Registrars could be held liable for US gun violence

A US presidential candidate has come out in support of amending the law to make domain name companies liable when customers use their services to incite violence.
Beto O’Rourke, a former member of Congress, stated last week that he wants to amend the Communications Decency Act to hold providers of “domain name servers” liable “where they are found to knowingly promote content that incites violence”.
He’s believed to be the first among the swarm of 2020 Democratic presidential hopefuls to lay out a plan to combat online hate speech.
The proposed amendments to Section 230 of the CDA are part of a sweeping package of reforms O’Rourke is proposing in order to tackle gun violence and domestic terrorism in the US.
He comes from El Paso, Texas, which was the target of a race-based terrorist attack a couple of weeks ago.
He’s also pushing for stricter gun controls, such as compulsory licensing and training.
But I’m not going to get into that stuff here. This is a blog about domain names. I’m British, so you can probably guess what my opinion on guns is.
In terms of online content, O’Rourke’s plan seems primarily aimed at getting the big social media platforms to more heavily moderate the content produced by their users.
But it specifically calls out domain name companies also:

Beto would require large internet platforms to adopt terms of service to ban hateful activities, defined as those that incite or engage in violence, intimidation, harassment, threats, or defamation targeting an individual or group based on their actual or perceived race, color, religion, national origin, ethnicity, immigration status, gender, gender identity, sexual orientation or disability. These companies also would be required to put in place systems designed to identify and act on content violating the terms of service. Platforms must be transparent when they block content and provide for an appeal process in order to guard against abuse.
…
Beto supports amending Section 230 of the CDA to remove legal immunity from lawsuits for large social media platforms that fail to change their terms of service and put in place systems as described above. Informational service providers of all sizes, including domain name servers and social media platforms, also would be held liable where they are found to knowingly promote content that incites violence.

Should registrars be worried about this?
If the legal test was that registrars “knowingly promote content that incites violence”, that seems like a pretty high bar.
I’m not convinced even Epik, which has come under fire for providing domain services to the likes of Stormfront and 8chan — both of which O’Rourke cites in his policy — “knowingly promotes” incitements to violence.
That’s not to say that registrars couldn’t find themselves prosecuted or sued anyway, of course.
O’Rourke is not a current front-runner in the Democrat presidential pack. While still in the race, he’s towards the bottom of the top 10, polls suggest.
What O’Rourke’s policy statement does suggest is that the regulation of online speech could become a significant issue in the 2020 election, and that the domain name industry in the US could find itself a political football in an extremely divisive game.

After more racist shootings, take one guess which registrar 8chan just switched to

Controversial web forum 8chan has moved its domain name to a new registrar after it was linked to at least one of the two mass shootings that occurred in the US over the weekend.
According to Whois records, it’s just jumped to racist-friendly Epik, having been registered at Tucows since 2003.
The switch appears to have happened in the last few hours. At time of writing, you’re going to get different results depending which Whois server you ping.
Some servers continue to report Tucows as the registrar of record, perhaps using cached data, but Epik’s result looks like this:

8chan is an image/discussion board that describes itself as “the Darkest Reaches of the Internet”. It’s reportedly heavily used by racists, extremists and those with an interest in child pornography.
It was widely linked by the media to the shooting in the border town of El Paso, Texas on Saturday, which claimed the lives of 20 people and left 26 more injured.
The suspect in the case reportedly posted to 8chan a 2,300-word racist “manifesto”, in which he ranted against Latino immigration, just 20 minutes before launching the attack.
This morning, Cloudflare announced that it would no longer provide denial-of-service attack protection for the web site, saying:

The rationale is simple: they have proven themselves to be lawless and that lawlessness has caused multiple tragic deaths. Even if 8chan may not have violated the letter of the law in refusing to moderate their hate-filled community, they have created an environment that revels in violating its spirit.

