Group to seek .io TLD takeover after OECD human rights ruling

A group composed of displaced Chagossians will ask ICANN to redelegate the increasingly popular .io top-level domain, according to the group’s lawyer.

The move, still in its very early stages, follows a recent ruling under the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct, which mildly chastised the current registry, Identity Digital.

“The next move is domain reassignment,” lawyer Jonathan Levy, who brought the OECD complaint on behalf of the Chagos Refugees Group UK, told us. The proposed beneficiary would be “a group composed of Chagossians” he said.

.io is the ccTLD for the archipelago currently known as the British Indian Ocean Territory. It’s one of those Postel-era “Just Some Guy” developing-world delegations that pre-date ICANN.

But BIOT is a controversial territory. Originally the Chagos Archipelago, the few thousand original inhabitants were forced out by the UK government in the 1970s so the US military could build a base on Diego Garcia, the largest island.

Most of the surviving Chagossians and their descendants live in Mauritius, but have been fighting for their right to return for decades. In 2019, the UN ruled the UK’s current administration of BIOT is unlawful.

In recent years, since .io became popular, the ccTLD has become part of the fight.

The original and technically still-current registry for .io is a UK company called Internet Computer Bureau. ICB was acquired by Afilias in 2017 for $70 million. Afilias was subsequently acquired by Donuts, which is now called Identity Digital.

Corporate accounts filed by ICB name its ultimate owner as Beignet DTLD Holdings of Delaware, which appears to be a part of $2.21 billion private equity firm Ethos Capital, Identity Digital’s owner, which is co-managed by former ICANN CEO Fadi Chehadé.

None of these companies have a connection to BIOT beyond paying a local company called Sure (Diego Garcia) Limited for a mail-forwarding service. The only people believed to reside in the territory at all are US and UK military and contractors.

Levy, on behalf of the Chagossian refugees and a group of victims of cryptocurrency scams operated from .io domains, filed a complaint with the Ireland National Contact Point for the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct — basically a mediation service operated by the Irish government — seeking a share of the money from .io sales and/or redelegation.

According to its most-recent public accounts, ICB had turnover of £16.4 million ($19.8 million) in 2021, up from £12.8 million ($15.5 million) in 2020, but also had absolutely horrible gross margins for a registry with only one employee.

The company had cost of sales of £15.8 million and a gross margin of 3.58%. It pays no ICANN fees and the UK government receives no cut beyond the regular corporate tax ICB pays (about £26,000 in 2021).

The OECD’s Guidelines are voluntary guidelines that countries sign up to that are meant to guide how multinational companies behave with regards human rights and so on. Enforcement seems to be relatively toothless, with national NCPs only having the power to “recommend” actions.

In fact, Afilias declined to participate in mediation and appears to have received only a mild finger-wagging in the Irish NCP’s decision (pdf), which was published in September. One of its recommendations reads:

The NCP recommends that in cases in which a product, including a digital asset, is associated with long-running disputes regarding human rights, multinational enterprises should be able to demonstrate that they have carried out human rights due diligence

Levy thinks the NCP’s decision is a big deal, saying it means the OECD has validated the Chagossians’ concerns. Coupled with the UN sanction on the UK related to BIOT, he reckons it could play in their favor in a future redelegation request.

.io domain owners shouldn’t be too worried right now, however. Redelegation takes a very long time even when the losing party agrees, and it doesn’t tend to happen without the consent of the incumbent.

Namecheap says it won legal fight over .org price caps

Namecheap claims to have won a fight against ICANN over the lifting of contractual price caps in .org and .info back in 2019.

The two parties have been battling it out for almost three years in an Independent Review Process case over ICANN’s decision to allow the .info and .org registries to increase their prices by as much as they want.

Namecheap now claims the decision has been delivered and “the IRP panel decided that ICANN had, indeed, violated its Bylaws and Articles of Incorporation and that ICANN’s decision to remove the price caps was invalid.”

The registrar also says it failed in its attempt to have a similar ruling with regrds the .biz TLD, but it’s not clear why.

