Registries could become registrars by summer

The big incumbent top-level domain registry operators could apply to also become registrars as early as June this year, according to a just-passed ICANN resolution.
Last November, ICANN decided to dump its longstanding policy of generally not allowing TLD registries to also own and operate registrars.
While the rule was designed primarily for TLDs won under the new gTLD program, it will also retroactively apply to operators of existing gTLDs.
Neustar (.biz) has already publicly stated its intention to vertically integrate, and is keen for ICANN to lift its current 15% registrar ownership restriction before the new gTLD program kicks off.
According to a resolution passed by ICANN’s board of directors on Thursday, Neustar is not the only registry operator to make such a request.
The board last week…

RESOLVED (2011.04.21.13), the Board directs the CEO to develop a process for existing gTLD registry operators to transition to the new form of Registry Agreement or to request amendments to their registry agreements to remove the cross-ownership restrictions. This process would be available to existing operators upon Board approval of the new gTLD Program.

ICANN currently plans to approve the gTLD program June 20 at its meeting in Singapore.
That gives CEO Rod Beckstrom and his team just two months to come up with a process for allowing the likes of VeriSign, Neustar and Afilias to either amend their contracts or move to the standard contract outlined in the new TLD program’s Applicant Guidebook.
I see a potential source of tension here.
The registry agreement template in the Guidebook has been described by some as an “adhesion contract” due to its heavy balance in ICANN’s favor.
Existing registries will very likely prefer to simply delete the cross-ownership restrictions in their current contracts and incorporate the new proposed Code of Conduct rules.
On the other hand, some have suggested that registries should be obliged to adopt the new Guidebook agreement in full, rather than amend their existing deals, in the interests of equitable treatment.
Registrars still signed up to ICANN’s 2001 Registrar Accreditation Agreement only get the option to upgrade wholesale to the 2009 agreement, it has been noted.

ICE domain seizures enter second phase

The US Immigration & Customs Enforcement agency seems to be consolidating its portfolio of seized domain names by transferring them to its own registrar account.
Many domains ICE recently seized at the registry level under Operation “In Our Sites” have, as of yesterday, started naming the agency as the official registrant in the Whois database.
ICE, part of the Department of Homeland Security, has collected over 100 domains, most of them .coms, as part of the anti-counterfeiting operation it kicked off with gusto last November.
The domains all allegedly either promoted counterfeit physical goods or offered links to bootleg digital content.
At a technical level, ICE originally assumed control of the domains by instructing registries such as VeriSign, the .com operator, to change the authoritative name servers for each domain to seizedservers.com.
All the domains pointed to that server, which is controlled by ICE, resolve to a web server displaying the same image:

(The banner, incidentally, appears to have been updated this month. If clicked, it now sends visitors to this anti-piracy public service announcement hosted at YouTube.)
Until this week, the Whois record associated with each domain continued to list the original registrant – a great many of them apparently Chinese – but ICE now seems to be consolidating its portfolio.
As of yesterday, a sizable chunk — but by no means all — of the seized domains have been transferred to Network Solutions and now name ICE as the registrant in their Whois database records.
Rather than simply commandeering the domains, it appears that ICE now “owns” them too.
But ICE has already allowed one of its seizures to expire. The registration for silkscarf-shop.com expired in March, and it no longer points to seizedservers.com or displays the ICE piracy warning.
The domain is now listed in Redemption Period status, meaning it is starting along the road to ultimately dropping and becoming available for registration again.
Interestingly, most of the newly moved domains appear to have been transferred into NetSol from original registrars based in China, such as HiChina, Xin Net and dns.com.cn.
After consulting with a few people more intimately familiar with the grubby innards of the inter-registrar transfer process than I am, I understand that the names could have been moved without the explicit intervention of either registrar, but that it would not be entirely unprecedented if the transfers had been handled manually under the authority of a court order.
If I find out for sure, I’ll provide an update.

.xxx domains go live

Click here: icmregistry.xxx, then come back.
That’s right. After ICM Registry’s almost 11 years of campaigning, and almost $20 million in legal and other expenses, .xxx domain names are actually live in the domain name system.
ICANN, IANA, the US government and VeriSign, in that order, have all agreed to delegate the internet’s newest gTLD, and the first few .xxx domains went live within the last couple hours.
The domains sex.xxx and porn.xxx are now also resolving to placeholder sites. They’re currently “safe for work”, but possibly not for much longer.
IANA has a .xxx page, complete with a lengthy delegation report (in a snazzy new pdf format) that broadly explains the convoluted process ICANN used to ultimately, albeit reluctantly, approve the TLD.