Google removed the site from its index a few years ago, due to allegations about child abuse material.
At this point, it’s not clear whether Tucows also ejected 8chan, or whether its owners decided to jump ship, perhaps sensing which way the wind is blowing.
Its new home, Epik, calls itself the “Swiss bank” of domain registrars, and has actively courted sites that enable far-right political views.
The registrar openly sought the business of Gab.com, the Twitter clone used largely by those who have been banned by Twitter, after GoDaddy suspended the site’s domain last November.
In March this year, Epik CEO Rob Monster came under fire for publicly doubting the veracity of the video of the mosque shootings in Christchurch, New Zealand, which killed 50 people.
8chan was also frequented by the perpetrator of that attack, among others.
Epik is described as “cornering the market on websites where hate speech is thriving”, according to the Southern Poverty Law Center, an anti-racist group.
Monster has said that he does not support the views of extremists, but merely wants to provide a platform where registrants can exercise their rights to free speech.

XYZ weighs into Epik controversy with .monster fundraising domain

New gTLD registry XYZ.com has set up a domain to help raise money for victims of the terrorist attack in Christchurch, New Zealand last week.
The domain is give.monster. It redirects to a page on Givealittle.co.nz, a Kiwi crowdfunding site, that has so far raised almost NZD 7.8 million ($5.3 million) for the victims of the attack, which killed 50 and injured many more last Friday.
Given the amount of coverage in the New Zealand press, it appears that the fundraising page is legit.
The domain is obviously a reference to Epik.com CEO Rob Monster, who has come in for criticism this week for hosting and sharing the terrorist’s video of the attack, and then suggesting it might be a hoax, as I blogged earlier today.
XYZ is able to create this domain because it is the registry for .monster, a gTLD it acquired last year that is currently slap-bang in the middle of its early access launch period.
Whois records show that the domain was created a little over an hour ago and belongs to XYZ.com LLC.
I learned about it through this comment on DI:

We are sorry to see this in our industry… Please visit http://www.Give.Monster and donate to support victims of the horrific Christchurch shootings. Thank you for your support.

XYZ.com is the registry for .xyz, .college, .rent and other gTLDs. .monster previously belonged to recruitment web site Monster.com.

After NZ shooting, Epik has a Monster PR problem

Domain name registrar Epik.com has come under fire from prominent domain investors and others after CEO Rob Monster suggested that video of the recent mosque shootings in New Zealand, which he hosted on an Epik service and shared on social media, was a hoax.
Domainer-bloggers including Shane Cultra, Konstantinos Zournas, and DNPlaybook.com have questioned Monster’s decision, and one of his own senior staffers, former DomainNameWire contributor Joseph Peterson, took to a domainer forum to in parts criticize and defend his boss.
Cultra was particularly harsh in his criticism this week, calling for domainers to move their domains out of Epik and for his friend, Epik director Braden Pollock, to remove himself from the board.
He wrote: “I would like to think that any respectable domain investor remove their domains from Epik… Rob Monster’s agenda has no place in our industry”.
DNPlaybook wrote that Monster has become “Facilitator of Hate and Promoter of Conspiracies”.
Other domainers have written that they have removed, or will remove, their domains from Epik, though Monster wrote earlier this week that the impact on its business so far has been minimal.
Epik is an ICANN-accredited registrar with about 400,000 gTLD names under management at the last count. It’s almost doubled in size over the last two years.
The company and its CEO have been subject to criticism for months over their decision to provide services to web sites that enable the promotion of far-right ideologies such as white supremacism and Nazism.
But the latest row kicked off on March 15, when Monster used his personal Twitter account to share a link to the self-shot, first-person video of one of the terrorist attacks at a mosque in Christchurch.
Fifty people, all Muslims attending Friday prayers or in the vicinity of the mosques, were killed by the same person during the attacks.
The first attack was live-streamed on Facebook from a head-mounted camera. Apparently viewed live by fewer than 200 people, copies were nevertheless widely circulated on social media and elsewhere.
The copy of the video linked to by Monster was hosted by Epik-owned privacy services provider Anonymize.com, on an “effectively uncensorable” file-sharing service the company is currently developing.
In a subsequent tweet, Monster threw doubt upon whether the footage was real, writing: “Shell casings simply vanish into thin air. Etc. It looks like low budget CGI”.
Anyone with a grain of common sense who has seen the video will tell you that Monster is clearly talking absolute bollocks here. It’s not a fake.
Monster’s Twitter account has since been deleted. According to Peterson, Epik’s director of operations, Monster deleted it himself. Reading between the lines, it appears he was pressured to do so by his staff, including Peterson.
Monster has not yet deleted — and is in fact still actively using — his @epik account on Gab.com, the Twitter clone often used by far-right activists who have been banned from or choose not to use Twitter due to their views.
A March 15 post on Gab by Monster links to a copy of the Christchurch killer’s rambling “manifesto”, again hosted on anonymize.com. This link is still live, but I’ve redacted it in the screen-cap below, which shows Monster effectively using the manifesto to promote the forthcoming Anonymize service.

