Generally speaking, the "Add Grace Period" (AGP) should be a net
positive benefit for users (i.e. if you make a typo when you register a
name, your registrar can fix it for you). However, most AGP exploits
heavily dilute the public benefit aspect of the AGP. Some have likened
AGP exploitation to strip mining in that they consume vast amounts of
resources to extract a very small benefit for a highly limited number of
actors.
Earlier today, I realized that most current AGP exploits (kiting,
tasting and their kin) would seem to be in violation of section 3.4.7 of
the Registrar Accreditation Agreement as I outlined below to a post to
the registrar constituency.
If this is the case, shouldn't we be pushing for proactive enforcement
of these types of clauses? I have heard in the past that enforcement is
difficult because ICANN staff only have the capability to de-accredit
registrars as a penalty, which might be an overly harsh penalty in most
cases. On the other hand, I'm aware that some country code registries
faced with the similar option have made enforcement penalties a menu of
possibilities that the registrar can choose from insttead of facing
de-accreditation (i.e. "you can choose to pay the optional $5000 fine
and if you do, we'll take de-accreditation off the table"). Wouldn't
these types of solutions allow ICANN to start enforcing their contracts
now? I mean, there is nothing better than a carefully documented
sanctions program that has explicit enforcement hooks in the contracts,
but why do we have to wait for that perfect state? It seems to me that
ICANN is choosing not to enforce its contracts and in the meantime, the
general public is getting worked over by those who choose to ignore the
terms of their deal with ICANN.
Copied below is my message to the RC regarding the AGP exploits and the
clauses of the contract that should explicitly deal with these issues
already.
I'd be interested in other views on ICANN's enforcement of these clauses
and whether or not we need to wait for a PDP to conclude before we get
action on these issues.
-ross
-------- Original Message --------
Subject: Re: [registrars] OUTCOMES REPORT OF THE GNSO AD HOC GROUP ON
DOMAIN NAME TASTING
Date: Wed, 03 Oct 2007 12:13:52 -0400
From: Ross Rader <ross(a)tucows.com>
Reply-To: ross(a)tucows.com
Organization: Tucows Inc.
CC: Registrars Constituency <registrars(a)gnso.icann.org>
References: <200710031500.l93Exixs012158(a)pechora2.lax.icann.org>
Robert F. Connelly wrote:
> Dear Registrars:
>
> The following is the present draft of the "Outcomes Report". It
deals with uses
> of the AGP other than domain tasting.
<snip>
Isn't this practice...
> On the other hand, there are some registrars that have created a cart
reserve
> process utilizing the AGP, that immediately adds the domain at the
registry once
> it gets looked up by the user. This completely mitigates the issue of
the domain
> being otherwise provisioned by another while completing the sales
process. If
> the sales process is not completed, or nearly 5 days passes, the
domain is
> deleted at the registry.
...a violation of provision 3.7.4 [1] of the RAA? No reasonable
assurance of payment has been secured in any way for these types of
transactions.
Furthermore, couldn't the whole issue of kiting and tasting be addressed
through proper enforcement of this clause? I mean, in 99.999% (or
whatever the sickly high number is) of tasting transactions, there is no
reasonable assurance of payment by a registrant. By definition, the
customer knows that they won't have to pay for those transactions. Why
do we need a PDP to deal with this when there is clearly sufficient room
in the current contract for ICANN to deal with the practice?
I can understand wanting to tighten up the agreement after it has been
demonstrated that enforcement has proven difficult or inefficient, but
I'm not aware that this clause has *ever* been enforced.
I've requested that the GNSO Chair ask staff for more information
regarding their enforcement of this clause and whether or not it is, or
could be, an effective hedge against AGP abuse in practice.
-ross
[1] RAA 3.7.4 Registrar shall not activate any Registered Name unless
and until it is satisfied that it has received a reasonable assurance of
payment of its registration fee. For this purpose, a charge to a credit
card, general commercial terms extended to creditworthy customers, or
other mechanism providing a similar level of assurance of payment shall
be sufficient, provided that the obligation to pay becomes final and
non-revocable by the Registered Name Holder upon activation of the
registration.
Robert F. Connelly wrote:
> Dear Registrars:
>
> The following is the present draft of the "Outcomes Report". It deals with uses
> of the AGP other than domain tasting.
>
> It is a redlined version and I see that the redlined elements did not survive my
> cut and paste efforts.
>
> Regards, BobC
>
>
>
> *4.3Opinion Polling of Registrars regarding use of AGP
>
>
> *Following statements within the group that the AGP was sometimes used by
> registrars for other purposes, not connected to domain tasting or corrections of
> misspelled names, the question was raised to some registrars to exemplify their
> uses of the AGP. Below is an excerpted, edited version of the submission
> provided by the registrar representatives in the group, the complete submission
> is in Annex __:
>
>
> The RFI regarding the use of AGP posed three different options to consider in
> remedying the current abuses in AGP: (1) making the ICANN fee non-refundable;
> (2) requiring some form of restocking fee per name deleted within the AGP term;
> and (3) eliminating the AGP in its entirety.
>
>
>
>
> [In a straw poll [please provide for an Annex] sent to [how many, and how many
> responded? Provide responses for Annex.] registrars to comment on what the
> impact would be to their registrants were AGP to be eliminated in its entirety,
> certain [how many? Who?] registrars indicated that they were using the AGP for
> customers in a beneficial manner. All of these registrars believed that the
> elimination of AGP would break their cart or provisioning systems or monitoring,
> and would require significant re-engineering to re-architect their registrar
> systems should there be an elimination of AGP.]
