucows for $83.5m

Tucows is to become “the second largest registrar in the world” by acquiring eNom from Rightside, paying $83.5 million.
The deal will give Tucows another 14.5 million domains under management and 28,000 resellers, giving it a total of 29 million DUM and 40,000 resellers.
That DUM number, which appears to include ccTLDs, makes Tucows the undisputed volume leader in the reseller world and the second-largest registrar overall.
GoDaddy, the DUM leader, had about 55 million domains just in gTLDs at the last count.
Tucows CEO Elliot Noss told analysts that the deal, along with the April 2016 acquisition of Melbourne IT’s reseller business, were “individual opportunistic transactions”.
He said that Tucows will take its time integrating the two companies, but expects to realize cost savings (presumably read: job losses as duplicate administrative positions are eliminated) over 24 months.
The reseller APIs will not change, and Tucows will not migrate names over to its own existing ICANN accreditations. This could help with reseller retention.
For Rightside, the company said the spin-off will allow it to focus on vertical integration between its gTLD registry business and its consumer-facing registrar, Name.com.
Rightside had come in for a certain amount of high-profile investor criticism for its dogged focus on new gTLDs at the expense of its eNom and Name.com businesses.
Activist investor J Carlo Cannell, supported by fellow investor and Uniregistry CEO Frank Schilling, a year ago accused Rightside of putting too much emphasis on “garbage” new gTLDs instead of its more profitable registrar businesses.
Since then, Rightside has rebuffed separate offers for some or all of its gTLDs by rivals Donuts and XYZ.com.
Last June, it also announced plans to modernize eNom, which Cannell and others had accused of looking stale compared to its competitors.

Tucows pays $6.5 million for Melbourne IT’s channel

Canadian registrar Tucows has acquired the reseller network of Australian rival Melbourne IT for up to $6.5 million.
The company said the deal will “add hundreds of resellers and approximately 1.6 million domains under management to Tucows’ OpenSRS wholesale domain business.”
Melbourne IT said that the low-margin business was a “drag” on the performance of its core business as a retail registrar focused on small and medium sized businesses.
The price, the Aussie company said, will be between AUD 8.1 million and AUD 8.5 million, depending on exchange rates. That’s as much as $6.5 million.
Tucows did not disclose the price, saying it was “immaterial”.