September 2018 - GNSO-RPM-WG

Order and Schedule for Individual URS Proposal Presentations
by Julie Hedlund Sept. 11, 2018

Sept. 11, 2018

Dear RPM PDP Working Group members, As reported last week, the deadline for individual Working Group members to submit Proposals for URS policy and operational recommendations closed on COB 06 September. By the deadline, thirty-three (33) URS Proposals were submitted. In preparation for the Working Group meeting on Monday, 17 September, the RPM PDP Working Group Co-Chairs, in coordination with staff, have reviewed the individual URS proposals and have grouped them by type as follows: Operational Fixes, Policy Recommendations, and Other. In addition, the proposals have been mapped to the topics in the Super Consolidated URS Topic Table. Per the attached Procedures for URS Policy and Operational Recommendations, the Co-Chair propose to schedule the presentations in the following order, organized by URS topic: Operational Fixes; Policy Recommendations; Other proposals. The order and schedule for individual URS proposal presentations is subject to the following procedures as described in the attached document: To the maximum extent possible, presentations will be rotated to ensure that the same Working Group member is not making more than two (2) proposals per meeting. When a proposal is up for discussion, its proponent will be accorded a maximum of five (5) minutes to orally present the proposal, rationale, and supporting evidence. The floor will then be open to other Working Group members to comment on the proposal for a maximum of two (2) minutes each, with total discussion limited to twenty (20) minutes. However, if there is exceptionally high interest in a topic, the Co-Chairs would have discretion to increase the discussion time. At the end of twenty (20) minutes, or when there are no more commenters in queue, the proponent will have up to four (4) minutes to respond and/or propose a modification of the proposal based upon the discussion. After the presentation: Shortly following the conclusion of the call (i.e. as soon as attendance, chat, and link to mp3 recording are available), staff shall post to the email list the final text and rationale of considered proposals. All Working Group members will be invited to comment on the proposals on the Working Group email list. In addition, per the attached procedures proponents will receive advance notice of the date on which their proposal is scheduled for presentation to ensure they will be available. Proponents will be permitted to request an alternate date if they have a conflict. Also, as requested, proponents will be able to designate an alternate to present on their behalf if they are unable to present at any of the available meetings. The Co-Chairs would like to re-emphasize that the Working Group faces a significant challenge in adhering to its current timeline and completing its URS work for the Initial Report before ICANN63. Consequently, the Co-Chairs also propose expediting the handling of the 33 proposals to keep to the Phase 1 timeline in the following manner: Deferring discussion of proposals designated by their proponent as Phase 2 items until we reach Phase 2, with an assurance they will be listed in the Initial Report as reserved for Phase 2 consideration, and that they will be brought up for discussion during Phase 2 in a manner consistent with any procedures for consideration of WG member proposals adopted for Phase 2. To be clear, the acceptance of any Phase II proposals submitted presently for preservation purposes does not foreclose the additional submission of future Phase II proposals by WG members when the WG is at that stage of its work. Any proponents who have designated their current URS proposals Phase 2 items will be contacted separately to confirm their agreement with this approach. Possibly holding two meetings per week to complete consideration of all items before ICANN63. The Co-Chairs appreciate the time that WG members are already making through their participation in WG meetings and will only utilize this option if it appears absolutely necessary. Please see the attached table of the order and schedule of Individual URS Proposals and on the wiki at: https://community.icann.org/x/aACNBQ. Staff have reorganized the wiki page and renamed the document files to reflect the order of the individual URS proposal presentation. The tentative presentation date of each proposal is included, subject to change depending on actual progress. The proposals about topics that can be deferred to Phase 2 are colored in grey; no presentation date has been assigned to these proposals. You may view and download all URS proposals quickly by clicking the “Quick Download” tab. As noted previously, the Co-Chairs believe that these procedures will efficiently and fairly facilitate the RPM PDP Working Group discussion and development of URS policy and operational recommendations over the course of the upcoming Working Group meetings in September and October, beginning on Monday, 17 September. Finally, the Co-Chairs reiterate that the next Working Group meeting on 12 September is for the consideration of the URS Sub Team suggested draft policy recommendations. Working Group members who have submitted proposals similar to or on the same subject as a sub-team policy proposal are asked to hold any comments regarding their individual proposals until their scheduled presentations. The acceptance of a sub-team proposal will not preempt that of a related individual proposal; if such an individual proposal elicits adequate support, the co-chairs may suggest that it be combined with a related sub-team proposal or, if appropriate, both proposals may be included in the Initial Report for public comment. Best regards, Mary, Julie, Ariel & Berry On behalf of the RPM PDP Working Group Co-Chairs