I’ve been unable to confirm whether Epik is still hosting the video of the attack, though there are reports that it was taken down a matter of hours after posting. (UPDATE 1816 UTC: the video is in fact still live on the Anonymize service).
Epik and Monster drew attention last November when Monster publicly offered to become the registrar for Gab.com, after the domain was suspended by GoDaddy.
Monster at the time said the move was to protect freedom of speech online.
Epik again attracted attention last month when it acquired BitMitigate, a denial-of-service protection startup which has been providing services to unapologetic Nazi propaganda site The Daily Stormer since August 2017, when Cloudflare told the site to GTFO.
It’s also taken on the domain business of video hosting site BitChute, which is often used as a refuge for political vloggers (including some on the far right) who have been demonetized or banned by YouTube.
For these reasons, in January Epik attracted the attention of the Southern Poverty Law Center, an anti-racist group based in the US. The SPLC wrote that “Epik is cornering the market on websites where hate speech is thriving”.
The post, and other news reports, strongly hint that Monster’s own political views might be more aligned with those of his customers than he cares to admit.
Monster naturally rebuts these suggestions, calling the SPLC post “highly defamatory and inaccurate”. In one of his most recent posts on Namepros, before his staff asked him to back away from the public square for a while, he wrote:

As for those members of the domain community who have taken the opportunity this week to rebuke me for allowing free speech to continue on the Internet, please know that I am neither seeking publicity or controversy. I am of sound mind. I am not a Nazi, an anti-semite, a homophobe, a misogynist, a bigot, or a racist. I believe love and understanding will overcome hate and divisiveness.
The future of the domain industry is being determined in 2019. Censorship, WHOIS privacy, sinkholing, DDoS, deplatforming, demonetization, unpersoning, are all symptoms of the disease which is a relentless desire by the few to dictate the narratives and choices to be consumed by the many.

Peterson has also denied that his boss harbors secret extremist views, in a series of lengthy, nuanced posts (starting here) on Namepros this week.
He writes that Monster has a “weird conspiratorial streak” and a natural inclination to believe in “false flag” conspiracy theories. He doubts the official story on 9/11 and believes the moon landings were faked, Peterson said. Monster is also a “Bible-believing Christian”, according to his Gab profile.
Peterson also writes that a significant portion of Epik’s employees, including some in important roles, are Muslims. He writes that he was “appalled” by Monster’s decision to post the video, but added:

But to infer that he did this because he hates muslims and condones murder is not just simplistic; it is LUDICROUS. One person murders 30+ muslims. The other person hires them and works with them closely on a daily basis. To equate these 2 is simply wrong. Whatever the reasons Rob felt it necessary to re-publish a link to content others had decided to censor, hatred of muslims was NOT the reason.

He goes on to say:

I object to Epik — the team I work with and the customers we look after — being portrayed falsely as some epicenter of “hate speech” or the alt right. We are not. We are a domain registrar and marketplace with a wide range of services. We are a company whose boss has taken controversial (and in some ways courageous) steps to protect free speech. Unfortunately, that same boss has stepped on that message with some very bad PR moves. When Rob does that, it irritates me to the point of exasperation. And I tell him so.

According to Peterson, Monster and his wife came under attack last year with a leafleting campaign in his local neighborhood, denouncing him as a Nazi.
He suspects this kind of behavior may have caused his boss to “double-down” on exactly the same kinds of activities that invited the controversy in the first place.
Whatever the reason, Epik certainly has got a PR problem on its hands right now.
I doubt this is the last we’ll hear of it.