Neither party has yet published the decision in full (ICANN is likely redacting it for publication as I type), and ICANN has yet to make a statement, so we only have Namecheap’s interpretation to go on.

It seems the IRP panel disagreed with ICANN that it was within its staff’s delegated powers to renegotiate the price provisions of the contracts without input from the board of directors.

Rather, there should be a open and transparent process, involving other stakeholders, for making such changes, the panel said according to Namecheap.

What the panel does not appear to have said is that the price caps can be unilaterally restored to the contracts. Rather, it seems to suggest a combination of voluntary reinstatements, expert competition reviews, and bilateral renegotiations.

The decision also seems to say that price controls are more important in .org than .info, due to its not-for-profit nature, which flies in the face of ICANN’s long-term push to standardize its contracts to the greatest extent possible.

The row over .org pricing emerged shortly before the ultimately unsuccessful takeover attempt of Public Interest Registry by for-profit private equity firm Ethos Capital was announced. Ethos had planned to raise prices, but PIR, still a non-profit owned by the Internet Society, to date has not.

Namecheap’s IRP claims related to ICANN’s handling of that acquisition attempt were thrown out in 2021.

.info was an Afilias TLD when the IRP was filed but is now Ethos-owned Identity Digital’s biggest gTLD following consolidation.

I’ll have more on this story after the full decision is made public.

ICANN waves off EFF concerns about the Ethos-Donuts deal

ICANN has dismissed concerns from the Electronic Frontier Foundation about the recent acquisition of Donuts by Ethos Capital.

Responding to a letter from EFF senior attorney Mitch Stoltz, ICANN chair Maarten Botterman said the deal had been thoroughly reviewed according to the necessary technical and financial stability standards.

In reviewing this transaction, the ICANN org team completed a thorough review and analysis of information provided by Ethos Capital and Donuts. Based on the review, the ICANN org team concluded that Donuts, as controlled by its proposed new owners would still meet or exceed the ICANN-adopted specifications or policies on registry operator criteria in effect, including with respect to financial resources, operational and technical capabilities, and overall compliance with ICANN’s contracts and Consensus Policies. Before its final decision on the matter, ICANN org provided multiple briefings to the Board. Following its final briefing and discussion with the Board, ICANN org approved the change of control in late March 2021.

The EFF had claimed that the anti-abuse parts of Donuts various registry agreements amounted to giving Donuts the right to “censor” domains, and it took issue with the Domain Protected Marks List domain blocking service.

Botterman noted that these predate the Ethos acquisition and were not reviewed.

Prior to the deal, which closed in March, Donuts was owned by another PE firm, Abry Partners. ICANN CEO Göran Marby had previously expressed puzzlement that the acquisition to lead to such concerns.

Price caps on .org could return, panel rules

ICANN could be forced to reimpose price caps on .org, .biz and .info domains, an Independent Review Process panel has ruled.

The panel handling the IRP case filed by Namecheap against ICANN in February 2020 has decided to allow the registrar to continue to pursue its claims that ICANN broke its own bylaws by removing price controls from the three gTLD contracts.

Conversely, in a win for ICANN, the panel also threw out Namecheap’s demand that the IRP scrutinize ICANN’s conduct during the attempted takeover of .org’s Public Interest Registry by Ethos Capital in 2019.

The split ruling (pdf) on ICANN’s motion to dismiss Namecheap’s case came March 10 and was revealed in documents recently published by ICANN. The case will now proceed on the pricing issue alone.

The three-person panel decided that the fact that ICANN ultimately decided to block Ethos’ acquisition of PIR meant that Namecheap lacked sufficient standing to pursue that element of its case.

Namecheap had argued that ICANN’s opaque processing of PIR’s change of control request created uncertainty that harmed its business, because ICANN may approve such a request in future.

But the panel said it would not prejudge such an eventuality, saying that if another change of control is approved by ICANN in future, Namecheap is welcome to file another IRP complaint at that time.

“Harm or injury flowing from possible future violations by the ICANN Board regarding change of control requests that are not presently pending and that may never occur does not confer standing,” the panel wrote.