3 5

Re: [gnso-rpm-wg] URS / UDRP proposals -- data on registrar/registry compliance costs
by Maxim Alzoba Sept. 11, 2018

Sept. 11, 2018

Hello Jonathan, I am resending it (was not processed by gnso-rpm-wg@ list). I think lifetime lock (if at all) should be limited to the lifetime of the TM registration, to avoid dumping of some strings for no reason (when there is no TM holder to protect, what is the reason for locking?) Also, all registrations terms are limited to the time of Registry contract with ICANN (10 years), so at the best it can be 10 years, and not a single day more. So either we do not use this idea, or we will have to create mechanism of removing such lifetime-10years-lock, preferably using the current system (for example, TM database to which URS complainant of that time referred to , does not have the entry no more, so the party seeking for the registration can start a process, might be even with the same price of filing via the same URS provider, or it's successor). p.s: any kind of such lock can be overridden by a simple village court in the same jurisdiction as the particular registry is based. Sincerely Yours, Maxim Alzoba Special projects manager, International Relations Department, FAITID m. +7 916 6761580(+whatsapp) skype oldfrogger Current UTC offset: +3.00 (.Moscow) > On 5 Sep 2018, at 20:59, Jonathan Frost <jonathan(a)get.club <mailto:jonathan@get.club>> wrote: > > For instance, there is ambiguity about what action a registry should take when a domain which is already the subject of a URS judgement & lifetime lock receives a UDPR judgement that requires unlock & transfer. The URS rules don't account for this situation, and by their letter, require that the domain not be unlocked. However, the registries are also required to comply with consensus policies (such as UDRP). > > Jonathan > > On Wed, Sep 5, 2018 at 1:47 PM Doug Isenberg <Doug(a)giga.law <mailto:Doug@giga.law>> wrote: > What are some of the “ambiguities in complying with the rules”? > > > > Doug > > > > > > From: gnso-rpm-wg <gnso-rpm-wg-bounces(a)icann.org <mailto:gnso-rpm-wg-bounces@icann.org>> On Behalf Of Jonathan Frost > Sent: Wednesday, September 5, 2018 1:15 PM > To: icann(a)leap.com <mailto:icann@leap.com> > Cc: gnso-rpm-wg <gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org>> > Subject: Re: [gnso-rpm-wg] URS / UDRP proposals -- data on registrar/registry compliance costs > > > > I agree that Registries and Registrars need to be able to recover the cost of administering the URS/UDRPs, as part of the filing fee. > > > > The costs that the Registries/Registrars bear actually goes beyond what Reg has said. There are situations where we have to go to outside counsel or even ICANN to resolve ambiguities in complying with the rules. Additionally, the 24 hour action requirement on locking a domain that has received a URS complaint actually increases the resources that have to be dedicated, beyond the actual number of minutes per complaint, because compliance personal has to allocate/reserve a certain time per day to perform the tasks, even if no complaint is received that day. > > > > Just like the arbitration administrators charge a cost recovery fee for administration as part of the filing fee, it's just common since that the Registries/Registrars would too. > > > > Jonathan Frost > > _______________________________________________ > gnso-rpm-wg mailing list > gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rpm-wg <https://mm.icann.org/mailman/listinfo/gnso-rpm-wg>_______________________________________________ > gnso-rpm-wg mailing list > gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rpm-wg

