VeriSign’s .com takedown power grab causing controversy

VeriSign’s request for a wide-ranging set of powers that would enable it to shut down .com and .net domain names that are suspected of abuse is already attracting criticism.
The proposals came in a Registry Services Evaluation Process request to ICANN that I reported on for The Register this morning.
It’s asking (pdf) to be able to create a new anti-abuse policy that would refocus many of the controls currently in the hands of registrars to the registry level instead.
The policy would “allow the denial, cancellation or transfer” of any VeriSign-managed domain if any any of these conditions were triggered:

(a) to protect the integrity, security and stability of the DNS;
(b) to comply with any applicable court orders, laws, government rules or requirements, requests of law enforcement or other governmental or quasi-governmental agency, or any dispute resolution process;
(c) to avoid any liability, civil or criminal, on the part of Verisign, as well as its affiliates, subsidiaries, officers, directors, and employees;
(d) per the terms of the registration agreement,
(e) to respond to or protect against any form of malware (defined to include, without limitation, malicious code or software that might affect the operation of the Internet),
(f) to comply with specifications adopted by any industry group generally recognized as authoritative with respect to the Internet (e.g., RFCs),
(g) to correct mistakes made by Verisign or any Registrar in connection with a domain name registration, or
(h) for the non-payment of fees to Verisign. Verisign also reserves the right to place upon registry lock, hold or similar status a domain name during resolution of a dispute;

As you can see, that’s a pretty broad range of justifications.
Notably, it would enable a domain to be canceled or transferred at the “requests of law enforcement or other governmental or quasi-governmental agency”, which would seem to circumvent the current practice of a court order being obtained before a domain is seized.
The question of what constitutes a “quasi-governmental agency” is also interesting. Is ICANN itself such a thing?
The policy would also enable a take-down “to avoid any liability, civil or criminal”, which seems to be just begging for VeriSign to be named spuriously in commercial lawsuits between .com registrants.
The RSEP also suggests that VeriSign plans to extend its hand of friendship to law enforcement agencies from outside the US:

Pilots with European Law Enforcement, Government CERTS and Registrars are planned, and other global test pilots will follow, to ensure global collaboration in the continuing development of the procedures.

Today, US agencies can get court orders instructing VeriSign to hand over domains. While imposing US law on .com owners from other countries is controversial, at least overseas registrants know where they stand.
Now VeriSign is talking about cooperating with European law enforcement agencies too.
At the risk of getting dangerously close to invoking Godwin’s Law, this brings us back to an old jurisdictional problem – what if the French police demand the seizure of a .com site selling Nazi memorabilia, which is illegal in France but legal in the US, for example?
Taking it a step further, what if VeriSign starts entertaining takedown requests from some of the world’s least pleasant theocracies, banana republics and dictatorships?
Half of .com could disappear overnight.
Since VeriSign has a business to run, that’s obviously not going to happen. So the company is going to have to draw a line somewhere, separating criminality from legitimate behavior and free speech.
I’m speculating wildly here, of course, but the RSEP doesn’t contain nearly enough detailed information about VeriSign’s proposed procedures to make a more informed analysis.
VeriSign knows what it is proposing is controversial. The RSEP says:

Registrants may be concerned about an improper takedown of a legitimate website. Verisign will be offering a protest procedure to support restoring a domain name to the zone.

The proposals have been made following many months of discussions between registries, registrars, law enforcement agencies and other community stakeholders.
It’s not entirely clear from VeriSign’s RSEP, which sometimes confusingly conflates the abuse policy with a separate proposed malware scanning service, how a takedown notice would be processed.
One likely reading is that VeriSign would act almost like a centralized clearinghouse for takedown requests, forwarding them to individual registrars for enforcement.
The registrars could be obliged by the terms of an amended Registry-Registrar Agreement to follow whatever process had been laid down.
There seems to be some concern in the ICANN community about this.
ICANN senior VP of stakeholder relations Kurt Pritz recently sent a document to PIR’s David Maher and Oversee.net’s Mason Cole outlining the procedure for amending the RRA.
The flowchart (pdf) describes a trilateral negotiation between the registry proposing the change, the Registrars Stakeholder Group and ICANN, with the ICANN board having the ultimate decision-making authority.
However this proceeds through ICANN, it’s going to cause some heated community debate.

Should .com get a thick Whois?