Feds seize billion-dollar poker domains

Five domain names associated with online poker sites have been seized by the FBI as part of an investigation that has also seen 11 people indicted.
The principals of PokerStars, Absolute Poker and Full Tilt Poker, along with third-party “payment processors”, stand accused of engaging in a massive money laundering scheme in order to accept billions of dollars of payments from American gamblers in violation of US laws.
The charges carry possible maximum sentences of between five and 30 years in prison, along with substantial monetary fines. Two men have been arrested, a third is due to be arraigned, and the remainder are currently outside of the US, according to a press release (pdf).
The US Attorney for the Southern District of New York said five domain names have been seized by the FBI in connection with the prosecutions.
It’s not yet clear which domains have been seized.
From where I’m sitting in London, absolutepoker.com already shows an FBI warning banner, but pokerstars.com and fulltiltpoker.com both resolve normally. I may be receiving cached DNS data.
Blogger Elliot Silver, sitting behind a resolver on the other side of the pond, reports that ub.com is among the seized domains.
Unlike previous recent seizures, which were carried out by the US Immigration and Customs Enforcement agency, this time the FBI appears to be the responsible agency.
And this time, these aren’t two-bit file-sharing forums or Chinese knock-off merchandise sites, we’re talking about businesses that are perfectly legal in many jurisdictions, clearing billions in revenue.
But according to US Attorney’s charges, the companies carried out an elaborate plan to cover up the sources of their revenue through third parties and phoney bank accounts.
The companies are even alleged to have made multi-million dollar investments in failing banks in order to get them to turn a blind eye to the illicit gambling activities.
It appears that the FBI went straight to the .com registry, VeriSign, as some of the affected domains appear to be registered through UK-based corporate registrar Com Laude.
If you’re wondering whether this is yet another confirmation that all .com domains are subject to US jurisdiction, this is your takeaway sentence, from Manhattan US Attorney Preet Bharara:

Foreign firms that choose to operate in the United States are not free to flout the laws they don’t like simply because they can’t bear to be parted from their profits.

The suits seek $3 billion in allegedly ill-gotten gains to be returned.

VeriSign to offer different prices to different registrars?

VeriSign may be able to offer differential pricing for .net domain names under the just-published draft .net registry contract.
The current .net agreement expires at the end of June, but VeriSign has a presumptive right of renewal.
The newly negotiated contract has a new “Special Programs” clause would enable VeriSign to offer pricing incentives to registrars in “underserved geographies” not available to other registrars.
Here’s the meat of the paragraph:

Registry Operator may for the purpose of supporting the development of the Internet in underserved geographies provide training, technical support, marketing or incentive programs based on the unique needs of registrars located in such geographies to such registrars, so long as Registry Operator does not treat similarly situated registrars differently or apply such programs arbitrarily. Registry Operator may implement such programs with respect to registrars within a specific geographic region, provided, that (i) such region is defined broadly enough to allow multiple registrars to participate and (ii) such programs do not favor any registrar in which Registry Operator may have an ownership interest over other similarly situated registrars within the same region.

Later, the part of the contract that limits VeriSign’s registry fee and requires uniform pricing among all registrars has been amended to specifically exclude these special programs.
The contract does seem to envisage differential registrar pricing, within certain geographic parameters, perhaps enabling VeriSign to stimulate growth in low-penetration markets.
It’s probably too early to speculate, given that we don’t know what incentives VeriSign has in mind, but it’s not difficult to imagine a scenario where particularly attractive pricing could cause a bunch of shell companies to emerge in, say, Africa or Asia.
For now, the provision would only apply to .net domains, but VeriSign has been known to use .com as a venue for dry runs of services it wants to offer in .com. The .com contract is up for renewal next year.
The proposed .net contract (pdf) contains a number of other changes (pdf), some of which mirror language found in other registry contracts, some of which are new.
There’s a provision for VeriSign to be able to “prevent” the registration of certain names, such as those that would have led to the Conficker worm spreading, in order to protect the security of the internet.
Some of the things that have not changed are also quite interesting.
With ICANN’s recent “vertical integration” decision, which will allow registries and registrars to own each other, you’d think the .net contract renegotiation would be the perfect opportunity for VeriSign to signal its intentions to get into the registrar business, as Neustar already has.
But it has not. The contract contains the same prohibitions on cross ownership as the earlier version.
And as Domain Name Wire noted, the new contract would allow VeriSign to continue to increase its prices by 10% every year until 2017.
That could lead to a maximum of about $9 per domain per year, including ICANN fees, by the time the deal is next up for renewal, if VeriSign exercised the option every year.
There’s an ICANN public comment period, open until May 10.