Terror fears prompt security crackdown for ICANN 55

ICANN is bringing in metal detectors, bag searches and ID checks at its forthcoming public meeting in Marrakech, Morocco.
The measures are being introduced despite ICANN’s assurances that it considers the chance of terrorism at ICANN 55 to be “LOW”.
In a statement today, ICANN meetings boss Nick Tomasso said:

we are in constant and on-going communication with our hosts and the Moroccan government, to assess any security concerns surrounding the upcoming meeting. In addition, we are working with a highly respected global security-consulting firm, which gives us on-going updates of potential risks. This firm has also assigned a senior level analyst to work with ICANN.
As of this date, the assessments of these various security experts is that there is only a LOW risk of any type of terrorist activity in Morocco.

The statement comes as some members of the ICANN community have been expressing concerns about visiting Morocco, in the light of recent ISIS/Daesh-linked terrorist attacks in North Africa.
Morocco itself has not been the target of any successful Daesh attacks, though members of the cell behind the November attacks in Paris are reported to have Moroccan links.
Marrakech was bombed by an Al Qaeda-linked group in 2011.
Several Western governments urge visitors to the country to exercise caution, saying there’s a high risk of terrorist attacks.
The UK government says, for example:

There is a high threat from terrorism in Morocco. Attacks could be indiscriminate, including in places visited by foreigners.

The US government is less alarmist:

The potential for terrorist violence against U.S. interests and citizens exists in Morocco. Moroccan authorities continue to disrupt groups seeking to attack U.S. or Western-affiliated and Moroccan government targets, arresting numerous individuals associated with international terrorist groups. With indications that such groups still seek to carry out attacks in Morocco, it is important for U.S. citizens to be keenly aware of their surroundings and adhere to prudent security practices such as avoiding predictable travel patterns and maintaining a low profile.

I’ve heard community members speculate that an ICANN meeting, with its broad international mix of delegates, some governmental, might be an attractive target.
Personally, I’m not convinced the risk is much greater than it would be in any Western capital. My mother is vacationing unaccompanied in Egypt around the same time, and I’m fine with that.
However, ICANN seems to be taking the concerns seriously.
Tomasso added the following, non-exhaustive list of new security measures for ICANN 55:

• Every delegate will now need a government-issued ID to pick up a badge at the registration desk.
• There will be increased security screening for those entering our meeting venue, which may include metal detectors, magnetic wands and bag checks.
• There will be advanced verification of delegate registration information by Moroccan authorities.
• Security will be increased at the hotels where delegates are staying.
• We are establishing a 24/7 operations center at the venue.

It’s not exactly TSA-levels of privacy invasion, but I can see some would-be delegates being put off by the extra hassle.
If ICANN were to cancel the Marrakech meeting, it would risk seriously pissing off African community members.
The Marrakech meeting was originally scheduled for 2015, but it was postponed due to fears about the Ebola virus, which at the time was running rampant in African countries thousands of miles away.
In 2010, ICANN was criticized for its handling of security concerns around a meeting in Kenya, where at least 74 delegates cancelled their registrations over terror fears.
ICANN also cancelled a planned 2011 meeting in Jordan due to Middle East security concerns.
ICANN 55 is scheduled for March 5 to 10.

Judge blocks seizure of Iran’s ccTLD

ICANN has won a court battle, and avoided a major political incident, over an attempt by terrorism victims to seize ccTLDs belonging to Iran, Korea and Syria.
A District of Columbia judge ruled this week that while ccTLDs may be a form of “property” under the law, they’re not “attachable” property.
Attachment is a legal concept used when creditors attempt to seize assets belonging to debtors.
The ruling overturns a request by a group of terrorism survivors, led by attorney Nitsana Darshan-Leitner, to have .ir, .sy, .kp, سور, and ايران. transferred to them in lieu of payment of previous court rulings.
Darshan-Leitner has previously secured US court judgments amounting to hundreds of millions of dollars against the three nations. Because the nations have not paid these penalties, she’s been using the courts to seize state-owned assets in the US instead.
But US District Judge Royce Lamberth ruled (pdf) earlier this week:

the country code Top Level Domain names at issue may not be attached in satisfaction of plaintiffs’ judgments because they are not property subject to attachment under District of Columbia law.