On the pricing issue, the panel disagreed with ICANN’s argument that Namecheap has not yet been harmed by a lack of .org price caps because PIR has not yet raised its .org prices.

It said that increased prices in future are a “natural and expected consequence” of the lack of price controls, and that to force Namecheap to wait for such increases to occur before filing an IRP would leave it open to falling foul of the 12-month statute of limitations following ICANN decision-making baked into the IRP rules.

As such, it’s letting those claims go ahead. The panel wrote:

This matter will proceed to consideration of Namecheap’s request for a declaration that ICANN must annul the decision that removed price caps in the .org, .info and .biz registry agreements. The Panel will also consider Namecheap’s request for a declaration that ICANN must ensure that price caps from legacy gTLDs can only be removed following policy development process that takes due account of the interests of the Internet user and with the involvement of different stakeholders. The Panel will consider Namecheap’s request for a declaration that “registry fees… remain as low as feasible consistet with the maintenance of good quality service” within the context of removal of price caps (not in the context of regulating changes of control).

In other words, if Namecheap prevails, future price caps for pre-2012 gTLDs could be decided by the ICANN community, with an assumption that they should remain as low as possible.

That would be bad news for PIR, as well as .info registry Donuts and .biz registry GoDaddy.

But it’s important to note that the IRP panel has not ruled that ICANN has done anything wrong, nor that Namecheap is likely to win its case — the March 10 ruling purely assesses Namecheap’s standing to pursue the IRP.

The panel has also significantly extended the proposed timeline for the case being resolved. There now won’t be a final decision until 2022 at the earliest.

The panel last week delayed its final hearing in the case from August this year to January next year, according to a document published this week.

Other deadlines in the case have also been pushed backed weeks or months.

EFF rages as Ethos closes Donuts buy

The Electronic Frontier Foundation thinks the acquisition of Donuts by “secretive” private equity group Ethos Capital represents a risk to free speech.

The deal, which sees Ethos buy a controlling stake from fellow PE firm Abry Partners, closed earlier this week, having apparently received no official objection from ICANN.

But the EFF now wants ICANN to force Donuts to change its gTLD registry contracts to make it harder for the company to engage in what it calls “censorship-for-profit”.

The group’s senior staff attorney, Mitch Stoltz, raised the issued at the Public Forum session of last week’s ICANN 70 virtual public meeting, and expanded upon his thinking in a blog post this week. He wrote:

Donuts already has questionable practices when it comes to safeguarding its users’ speech rights. Its contracts with ICANN contain unusual provisions that give Donuts an unreviewable and effectively unlimited right to suspend domain names—causing websites and other internet services to disappear.

He pointed to Donuts’ trusted notifier program with the Motion Picture Association, which streamlines the takedown of domains used for pirating movies, as an example of a registry’s power to censor.

Donuts runs gTLDs including ones with social benefit meanings that the EFF is particularly concerned about, such as .charity, .community, .fund, .healthcare, .news, and .university.

Stoltz also makes reference to the Domain Protected Marks List, a Donuts service that enables trademark owners to block their marks, and variants, across its entire portfolio of 240+ gTLDs.

In effect, this lets trademark holders “own” words and prevent others from using them as domain names, even in top-level domains that have nothing to do with the products or services for which a trademark is used. It’s a legal entitlement that isn’t part of any country’s trademark law, and it was considered and rejected by ICANN’s multistakeholder policy-making community.

The DPML is not unique to Donuts. Competitors such as UNR and MMX have similar services on the market for their gTLDs.

When Stoltz raised the EFF’s concerns at last week’s ICANN meeting, CEO Göran Marby basically shrugged them off, saying he didn’t understand why one PE firm buying an asset off another PE firm was such a big deal.

I have to say I agree with him.

Ethos came under a lot of scrutiny last year when it tried to buy .org manager Public Interest Registry, turning it into a for-profit entity, generating cash for Ethos’ still-undisclosed backers.

(This week, Ethos disclosed in a press release that its investors include massive hedge funds The Baupost Group and Neuberger Berman “among others”, which appears to be the first time these names have been mentioned in connection with the company).