VeriSign now front-runner for .bank

VeriSign has signed a deal with two major banking industry organizations to become their exclusive provider of registry services for any new top-level domains designed for financial services companies.
The deal is with the American Bankers Association and BITS, the technology policy arm of the Financial Services Roundtable. Together, they represent the majority of US banks.
While the announcement conspicuously avoids mentioning any specific TLD strings, .bank is the no-brainer. I suspect other announced .bank initiatives will now be reevaluating their plans.
The way ICANN’s new gTLD Applicant Guidebook is constructed, any TLD application claiming to represent the interests of a specific community requires support from that community.
There are also community challenge procedures that would almost certainly kill off any .bank application that did not have the backing of major banking institutions.
BITS has already warned ICANN that it would not tolerate a .bank falling into the wrong hands, a position also held by ICANN’s Governmental Advisory Committee.
In an era of widespread phishing and online fraud, the financial services industry is understandably eager that domains purporting to represent banks are seen to be trustworthy.
Because we all trust bankers, right?
VeriSign is of course the perfect pick for a registry services provider. As well as running the high-volume .com and .net domains, it also carries the prestige .gov and .edu accounts.
“We’re honored to have been chosen by BITS and ABA as their registry operator for any new gTLDs deployed to serve the financial services industry and their customers,” said Pat Kane, VeriSign’s senior VP of Naming Services, in a statement.
Apart from the multilingual versions of .com and .net, I think this may be the first new TLD application VeriSign has publicly associated itself with.

Domain security arrives in .com

VeriSign announced late yesterday that it has fully implemented DNSSEC in .com, meaning pretty much anyone with a .com domain name can now implement it too.
DNSSEC is a domain-crypto protocol mashup that allows web surfers, say, to trust that when they visit wellsfargo.com they really are looking at the bank’s web site.
It uses validatable cryptographic signatures to prevent cache poisoning attacks such as the Kaminsky Bug, the potential internet-killer that caused panic briefly back in 2008.
With .com now supporting the technology, DNSSEC is now available in over half of the world’s domains, due to the size of the .com zone. But registrants have to decide to use it.
I chatted to Matt Larson, VeriSign’s VP of DNS research, and Sean Leach, VP of technology, this afternoon, and they said that .com’s signing could be the tipping point for adoption.
“I feel based on talking to people that everybody has been waiting for .com,” Larson said. “It could open the floodgates.”
What we’re looking at now is a period of gradual adoption. I expect a handful of major companies will announce they’ve signed their .coms, probably in the second half of the year.
Just like a TLD launch, DNSSEC will probably need a few anchor tenants to raise the profile of the technology. Paypal, for example, said it plans to use the technology at an ICANN workshop in San Francisco last month, but that it will take about six months to test.
“Most people have their most valuable domains in the .com space,” said Leach. “We need some of the big guys to be first movers.”
There’s also the issue of ISPs. Not many support DNSSEC today. The industry has been talking up Comcast’s aggressive deployment vision for over a year now, but few others have announced plans.
And of course application developer support is needed. Judging from comments made by Mozilla representatives in San Francisco, browser makers, for example, are not exactly champing at the bit to natively support the technology.
You can, however, currently download plugins for Firefox that validate DNSSEC claims, such as this one.
According to Leach, many enterprises are currently demanding DNSSEC support when they buy new technology products. This could light a fire under reluctant developers.
But DNSSEC deployment will still be slow going, so registries are doing what they can to make it less of a cost/hassle for users.
Accredited registrars can currently use VeriSign’s cloud-based signing service for free on a trial basis, for example. The service is designed to remove the complexity of managing keys from the equation.
I’m told “several” registrars have signed up, but the only one I’m currently aware of is Go Daddy.
VeriSign and other registries are also offering managed DNSSEC as part of their managed DNS resolution enterprise offerings.
Neither of the VeriSign VPs was prepared to speculate about how many .com domains will be signed a year from now.
I have the option to turn on DNSSEC as part of a Go Daddy hosting package. I probably will, but only in the interests of research. As a domain consumer, I have to say the benefits haven’t really been sold to me yet.