7 17

Sunrise & Trademark Claims Survey Launched
by Ariel Liang Sept. 11, 2018

Sept. 11, 2018

Dear RPM Working Group members, Staff are happy to report that the Sunrise & Trademark Claims survey has been launched today and is scheduled to run until Friday, 28 September 2018. * Registry Operator: http://icannregistryoperators.cloudssi.com/login.html * Registrar: http://icannregistrar.cloudssi.com/login.html * Trademark Owner/Representative: http://icanntrademarkholders.cloudssi.com/login.html * Actual/Potential Registrant: https://online.ssisurveys.com/wix/p3964574.aspx?hSamp=1 The survey is being circulated according to the distribution plans jointly developed by the Data Sub Team, Analysis Group, and staff: https://community.icann.org/x/aQ9pBQ. In summary, the survey targeting actual/potential registrants would be promoted as widely as possible; the survey targeting registries, registrars, and trademark owners would be promoted using a targeted approach. According to the plans, the following activities were conducted today: * An announcement on GNSO website has been published: https://gnso.icann.org/en/announcements/announcement-06sep18-en.htm * An ICANN.org announcement has been published (it features the actual/potential registrant survey, but makes reference to the others): https://www.icann.org/news/announcement-2-2018-09-06-en * The GDD Team sent the survey announcement directly to their registry and registrar contacts, and circulated it with the CPH/RySG/RrSG. * The GNSO Secretariat Team, GSE Team, Analysis Group, and a few WG members (Brian Beckham, Lori Schulman, and Susan Payne) will help promote the survey inside and outside of ICANN. For instance, you should be able to see the survey announcement message being circulated on the mailing lists of various SOs/ACs/SGs/Cs shortly. External organizations would also be contacted to circulate the survey. * ICANN Comms Team will promote the survey on various social media channels tomorrow day time. Last, staff are sharing the Inception Report from Analysis Group. The Inception Report documents the work plan, proposed project schedule, survey targets, outreach plan, and final survey design and questions. Staff would like to thank the Data Sub Team members, especially Kristine Dorrain, Susan Payne, Michael Graham, and Rebecca Tushnet, who devoted tremendous amount of time and effort in developing and finalizing the survey in collaboration with Analysis Group. We also greatly appreciate the time and help from all the beta testers, who provided extensive and useful feedback! WG members are welcome to fill out the survey yourselves, if appropriate. Please also help promote the survey by sharing the web announcements, as well as social media posts from ICANN and GNSO’s channels. Analysis Group will monitor the response rates while the surveys are in the field. Again, big thanks to the members who have contributed to the Sunrise & Trademark Claims survey! Best Regards, Mary, Julie, Ariel & Berry

2 1

Second internet court set up in Beijing
by George Kirikos Sept. 10, 2018

Sept. 10, 2018

Hi folks, I read an interesting story in the Chinese media today: http://www.chinadaily.com.cn/a/201809/10/WS5b95b8e4a31033b4f46550e9.html "China opened a second internet court on Sunday to address the rising disputes and problems caused by its ever-growing reliance on cyberspace. The Beijing Internet Court, situated in a Fengtai district technology zone in the southwest of the capital, will mainly handle internet and intellectual property rights cases, such as disputes involving online loans, online shopping contracts and online copyright issues, the Supreme People's Court wrote in an online judicial interpretation. The IP rulings of the district-level court, which has 38 judges, can be appealed at the Beijing Intellectual Property Court, and its other cases at the Beijing No 4 Intermediate People's Court. .... Liu Shuhan, a judge at the court, said one of its key features is that litigants can handle their lawsuits entirely online－they are not required to go to the court in person at any point from the case filing to the hearing." I think this reinforces the call to eliminate the URS and/or the UDRP (one of the proposals I submitted last week was for the elimination of the URS), given that the court alternative appears to be fast, convenient, and inexpensive (at least for Chinese parties; for the URS, that was a significant fraction of disputes). As more and more jurisdictions modernize their court systems to include online offerings like this, the justification for creating alternatives to the courts decreases. Sincerely, George Kirikos 416-588-0269 http://www.leap.com/

1 0

Agenda and Materials for 12 Sept Working Group Meeting 1700 UTC
by Julie Hedlund Sept. 7, 2018

