A more complete version of my comments that that which appears in the report. -------- Original Message -------- Subject: Consumer trust: continued disagreement over the premise Date: Sun, 15 Jul 2012 14:28:22 -0400 From: Wendy Seltzer <wendy@seltzer.com> To: Consumer CCI DT <gnso-consumercci-dt@icann.org> Hi Consumer Metrics team, I write because I continue to have strong disagreement with the "trust" metrics and their presentation. Since I have been unable to make the calls due to persistent scheduling conflicts, I wanted to spell out the concerns I discussed with several of you in Prague. I appreciate the work that has gone into the metrics, but believe that the "trust" metrics rely on a faulty premise, that gTLDs should be predictable, rather than open to innovative and unexpected new uses. The current draft mistakes a platform, a gTLD, for an end-product. A key value of a platform is its generativity -- its ability to be used and leveraged by third parties for new, unexpected purposes. Precisely because much innovation is unanticipated, it cannot be predicted for a chart of measures. Moreover, incentives on the intermediaries to control their platforms translate into restrictions on end-users' free expression and innovation. Just as we would not want to speak about "trust" in a pad of printing paper, on which anyone could make posters, and we don't ask a road system to interrogate what its drivers plan to do when they reach their destinations, I think we shouldn't judge DNS registries on their users' activities. ICANN's planned reviews of and targets for gTLD success should not interfere with market decisions about the utility of various offerings. In particular, I disagree with the second group of "trust" metrics, the " Measures related to confidence that TLD operators are fulfilling promises and complying with ICANN policies and applicable national laws:" namely, * Relative incidence of UDRP & URS Complaints; Relative incidence of UDRP & URS Decisions against registrant; * Quantity and relative incidence of intellectual property claims relating to Second Level domain names, and relative cost of overall domain name policing measured at: immediately prior to new gTLD delegation and at 1 and 3 years after delegation; * Quantity of Compliance Concerns w/r/t Applicable National Laws, including reported data security breaches; * Quantity and relative incidence of Domain Takedowns; * Quantity of spam received by a "honeypot" email address in each new gTLD; * Quantity and relative incidence of fraudulent transactions caused by phishing sites in new gTLDs; * Quantity and relative incidence of detected phishing sites using new gTLDs; * Quantity and relative incidence of detected botnets and malware using new gTLDs * Quantity and relative incidence of sites found to be dealing in or distributing identities and account information used in identity fraud; and * Quantity and relative incidence of complaints regarding inaccurate, invalid, or suspect WHOIS records in new gTLD Separately, I disagree with the targets for the "redirection," "duplicates," and "traffic" measures. All of these presume that the use for new gTLDs is to provide the same type of service to different parties, while some might be used to provide different services to parties including existing registrants. Thanks, --Wendy -- Wendy Seltzer -- wendy@seltzer.org +1 617.863.0613 Fellow, Yale Law School Information Society Project Fellow, Berkman Center for Internet & Society at Harvard University http://wendy.seltzer.org/ https://www.chillingeffects.org/ https://www.torproject.org/ http://www.freedom-to-tinker.com/