VeriSign’s upcoming battle for the Chinese .com

Could VeriSign be about to face off against China for control of the Chinese version of .com? That’s an intriguing possibility that was raised during the .nxt conference last week.
Almost as an aside, auDA chief Chris Disspain mentioned during a session that he believes there are moves afoot in China to apply to ICANN for “company”, “network” and “organization” in Chinese characters. In other words, .com, .net and .org.
I’ve been unable to find an official announcement of any such Chinese application, but I’m reliably informed that Noises Have Been Made.
VeriSign has for several quarters been open about its plans to apply for IDN equivalents of its two flagship TLDs, and PIR’s new CEO Brian Cute recently told me he wants to do the same for .org.
While neither company has specified which scripts they’re looking at, Chinese is a no-brainer. As of this week, the nation is the world’s second-largest economy, and easily its most populous.
Since we’re already speculating, let’s speculate some more: who would win the Chinese .com under ICANN’s application rules, VeriSign or China?
If the two strings were close enough to wind up in a contention set, could VeriSign claim intellectual property rights, on the basis of its .com business? It seems like a stretch.
Could China leapfrog to the end of the process with a community application and a demand for a Community Priority Evaluation?
That also seems like a stretch. It’s not impossible – there’s arguably a “community” of companies registered with the Chinese government – but such a move would likely stink of gaming.
Is there a technical stability argument to be made? Is 公司. (which Google tells me means “company” in Chinese) confusingly similar to .com?
If these TLDs went to auction, one thing is certain: there are few potential applicants with deeper pockets than VeriSign, but China is one of them.
UPDATE: VeriSign’s Pat Kane was good enough to post a lengthy explanation of the company’s IDN strategy in the comments.

VeriSign scores big win in .com pricing lawsuit

VeriSign has successfully had an antitrust lawsuit, which claims the company has been raising .com domain name prices anti-competitively, dismissed by a California court.
While it’s encouraging news if you’re a VeriSign shareholder, the Coalition for ICANN Transparency, which filed the suit, will be allowed to amend and re-file its complaint.
The basis for the dismissal (pdf) goes to the central irony of CFIT – the fact that, despite its noble name, it’s not itself a particularly transparent organization.
CFIT was set up in 2005 in order to sue ICANN and VeriSign over their deal that gave VeriSign the right to raise the price of .com and .net domains, and to keep its registry contracts on favorable terms.
While it was cagey about who was backing the organization, those of us who attended the ICANN meeting in Vancouver that year knew from the off it was primarily a front for Momentous.ca, owner of Pool.com and other domainer services.
In dismissing the case last Friday, Judge Ronald Whyte decided that CFIT’s membership is vague enough to raise a question over its standing to sue on antitrust grounds. He wrote:

By failing to identify its purported members, CFIT has made it impossible to determine whether the members are participants in the alleged relevant markets, or whether they have suffered antitrust injury. Because the [Third Amended Complaint] identifies no members of CFIT, it must be dismissed.

While CFIT had disclosed some time ago Pool.com’s involvement, it recently tried to add uber-domainer Frank Schilling’s Name Administration Inc and iRegistry Corp to the list of its financial supporters.
But Whyte was not convinced that the two companies were CFIT “members” with standing to sue.
Whyte decided that CFIT’s complaint, “fatally fails to allege facts showing that iRegistry or Name Administration were financial supporters or members at the time the complaint was filed”.
He also denied CFIT’s demand for a jury trial.
CFIT wants VeriSign to return all the excess profits it has made on .com registrations since it started raising its prices above $6.
If CFIT were to win, it would severely curtail VeriSign’s ability to grow its registry business, and could lead to billions being wiped off its accounts.
The organization has been given leave to file a fourth amended complaint, so it’s not over yet.

Incumbents get the nod for new TLD apps

Domain name registries such as Neustar, VeriSign and Afilias will be able to become registrars under ICANN’s new top-level domains program, ICANN has confirmed.
In November, ICANN’s board voted to allow new TLD registries to also own registrars, so they will be able to sell domains in their TLD direct to registrants, changing a decade-long stance.
Late last week, in reply (pdf) to a request for clarification from Neustar policy veep Jeff Neuman, new gTLD program architect Kurt Pritz wrote:

if and when ICANN launches the new gTLD program, Neustar will be entitled to serve as both a registry and registrar for new gTLDs subject to any conditions that may be necessary and appropriate to address the particular circumstances of the existing .BIZ registry agreement, and subject to any limitations and restrictions set forth in the final Applicant Guidebook.

That doesn’t appear to say anything unexpected. ICANN had already made it pretty clear that the new vertical integration rules would be extended to incumbent gTLD registries in due course.
(However, you may like to note Pritz’s use of the words “if and when”, if you think that’s important.)
Neustar’s registry agreement currently forbids it not only from acting as a .biz registrar, but also from acquiring control of greater than 15% of any ICANN-accredited registrar (whether or not its sells .biz domains).
That part of the contract will presumably need to be changed before Neustar applies for official registrar accreditation or attempts to acquire a large stake in an existing registrar.
VeriSign and Afilias, the other two big incumbent gTLD registries, have similar clauses in their contracts.