But a pretty good case could be made that .org is a unique case, that has had a non-profit motive baked into its DNA for decades. That does not apply to Donuts, which was a profit-making venture from the outset.

It’s not entirely clear why the EFF is suddenly concerned that Donuts will start exercise its contractual right-to-suspend more frequently under Ethos than under Abry. Stoltz wrote:

As we learned last year during the fight for .ORG, Ethos expects to deliver high returns to its investors while preserving its ability to change the rules for domain name registrants, potentially in harmful ways. Ethos refused meaningful dialogue with domain name users, instead proposing an illusion of public oversight and promoting it with a slick public relations campaign. And private equity investors have a sordid record of buying up vital institutions like hospitals, burdening them with debt, and leaving them financially shaky or even insolvent.

Even with the acquisition passing through ICANN easily, the EFF wants Donuts to change its contracts to make it more difficult for the company to suspend domain names on a whim.

I believe the language causing the controversy comes from anti-abuse policies in the Public Interest Commitments found in almost all Donuts’ contracts with ICANN, which state in part:

Registry Operator reserves the right, at its sole discretion and at any time and without limitation, to deny, suspend, cancel, or transfer any registration or transaction, or place any domain name(s) on registry lock, hold, or similar status as it determines necessary for any of the following reasons:

a. to protect the integrity and stability of the registry;

b. to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process;

c. to comply with the terms of this Registry Agreement and the Registry Operator’s Anti-Abuse Policy;

d. registrant fails to keep Whois information accurate and up-to-date;

d. domain name use violates the Registry Operator’s acceptable use policies, or a third party’s rights or acceptable use policies, including but not limited to the infringement of any copyright or trademark; or

e. as needed during resolution of a dispute.

As a voluntary PIC, this language is unique to Donuts, though other registries have similar provisions in their registry agreements.

One year on, Namecheap still fighting aborted .org takeover and may target GoDaddy and Donuts next

Even though Ethos Capital’s proposed takeover of Public Interest Registry was rejected last May, registrar Namecheap is still doggedly pursuing legal action against ICANN’s handling of the deal, regardless.

The Independent Review Process complaint filed last February is still active, with Namecheap currently fighting a recent ICANN motion to dismiss the case.

The company is also demanding access to information about GoDaddy’s acquisition of Neustar and Donuts’ acquisition of Afilias, and is threatening to file separate actions related to both those deals.

Namecheap has essentially two beefs with ICANN. First, that it should not have lifted price caps in its .org, .biz and .info registry contracts. Second, that its review of Ethos’ bid for PIR lacked the required level of transparency.

ICANN’s trying to get the IRP complaint thrown out on two fairly simple grounds. First, that Namecheap lacks standing because it’s failed to show a lack of price caps have harmed it. Second, that it rejected the PIR acquisition, so Namecheap’s claims are moot.

In its motion to dismiss (pdf), its lawyers wrote:

Namecheap’s entire theory of harm, however, is predicated on the risk of speculative future harm. In fact, nearly every explanation of Namecheap’s purported harm includes the words “may” or “potential.” Namecheap has not identified a single actual, concrete harm it has suffered.

…

Namecheap’s claims related to the Change of Control Request should be dismissed because ICANN’s decision not to consent to the request renders these claims moot
and, separately, Namecheap cannot demonstrate any harm resulting from this decision.

In December, Namecheap had submitted as evidence two analyses of its business prospects in the event of registry price increases, one compiled by its own staff, the other prepared by a pair of outside expert economists.

While neither shows Namecheap has suffered any directly quantifiable harm, such as a loss of revenue or customers, Namecheap argues that that doesn’t matter and that the likelihood of future harm is in fact a current harm.

A mere expectation of an increase in registry prices is sufficient to show harm. This is because such expectation reduces Namecheap’s expected profits and its net present value.

It further argues that if Namecheap was found to not have standing, it would give ICANN the ability to evade future IRP accountability by simply adding a 12-month delay to the implementation of controversial decisions, pushing potential complainants outside the window in which they’re able to file for IRP.

On the PIR change of control requests, Namecheap says it’s irrelevant that ICANN ultimately blocked the Ethos acquisition. The real problem is that ICANN failed in its transparency requirements related to the deal, the company claims.