Sept. 7, 2018

Dear RPM PDP Working Group members, On behalf of the Co-Chairs, please see the draft agenda below for the Working Group meeting on Wednesday, 12 September at 1700 UTC for 120 minutes. For this next meeting, the Working Group will discuss the URS Sub Teams’ suggested draft policy recommendations as detailed in the attached Super Consolidated URS Topics Table (highlighted in green). Please note that the discussion of individual URS proposals will begin with the meeting on 17 September (replacing the regular meeting on 19 September). Early next week staff will send on behalf of the Co-Chairs the order and schedule of the individual proposal presentations. Working Group members who have submitted proposals similar to or on the same subject as a sub-team policy proposal are asked to hold any comments regarding their individual proposals until their scheduled presentations. The acceptance of a sub-team proposal will not preempt that of a related individual proposal; if such an individual proposal elicits adequate support, the co-chairs may suggest that it be combined with a related sub-team proposal or, if appropriate, both proposals may be included in the Initial Report for public comment. Draft Agenda: Review Agenda/Statements of Interest Updates Discussion of URS Draft Policy Recommendations (see attached Super Consolidated URS Topics Table) AOB Best, Mary, Ariel, Berry, and Julie On Behalf of the RPM PDP WG Co-Chairs

1 0

Identity Theft -- how it affects various proposals submitted
by George Kirikos Sept. 7, 2018