However, he added in a footnote:

But the conclusion that ccTLDs may not be attached in satisfaction of a judgment under District of Columbia law does not mean that they cannot be property. It simply means that they are not attachable property within this statutory scheme.

Drawing on “sparse” case law, Lamberth’s rationale appears to be that domain names are not a product, they’re a service. He wrote:

The ccTLDs exist only as they are made operational by the ccTLD managers that administer the registries of second level domains within them and by the parties that cause the ccTLDs to be listed on the root zone file. A ccTLD, like a domain name, cannot be conceptualized apart from the services provided by these parties. The Court cannot order plaintiffs’ insertion into this arrangement.

The ruling, which may of course be challenged by the plaintiffs, helps ICANN and the US government avoid a huge political embarrassment at a time when the links between the two are being dissolved and relations with Iran are defrosting.

Terror victims try to seize five ccTLDs

ICANN is fighting a US court action that could see the ccTLDs of Iran, Syria and Korea being seized by victims of terrorism.
While ICANN has not been sued as such, it’s been named in three “writs of attachment”, which seek to force the organization to hand over control of .ir, .sy, .kp, سور, and ايران.
This audacious attempt to take over three nations’ domains is being attempted by lawyers representing victims of state-sponsored terrorism, reportedly led by Nitsana Darshan-Leitner.
Darshan-Leitner has secured billions of dollars worth of judgments against these states in US courts over the last decade.
But because the states won’t pay up, she’s been getting US courts to seize state-owned US-based assets, such as valuable real estate, instead.
Now her attention has turned to domain names.
The writs against ICANN, issued by a District of Columbia court a month ago, would force ICANN to hand over any assets belonging to Iran, Syria and Korea.
But ICANN says it cannot and should not be made to do so, filing hundreds of pages of court documents yesterday explaining why ccTLDs are not property that can be “attached”.
“Attachment” is a legal term used in the process of transferring assets from debtors to creditors.
In its defense, ICANN argues that allowing the seizure would do nothing less than jeopardize the globally interoperable internet:

First, a ccTLD simply is not “property” subject to attachment. Second, although operating for the benefit of the people of Iran, Syria and North Korea, respectively, the relevant ccTLDs are not “owned” by the defendants or anyone else, for that matter. Third, the .IR, .SY and .KP ccTLDs are not “located” in the District of Columbia or even the United States, and therefore are beyond the reach of Plaintiffs’ Writs of Attachment. Fourth, even if these ccTLDs could be characterized as “property in the United States of the defendants,” this Court would lack jurisdiction over these proceedings, according to the Foreign Sovereign Immunities Act. Fifth, ICANN does not unilaterally have the capability or authority to transfer the .IR, .SY or .KP ccTLDs to Plaintiffs. Finally, a forced transfer of the .IR, .SY and .KP ccTLDs would destroy whatever value may exist in these ccTLDs, would wipe out the hundreds of thousands of second-level domain names registered therein by various individuals, businesses and charitable organizations, and could jeopardize the single, global, interoperable structure the Internet.

“While we sympathize with what plaintiffs may have endured, ICANN’s role in the domain name system has nothing to do with any property of the countries involved,” ICANN general counsel John Jeffrey said in a statement.
In its motions to quash the writs, ICANN describes how it has no contractual relationship and few dealings with the three ccTLD managers in question and how it has received no money from them.
It goes on to describe its relationship to the DNS root zone and the US Department of Commerce
The motion then compares domain names to street addresses and not “property”:

a ccTLD can be thought of as a zip code. That zip code may encompass many different addresses, and those addresses in turn may correspond to certain places on the Internet that people can access, such as websites. But the street address itself is not property, nor is the zip code in which the street address exists…To the extent a ccTLD is capable of a legal definition, it is a collection of technical and administrative services, rather than property