The fact that ICANN withheld its consent is no excuse for refusing to provide full transparency with respect to the actions surrounding the proposed acquisition and ICANN’s approval process. Namecheap’s claims relate to the non-transparent process; not the outcomes of such process. Irrespective of the outcome, lack of transparency increases the level of systemic risk in Namecheap’s business environment.

…

How did ICANN come to its decision? Was an imminent request for a change of control known to ICANN, when it took the decision to remove the price control provisions? What was discussed in over 30 hours of secret meetings between ICANN org and the Board? What discussions took place between ICANN, PIR and other entities involved? All these questions remain unanswered

Namecheap refers to two incidents last year in which ICANN hid its deliberations about industry acquisitions by conducting off-the-books board discussions.

The first related to the PIR deal. I called out ICANN for avoiding its obligation to provide board meeting minutes in a post last May.

The second relates to the board’s consideration of Donuts’ proposed (and ultimately approved) acquisition of Afilias last December. Again, ICANN’s board discussed the deal secretly prior to its official, minuted December 17 meeting, thereby avoiding its transparency requirements.

In my opinion, this kind of bullshit has to stop.

Namecheap is also now threatening to bring the Afilias deal and GoDaddy’s acquisition of Neustar’s registry business last April into the current IRP, or to file separate complaints related to them, writing in its response to ICANN’s motion (pdf):

Namecheap seeks leave to have ICANN’s actions and inactions regarding its consideration of the Neustar and Afilias changes of control reviewed by this IRP Panel. If, per impossibile such leave is not granted, Namecheap reserves all rights to initiate separate proceedings on these issues.

The deals are similar because both involve the change of control of legacy gTLD contractors with millions of domains under management that have recently had their price caps lifted — Afilias ran .info and Neustar ran .biz.

ICANN dissenter explains why she wanted .org sale approved

ICANN has finally published the dissenting statement made by one of its directors following the vote to deny Ethos Capital the right to acquire Public Interest Registry from the Internet Society.

Avri Doria was one of only two directors to vote against the majority on the April 30 resolution, and the only one to file a written statement for the record, which ICANN has now published (pdf). It reads:

Briefly, I believe that the contractual conditions have been met by PIR and Ethos and that they have gone beyond these required contractual conditions to offer significant public interest commitments currently missing from the current contract.

On balance after intense study of the proposal I have come to conclusion that the Public Interest of registrants and users is better served by the PICs offered by PIR, though they could
be stronger, than by forcing PIR to remain within ISOC without any guarantees on public interest related to data usage and freedom of expression.

In exchange for ICANN approval of the deal, Ethos had promised to cap its price increases at 10% for eight years and to create a largely independent stewardship council to monitor issues related to privacy and free speech in .org.

With ICANN voting to deny the acquisition, PIR is not required to live up to those commitments, but opponents of the deal feel that its not-for-profit status under ISOC control provide stronger protections against bad behavior.

ICANN said it rejected the deal on “public interest” grounds for a variety of reasons including the lack of transparency into Ethos’ ultimate ownership, distrust that Ethos would be able to service its debt, doubt over its management in the long term, and the sheer volume of dissent from the community.

Also playing a strong role was an objection from the California attorney general, who pulled rank and informed ICANN that it should reject the deal, reminding the organization that it was subject to his oversight. This has been described as a dangerous precedent.

ICANN’s .org decision was NOT unanimous, and it was made in secret

When ICANN announced its decision to deny Public Interest Registry’s request to be acquired by Ethos Capital at the end of April, I felt a little foolish.

I’d confidently predicted just days earlier that the decision by the board would not be unanimous, but ICANN, in announcing the decision, said “the entire Board stands by this decision”.

But it turns out I was right after all. Three directors voted against the consensus and one abstained.

The dissenting votes were cast by industry policy consultant Avri Doria, Serbian internet pioneer Danko Jevtović, and former Sudanese ccTLD operator Ihab Osman.