Sept. 7, 2018

Hi folks, Reviewing some of the proposals that were submitted by last night's deadline, I think that they'd encounter some very serious problems in terms of implementation, because of lack of WHOIS verification and vulnerabilities associated with identity theft. For example, there were multiple "loser pays" submissions (I too am on the record as being strongly in favour of "loser pays" as a concept, but I qualified my support, noting (without going into too much detail): https://mm.icann.org/pipermail/gnso-rpm-wg/2018-August/003226.html that (in point #11) the system had to be carefully constructed, with systems of checks and balances in place. While I made submissions on other topics, folks will note I didn't submit one on "loser pays" at this time, because I realized that in order to properly implement a loser pays system one would need to solve a whole series of other problems first. And to solve those other problems first might become a monumental task (I'd be up to that monumental task, but not sure the rest of the PDP members would be willing to do it! If the rest of the group does want to solve them, I'd love to rise to the challenge too). So, here's just one of the major problems that would need to be solved before implementing "loser pays" or penalties --- lack of WHOIS verification which relates to identity theft. Registrars generally don't have any "Know Your Client" requirements and there is no real verification of the true identity of the person/entity that purports to be the registrant. There might be verification that the email address and/or the telephone number are verified. But, all the rest of the fields in the WHOIS can easily be faked, or used to impersonate others to commit identity theft. This is not some theoretical issue. I know first hand, as someone using a Chinese registrar copied my company's WHOIS for a malware domain, see the historical WHOIS at: https://research.domaintools.com/research/whois-history/search/?q=antivirus… (I had a Google Alert triggered, and that's how I noticed it; the attacker changed the phone number by 1 digit from my real phone number, but copied my name, company name, fax, address, and used a gkirikos@ address (obviously not matching my real email address). [I complained to the registrar, and also using an ICANN WHOIS complaint] [NB: with GDPR and redacted WHOIS out there, it could be happening *now* -- how would I know??] This has even happened within UDRP cases, where there has been identity theft, see: http://www.udrpsearch.com/search?query=identity%20theft&search=text&results… for various matches. e.g.: http://www.adrforum.com/domaindecisions/1774660.htm http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2017-1843 So, let's consider various scenarios. If there's a "loser pays" system, new vulnerabilities would be created if a system is not carefully constructed. An attacker could copy someone else's name/identity, use it for cybersquatting, and "lose" a UDRP/URS. Now that victim of identity theft would potentially have a liability for damages on a domain they never actually registered, using a registrar that they never had any relationship with. Most of the time, the registrar simply has a relationship with a purported identity, not a verified identity with a verified relationship (i.e. "Tom Cruise" is a real person, but the famous actor Tom Cruise is unlikely to be the actual registrant with a real relationship with a registrar, if that actor's name is placed into the WHOIS by an attacker). One of the proposals went even further, saying: https://community.icann.org/display/RARPMRIAGPWG/URS+Proposals "the penalties should include (i) a requirement that the registrant deposit funds into an escrow account, or provide an equivalent authorization on a credit card, with each new domain registration (such funds could be dispersed to prevailing complainants in future domain name disputes against that registrant as part of a “loser pays” system), and (ii) a universal blocking of all domain registrations for a set period for the registrant (i.e. “blacklisting” the registrant on a temporary basis)" (from proposal #30) It should be fairly obvious that such a scheme would enable an attacker to engage in a Denial of Service attack against a victim, by impersonating them (stealing their identity). e.g. (a) spend $20 total on a few dozen "throwaway" domains that have a sub-$1 dollar promo price (b) copy the victim's identity on a series of "famousbrand-authorized-store.newgtld" domains (c) wait for the victim to lose the URS/UDRP and be labelled a "repeat offender" or "high volume cybersquatter" Now when the *real* victim wants to register a domain at their real registrar, they'll suddenly encounter their name on a "blacklist"!! To show how truly vulnerable the system is to an attack, there's likely no real verification by the URS/UDRP providers that a *Complainant* is who they say they are! So, let's suppose the "victim" is "John Smith". The attacker has created the cybersquatting domains under the "John Smith" name, using multiple trademarks of Amazon, for example. Instead of waiting for the brandholder Amazon to file a URS (i.e. step (c) above), a truly motivated attacker (think state-funded actors, as an example, that want to interfere with a business competitor or an election) could go even further, and go impersonate the brandholder and file the URS or UDRP actions as a complaint! This email's getting long, and the more sophisticated readers can see where this takes us. I won't go into too much more detail now (can expand later, if desired), but you'd need to develop a system not only to verify identity properly, but also a system to *DISAVOW* domain name registrations. That disavowal system would be very hard for domains (a disavowal system was developed by Google for backlinks, https://support.google.com/webmasters/answer/2648487?hl=en , but that's much easier). [Real verification could take place via a digital signature system, like the one that exists in Estonia, for example] And even if one did verify identity properly (e.g. "John Smith" is labelled a serial cybersquatter), there are so many people that share common names (think China, India) that the blacklist would have collateral damage on many innocent registrants. And here's the thing -- an attacker can simply create a new real identity (even a "verified" one) very cheaply. For £12, (USD $15.59 at the time of this post), one can create a real UK company online within 24 hours: https://www.gov.uk/limited-company-formation/register-your-company (or effectively "free" if one uses a stolen credit card, as criminals tend to do!) So, even a "properly" implemented system would not be effective, if one can create new verified identities at low cost. The only real parties within the ICANN system that *are* verified are registrars and registries, and I think they would likely push back very hard if they are the "losers" who have to pay up. [an unverified Complainant can put up a security bond before filing a complaint, and to that extent that bond could also represent security if the Complainant loses, albeit the Complainant themselves may not be who they say they are. [by the way, I do like the idea of posting security bonds, but not in the manner that the proposals have suggested --- I would want security bonds as a means for registrants to completely *opt-out* of URS/UDRP, so that any disputes for a "bonded" registrant/domain can be handled only by the courts] Even the real legal system (court system) could be subject to attempts at foul play using these kinds of tricks. However, real courts have much stronger due process mechanisms and machinery (e.g. court orders, contempt, etc.) to deal with them (e.g. subpoena the registrar who enabled the identity theft, discovery, etc.) and the real victim would have to be properly served, etc.. URS/UDRP providers don't have those strong mechanisms or powers. So, I'm very sympathetic to the motivation behind these proposals, and the objective to go after the bad guys. I want loser pays too, in order to protect my company from frivolous complaints. I know others with valuable domains want the same thing. But, the proposals on the table right now will need much, much more work before I can support them. All the various vulnerabilities that are present in the system *today* will be magnified if "loser pays" or "penalties" are adopted without addressing issues like verification and identity theft first. Sincerely, George Kirikos 416-588-0269 http://www.leap.com/ P.S. I don't know if we have any SSAC members on this PDP, but the broader issue of vulnerabilities and identity theft might be passed on to them for advice.