>
>
> [The concept of eliminating the AGP in its entirety is of concern to some
> registrars who utilize the AGP in ways other than tasting or kiting to provide a
> high quality of service to their registrants, including by:]
>
>
> 1.Correcting typographical errors made by the registrant
>
> 2.Using a cart ?hold? system to provide access to names
>
> 3.Mitigating fraud impacts; and
>
> 4.Proactively monitoring the security and stability of their provisioning
> systems and customer experience.
>
>
> [Two of the identified uses [which two? Identify briefly.] were considered
> proprietary, which required some generalization to where the polled registrar
> was not identifiable specifically and the respondent was comfortable with
> supplying it in response.]
>
>
> [Some registrars felt that the complete elimination of the AGP would miss the
> importance of these benefits which are completely separate and distinct from
> tasting or kiting. A description of each of these benefits and a review of how
> the two other measures proposed for curing the abuses of the AGP, making the
> ICANN fee non-refundable or requiring some form of restocking fee per name
> deleted within the AGP term, follows.]
>
> [It should be considered that the response to the RFI from registrants is
> generally formed largely by the experience that they have with their registrar.
> Registrants are presented by their registrar (or registrar reseller) with a
> ?front end? consisting of web based ?shopping carts? or portals to register or
> manage their domain names, host records, email, web hosting, blogs, etc. in the
> interests of simplifying the process and streamlining the user experience. Most
> registrants are sheltered from the confusing world of the provisioning protocols
> and technical aspects or business rules of policy that registrars face, and as
> such may not appreciate some of the other issues registrars face and how the AGP
> helps address certain of those issues. ]
>
>
> _AGP Use 1: Correction of typographical errors made by registrant
>
> _Whatever the source of the typographical mistake the registrant seems to make,
> typographical mistakes do happen, and the AGP is used by many registrars to
> remedy this situation.
>
>
> At last count, there are now more than 900 ICANN-accredited registrars. This has
> caused intense competition for customers, and has driven down margins in some of
> the price competitive registrars. Price sensitive customers have found
> registrars that service their needs, but there are also registrants who are more
> service sensitive than price sensitive, who demand a higher standard of
> experience from their registrar.]
>
> Because there are so many registrars, there is competition to differentiate
> themselves to the marketplace. Some registrars provide very high levels of
> customer service as a distinguishing feature. These registrars are extremely
> focused on the quality experience of the registrant, such that a phone call to
> the registrar?s customer service department can reverse a registration within
> the AGP, to correct a typographical error.]
>
>
>
>
> _AGP Use 2: Cart ?Hold? as an improved registration experience
>
> _[There are registrars that have raised the argument that the practice of domain
> tasting is creating a confusing user experience that is disruptive to their
> business. They believe that domain tasting generates volumes of customer
> complaints being fielded by their customer service departments, which contend
> that a domain was looked up and available for their company one day, and then
> approval or budget to proceed is obtained, only to find that within the time
> elapsed it had been registered by someone else.
>
>
> When one shops for something unique at a store, it is a common customer
> experience to see an item that interests a potential purchaser and that
> potential purchaser asks the sales clerk to set it aside while the purchaser
> continues to shop, or the purchaser leaves and comes back to confirm with a
> spouse, or goes to get some cash, etc. The item gets held for a period of time
> and presumably this is done so that nobody else can purchase it as though it was
> left on the shelf.
>
> Many registrars leave the item on the shelf, as it were, and only fully allocate
> the item upon completion of payment. This creates a circumstance where someone
> could conceivably purchase it elsewhere.
>
>
> On the other hand, there are some registrars that have created a cart reserve
> process utilizing the AGP, that immediately adds the domain at the registry once
> it gets looked up by the user. This completely mitigates the issue of the domain
> being otherwise provisioned by another while completing the sales process. If
> the sales process is not completed, or nearly 5 days passes, the domain is
> deleted at the registry.
>
> This process could be adopted by registrars that are concerned about customer
> confusion, but many of the registrars that compete on price and thus operate on
> thin profit margins will likely not adopt this approach because it means that
> their available funds at the registry are held in a non-sales transaction until
> it closes.
>
> As a matter of budget, most registrars opt to keep their balance available at
> the registry and not commit funds at the registry with the add command until a
> finalized purchase has completed with the registrant.
>
>
>
> _AGP Use 3: Fraud remedies
>
> _The AGP currently allows, in the event that fraud occurs, that domain names
> registered but still within the AGP can be returned for credit.
>
>
> Some of such types of fraud correction would be (but are not limited to):
>
> ?Recovering from activity where some bad actor stole registrar account
> credentials through phishing
>
> ?Remedy of credit card fraud, or
>
> ?Correctional efforts against a rogue reseller customer.
>
>
>
>
>
> _AGP Use 4: Proactive monitoring
>
> _[Many registrars take proactive steps to monitor and ensure the security and
> stability of their registration and resolution systems. This is done to provide
> quality service to their customers, to ensure high availability, or to meet
> dedicated service level agreements for their customers or resellers.
>
> Registrars use the AGP as a fundamental tool for proactive monitoring as a means
> to determine the health of their connections to the provisioning system of
> registries.
>
> Some of the registrars polled do this only when there is not typical
> registration activity to indicate system help.
>
>
> Some of the registrars do a simple EPP registration and deletion, others run a
> fairly comprehensive suite of tests combining EPP and DNS that involve
> registration, modification, and determination that DNS resolution changes also
> took effect prior to deleting the test name.
>
>
>
>
>
> Registrars indicated in their responses that they gratefully appreciate careful
> forethought, evaluation, and consideration of these other impacts should there
> be changes to business logic or provisioning logic, or provisioning systems as a
> part of any PDP. A forced or sudden change in the behavior of an EPP command or
> expected behavior of current provisioning systems, could take time and technical
> resources to implement, per GTLD, per registrar.
>
>