Doria and Jevtović voted against the first resolved clause, which rejected PIR’s request. All three voted against the second resolved clause, which would have allowed PIR to file a second request.

Sarah Deutsch, a private practice lawyer, abstained from both votes, presumably because she also sits on the board of the Electronic Frontier Foundation, the civil liberties group that can, via California’s attorney general, probably be credited most with getting the transaction killed.

All three dissenters and Deutsch are Nominating Committee appointees.

According to the preliminary report of the April 30 meeting, “Doria indicated that she would be voting against the resolution and explained her views about how the public interest would be better served by ICANN granting its consent to PIR’s request.”

What her reasons were are not reflected in the record.

It also seems likely that any substantive minuting of ICANN’s decision is likely to be limited, as it appears to have been made at a different, off-the-books session at an unspecified earlier date.

The preliminary report notes the “the Board discussed and considered alternative draft resolutions for potential Board action as part of an earlier briefing”.

No such earlier meeting is listed on ICANN’s web site. The board’s previous formal meeting, two weeks earlier, had PIR’s request removed from the agenda at the last minute.

So it appears that ICANN’s board decided to reject the deal basically in secret at some point between April 17 and April 29, during a meeting of which ICANN has no obligation to publicly release the minutes.

Nice transparency loophole!

There’s always the Documentary Information Disclosure Policy, I suppose.

.org sale officially dead

Public Interest Registry has formally announced that its proposed $1.13 billion acquisition by Ethos Capital is dead.

The company told ICANN yesterday that it is withdrawing its request for a change of control under its .org contract and that it “will not be pursuing an ICANN Request for Reconsideration or taking any other action to try to revive the Transaction”.

In a statement, CEO Jon Nevett said that PIR is no longer for sale to any other party. It will remain under the Internet Society’s control.

He also pointed out that it’s not within ICANN’s power to arbitrarily transfer .org to another registry, as some critics have called for.

“Such a transfer by ICANN is a contractual impossibility under our registry agreement,” he wrote.

ICANN rejected the change of control request after deciding it was not in the public interest for .org to pass into for-profit hands.

Following the decision, ISOC had indicated that PIR was no longer for sale.

The .org deal may be dead and buried, but calls remain for PIR to lose its contract

The Internet Society has revealed that the .org registry operator PIR is no longer for sale.

The news came in a statement from ISOC chair Andrew Sullivan late Friday, less than 24 hours after ICANN withheld its consent for the proposed $1.13 billion acquisition by private equity firm Ethos Capital.

ICANN had held the door open for Ethos and ISOC to resubmit a change of control request, and Ethos had said Thursday that it was evaluating its options, but it appears the decision has been made to keep PIR under ISOC’s wing.

In his statement, Sullivan expressed his dismay that ICANN had acted as a “regulator” by evaluating the deal using a public interest test rather than simply rubber-stamping it as it has in all other cases of registry acquisitions. He wrote:

It should concern the Internet community that ICANN has shown itself to be much more susceptible to political pressure than its limited mandate would recommend.

…

Now that we know that ICANN believes its remit to be much larger than we believe it is, we can state this clearly: neither PIR nor any of its operations are for sale now, and the Internet Society will resist vigorously any suggestion that they ought to be.

But who would want to, or could afford to, buy it? While ICANN has made it clear that PE firms are welcome to acquire other TLDs, it wants .org to remain in non-profit hands.

During the last few months of controversy, one other embryonic effort to take over .org was announced, led by founding ICANN chair Esther Dyson.

Called the Cooperative Corporation of dot-org Registrants (CCOR), it had no intention of handing over a billion dollars for .org, it simply wanted ICANN to assign the contract to its control.

It still wants that, or something like that. In a statement Saturday, CCOR said it “calls upon ICANN to proceed with the established multi-stakeholder led open request for proposals for stewardship of the dot-org domain”.

Unless it can be shown that PIR has seriously broken the terms of its Registry Agreement, the chances of ICANN randomly opening up .org to tender is pretty much zero.

CCOR goes on to say that it is still worried about .org falling into private hands and that it will lobby for legally binding policies “including the preservation of privacy, diversity and human rights, and freedom from censorship”.