2 1

URS Proposal Submissions - 06 Sep 2018 & Final Count
by Ariel Liang Sept. 7, 2018

Sept. 7, 2018

Dear RPM WG members, This is to let you know that fourteen (14) URS Proposals were submitted by COB today (06 Sep 2018). Today is the deadline for individual WG members to submit Proposals for URS policy and operational recommendations. The SurveyMonkey form has been closed. By the deadline, thirty-three (33) URS Proposals have been submitted. You may see all the Proposals uploaded to the wiki page here: https://community.icann.org/x/aACNBQ Best Regards, Mary, Julie, Ariel & Berry

1 0

Correction: URS Proposal Submissions - 05 Sep 2018
by Ariel Liang Sept. 6, 2018

Sept. 6, 2018

Dear All, Correction – yesterday (05 September 2018), Kristine Dorrain submitted one (1) URS Proposal and George Kirikos submitted five (5) URS Proposals. Staff erroneously mentioned Zak. Apologies for the confusion. Best Regards, Mary, Julie, Ariel & Berry From: Ariel Liang <ariel.liang(a)icann.org> Date: Wednesday, September 5, 2018 at 9:31 PM To: "gnso-rpm-wg(a)icann.org" <gnso-rpm-wg(a)icann.org> Subject: URS Proposal Submissions - 05 Sep 2018 Dear RPM WG members, This is to let you know that George Kirikos submitted five (5) URS Proposals and Zak Muscovitch submitted one (1) URS Proposal by COB today (05 Sep 2018). You may see the proposals uploaded to the wiki page here: https://community.icann.org/x/aACNBQ Best Regards, Mary, Julie, Ariel & Berry

1 0

Re: [gnso-rpm-wg] URS / UDRP proposals -- data on registrar/registry compliance costs
by George Kirikos Sept. 6, 2018

Sept. 6, 2018

Hi Maxim, On Thu, Sep 6, 2018 at 4:10 AM, Maxim Alzoba <m.alzoba(a)gmail.com> wrote: > These days, criminals interact on purely economical basis, and weakened > interaction between Yes, that's a very important point that should not be lost in all this debate. The URS and UDRP don't really attack the economic aspect of cybercrime (including cybersquatting) very well, in my opinion. That's why the Verizon/iREIT lawsuit was so effective (as previously discussed on this mailing list), as was as the Verizon/OnlineNic case: https://www.nytimes.com/2008/12/25/technology/companies/25verizon.html https://www.theregister.co.uk/2009/08/27/onlinenic_verizon_ruling_upheld/ Remember that scene from Batman? https://www.youtube.com/watch?v=DJS7NaktQ8g "I want you to tell all your friends about me." Those highly publicized cases told active and prospective cybersquatters all about Verizon, and not to mess with them. I'm sure many cybersquatters cleared out their portfolios of anything Verizon-related due to these actions. We've also seen evidence of the decline in the profitability of cybersquatting by looking at how many UDRP cases CitizenHawk has filed over time: http://www.udrpsearch.com/search?query=citizenhawk&search=text&results=100&… Just 3 cases in 2018 so far. As many members of this PDP are likely already aware, they file UDRPs on behalf of companies at no cost up front, but in exchange they monetize the traffic from the domains that are won: https://icannwiki.org/CitizenHawk The fact that we've seen such a sharp decline in cases they've brought is consistent with the fact that cybersquatting is less profitable than it used to be, because the problem has been addressed in other ways (e.g. getting domains banned at various monetization services like Google Adsense or parking companies, affiliate programs, credit card processors, hosting companies, Google Safebrowsing, etc.). CitizenHawk is driven purely by economics, so there are just fewer profitable typosquatting domains out there that they can successfully target via their business model. In conclusion, consistent with your statement, attacking the economics of cybercrime in more targeted manner (to deter the practice because it's simply unprofitable) is far more effective than to try to "punish" the criminals with a "weak" domain transfer (UDRP) or suspension (URS). The biggest criminals tend to be highly rational economic actors, otherwise they don't survive in "business" very long. Sincerely, George Kirikos 416-588-0269 http://www.leap.com/

1 1

URS Proposal Submissions - 05 Sep 2018
by Ariel Liang Sept. 6, 2018

Sept. 6, 2018

Dear RPM WG members, This is to let you know that George Kirikos submitted five (5) URS Proposals and Zak Muscovitch submitted one (1) URS Proposal by COB today (05 Sep 2018). You may see the proposals uploaded to the wiki page here: https://community.icann.org/x/aACNBQ Best Regards, Mary, Julie, Ariel & Berry

1 0