The ICANN community has taken another baby step towards pushing VeriSign into implementing a “thick” Whois database for .com and .net domain names.
The GNSO Council yesterday voted to ask ICANN to prepare an Issue Report exploring whether to require “all incumbent gTLDs” to operate a thick Whois. Basically, that means VeriSign.
The .com and .net registries currently run on a “thin” model, whereby each accredited registrar manages their own Whois databases.
Most other gTLDs today run thick registries, as will all registries approved by ICANN under its forthcoming new gTLDs program.
The thinness of .com can cause problems during inter-registrar transfers, when gaining and losing registrars have no central authoritative database of registrant contact details to rely upon.
In fact, yesterday’s GNSO vote followed the recommendations of a working group that decided after much deliberation that a thick .com registry may help reduce bogus or contested transfers.
Trusting registrars to manage their own Whois is also a frequent source of frustration for law enforcement, trademark interests and anti-spam firms.
Failure to maintain a functional web-based or port 43 Whois interface is an often-cited problem when ICANN’s compliance department terminates rogue registrars.
Now that an Issue Report has been requested by the GNSO, the idea of a thick .com moves closer to a possible Policy Development Process, which in turn can create binding ICANN consensus policies.
There’s already a clause in VeriSign’s .com registry agreement that gives ICANN the right to demand that it creates a centralized Whois database.
Switching to a thick model would presumably not only transfer responsibility to VeriSign, but also cost and liability, which is presumably why the company seems to be resisting the move.
Don’t expect the changes to come any time soon.
Writing the Issue Report is not expected to be a priority for ICANN staff, due to their ongoing chronic resource problems, and any subsequent PDP could take years.
The alternative – for ICANN and VeriSign to come to a bilateral agreement when the .com contract comes up for renewal next year – seems unlikely given that ICANN did not make a similar requirement when .net was renegotiated earlier this year.

VeriSign CFO quits after buyout rumors

VeriSign has just announced that its chief financial officer, Brian Robins, will leave the company at the end of the month.
The announcement follows a couple of trading days in which VeriSign’s shares have rallied on rumors that the company was on the verge of being acquired.
Ironically, it was Robins’ decision to cancel an appearance at a financial conference that sparked the rumors.
Robins’ resignation follows that of his old boss, CEO Mark McLaughlin, who quit to join a pre-IPO tech startup in late July.
Robins’ destination is not yet known, and VeriSign has yet to name a replacement.

MelbourneIT talks to 270 .brand applicants

The Australian domain registrar MelbourneIT said it has talked to 270 companies and signed contracts with 17 that want to apply for “.brand” top-level domains.
The news came in the company’s “disappointing” first-half financial results announcement yesterday.
According to its official report (pdf), MelbourneIT has received 230 expressions of interest and has inked deals with 14, but managing director Theo Hnarkis reportedly told analysts the higher numbers.
The company is charging clients between AUD 45,000 ($47,000) and AUD 75,000 ($79,000) to handle the ICANN application process.
MelbourneIT’s preferred partner for back-end registry services is VeriSign, so the clients it signs are likely to become recurring revenue streams for VeriSign if their applications are successful.

PIR sets its sights on .ngo

The .org registry hopes to add .ngo – for Non-Governmental Organization – to its stable of top-level domains, when ICANN opens its new gTLD program next year.
It may well face competition for the domain, however.
It’s quite difficult to narrowly define what an NGO is, but the Public Internet Registry plans to adopt a fairly broad definition that will give it potentially “millions” of new registrants.
“We’re looking at global, regional, and local NGOs, we’re engaging with all of them,” said PIR chief Brian Cute. “This acronym is something that these organizations strongly identify with.”
Cute said PIR has letters of support from some NGOs already, but is not prepared to disclose the identities of its supporters just yet.
Many NGOs are based in emerging markets – according to Wikipedia, India has as many as 3.3 million of them. PIR hopes to encourage domain growth in developing nations, Cute said.
With that in mind, we’re probably not looking at super-premium pricing, though PIR is not talking specific details of its plan yet.
It will be a self-designated “community” application, meaning it will qualify for a Community Priority Evaluation in the event that ICANN receives more than one bid for .ngo.
When a CPE kicks in, applications are scored against a number of criteria and have to get 14 out 16 points in order to win a contested gTLD without going to auction.
Those 14 points are not easy to win, however. Even .ngo, with its commonly understood meaning, may be a hard call.
As it happens, there is already potentially one other .ngo bidder.
The British charity Article 25 has been pondering a .ngo application since 2008, according to its web site at dotngo.net.
That initiative seems to have roughly similar goals to PIR — global, restricted, non-profit — and VeriSign seems to have been engaged as a possible registry services provider.
PIR plans to stick to its existing back-end infrastructure provider, Afilias.
As a community application, it will be a “closed domain”, Cute said. Unlike .org, there will be eligibility criteria to pass before you’re allowed to register a domain name.
PIR also plans to apply for internationalized domain name transliterations of .org, in Chinese, Hindi, Cyrillic and Arabic, Cute said.
Here‘s the site for the application.

VeriSign boss leaves domain industry

Former VeriSign chief executive Mark McLaughlin, who resigned last week, is leaving the domain name industry entirely, signing up as the new CEO of Palo Alto Networks, a firewall vendor.
The privately held company is being tipped for an imminent IPO, which could mean a big stock payday for McLaughlin if executed successfully.
The Wall Street Journal quotes McLaughlin today as saying “the upside is on the equity side”.
Coming ahead of the launch ICANN’s top-level domains program, you could have been forgiven for thinking that McLaughlin may have been headhunted by a new gTLD player.
That would have been a heck of an endorsement of the commercial opportunity of new gTLDs, for the head of .com and .net to throw in with the newcomers.
But clearly McLaughlin has realized there’s more money in firewalls.
Smart man.
At VeriSign, founder Jim Bedzos has taken over as CEO while a permanent replacement for the 10-year VeriSign veteran is sought.

VeriSign CEO quits. But where’s he going?

VeriSign’s CEO and president Mark McLaughlin has quit the company for a CEO position at an undisclosed private company.
The news of his departure, after two years at VeriSign’s helm, came during the company’s second quarter earnings call yesterday.
McLaughlin’s been at VeriSign for over a decade. In his time as CEO, he oversaw a massive restructuring at the company.
VeriSign is now dramatically smaller – 1,000 people compared to 5,000 when he took over – following the sale of assets such as the security business, which Symantec bought.
His resignation is effective on Monday, but he’s told the company he’ll stick around until late August. Founder and chairman Jim Bedzos will become interim CEO while a replacement is found.
But where’s McLaughlin going?
The timing, less that six months before ICANN’s new top-level domains program kicks off, is certainly curious. It would be an unbelievable coup for a new gTLD firm to hire the former boss of .com.
A lot of people are switching companies at the moment, positioning themselves the best to exploit the new gTLD opportunity. (Anybody need a writer? I’m told my prices are very reasonable).
But he could be going anywhere, of course.
On VeriSign’s earnings call yesterday, McLaughlin said he wanted to join a private company and take it public, which made me think he may be leaving the domain business entirely.
McLaughlin is an advisor to Altos Ventures, a venture capital firm with a bunch of startups to its name.
There are not a great many companies in the domain industry – that we know about, at least – that immediately jump out as near-term IPO candidates.
McLaughlin plans to announce his new employer next week.

VeriSign to raise .com and .net prices again

VeriSign has announced price increases for .com and .net domain name registrations.
From January 15, 2012, .com registry prices will increase from $7.34 to $7.85 and .net fees will go up from $4.65 to $5.11.
That’s a 10% increase for .net and a 7% increase for .com, the maximum allowable under its registry agreements with ICANN.
As ever, registrants have six months to lock down their domains at current pricing by renewing for periods of up to 10 years.
The last time VeriSign raised prices, also by 7% and 10%, the higher prices became effective a year ago, July 2010.
VeriSign’s contract for .net was renewed last month after it was approved by the ICANN board of directors.
Its .com contract comes up for renewal next year.

Buy a .com in England, go to jail in America?

People who register .com or .net domain names to conduct illegal activity risk extradition to the United States because the domains are managed by an American company.
That’s the startling line reportedly coming from the Immigration and Customs Enforcement agency, which is trying to have the British operator of TVShack.net shipped out to stand trial in the US.
According to reports, 22-year-old student Richard O’Dwyer is fighting extradition to face charges of criminal copyright infringement.
ICE assistant deputy director Erik Barnett told The Guardian that any overseas web site using a .com or .net address to spread pirated material is a legitimate target for prosecution in the States.
The agency has already started shutting down .com and .net sites by seizing their domains, even if the sites in question had been found legal in their own overseas jurisdictions.
It does so by serving a court order to VeriSign, the registry manager, which is based in Virginia. The company is of course obliged to obey the order.
TVShack.net provided links to bootleg movies and TV shows, rather than hosting the content itself. It appears to be a matter of some confusion in the UK whether that behavior is actually illegal or not.
The site reportedly was hosted outside the US, and O’Dwyer never visited the US. The only link was the domain name.
I’m British, but DI is a .com, so I’d like to exercise my (presumed conferred) First Amendment rights to call this scenario utterly insane.
The issue of legal jurisdiction, incidentally, is one that potential new gTLD applicants need to keep in mind when selecting a back-end registry services provider.
Most incumbent providers are based in the US, and while we’ve seen plenty of upstarts emerge in Europe, Asia and Australia, some of those nations sometimes have pretty crazy laws too.

VeriSign’s .net contract renewed

VeriSign has been given the nod to continue to run the .net domain registry after a vote by ICANN’s board of directors today.
The vote was 14-0, with director Bertrand De La Chappelle abstaining without explanation.
The renewal is hardly surprising – nobody thought for a second that VeriSign would fail to retain the contract – but the deal was controversial anyway, due to a Boing-Boing misunderstanding.
The contract still allows VeriSign to carry on raising prices, by up to 10% in any given year, and it still calls for ICANN to receive $0.75 per domain, which currently adds up to over $10 million a year.
The money is still ostensibly earmarked for special projects including extending ICANN’s outreach into developing nations and DNS security, and the resolution passed by the board today says:

ICANN commits to provide annual reporting on the use of these funds from .NET transaction fees.

This is presumably designed to address criticisms that it basically ignored its commitment under the 2006 .net agreement to set up two “special restricted funds” to manage .net cash, as I reported on here.