There’s a bunch of US case law that states second-level domain names are not property, which ICANN draws on heavily in its motion.
I’m not going to dwell on the legal issues at stake here too much, but the case is politically, to use an inappropriate word, explosive.
If ICANN were to receive a court order, instructing it to transfer ownership of .ir to Darshan-Leitner’s group, and had no option but to comply, we’re looking at a major international political incident.
Under ICANN’s current IANA arrangement, ICANN-recommended changes to ccTLD management are handled by Verisign, but only with the consent of the US National Telecommunications and Information Administration.
The US Department of Commerce, of which NTIA is a part, would have to give its approval to the transfer of Iran’s ccTLD from an Iranian institution to an Israeli entity.
That, at a time when US-Iranian relations are softening, in light of the new ISIS crisis in Iraq.
It’s a recipe for putting the IANA contract at the center of what can mildly be described as a “political incident” unlike anything the internet has seen to date.
While the US government has a role in ccTLD redelegations today, due to its membership of the DNS root zone triumvirate, it has announced its intent to step away from IANA stewardship.
The NTIA will be replaced, possibly as early as September 2015, by a mechanism that the ICANN community has started to develop.
If we can assume that the US government’s current role may prove to be a buffer between the US courts and potentially devastating forced ccTLD redelegations, it’s not at all clear that the NTIA-replacement mechanism would hold the same kind of political clout.
Would an IANA without US stewardship be more susceptible to crazy US court rulings?
If the US court asserts its authority over the DNS root zone, by ordering the transfer of a ccTLD to a private entity, all ccTLD registries would have a right to be very nervous indeed.
The case also highlights the fact that ICANN is subject to US court jurisdiction — something likely to remain after the IANA stewardship transition — which also makes some nations very nervous.
Rumors have been floating around for a while that ICANN would like to move its headquarters and primary legal structure to Switzerland — it already has an office and a legal presence there — and this case will certainly provide ammunition for those who would like to see such a move happen.

US quietly revises IANA contract

ICANN will not be allowed to do business with groups designated by the US government as terrorists, according to one of many changes that have been quietly made to the IANA contract.
The IANA contract, which gives ICANN its ability to delegate top-level domains, is up for renewal following the publication of an RFP by the Department of Commerce earlier this month.
But Commerce substantially modified the RFP a week after its initial publication. It’s now about 20 pages longer than the original document, containing many new terms and conditions.
A few changes struck me as notable.
Terrorism
Among the changes is a ban on dealing with groups classified as supporting terrorism under the US Executive Order 13224, signed by President Bush in the aftermath of the the 9/11 attacks.
That Order bans US companies from working with organizations including the IRA, Hamas and Al Qaeda.
While the addition of this clause to the IANA contract doesn’t really change anything – as a US corporation ICANN is bound to comply with US trade sanctions – it may ruffle some feathers.
The new top-level domains Applicant Guidebook banned applicants involved in “terrorism” in its fourth draft, which caused complaints from some quarters.
It was revised over a year ago to instead make reference to US legal compliance and the US Office of Foreign Assets Control and its List of Specially Designated Nationals and Blocked Persons.
Khaled Fattal of the Mulitlingual Internet Group, who first described the unqualified Guidebook ban on “terrorism” as “racist”, continued to voice opposition to this rule, most recently at the ICANN public forum in Dakar, suggesting it betrays ICANN’s American bias.
Data Rights
The revised IANA RFP also contains a new section detailing the US government’s “unlimited rights” to data and software produced by the IANA contractor.
The new RFP states: “The Government shall have… Unlimited rights in all data delivered under this contract, and in all data first produced in the performance of this contract”
“Data,” it says, “means recorded information, regardless of form or the medium on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.”
It’s not entirely clear what this clause could potentially cover.
By it’s very nature, much of the data produced by IANA is public – it needs to be in order for the DNS to function – but could it also cover data such as redelegation communications with other governments or private DNSSEC keys?
New gTLDs
There are no big changes to the section on new gTLDs, just one minor amendment.
Whereas the old RFP said that IANA must show that ICANN “followed its policy framework” to approve a gTLD, the new version says it must have “followed its own policy framework”, which doesn’t seem to change the meaning.
Other amendments to the RFP appear to be formatting changes or clarifications.
The more substantial additions – including the terrorism and data rights sections – appear to be standard boilerplate text designed to tick some boxes required by US procurement procedure, rather than being written specifically for ICANN’s benefit.
You can download the original and revised RFP documents here.

What does ICANN say about terrorism?

While it’s true that ICANN has excised specific references to terrorism from its new top-level domain Applicant Guidebook, don’t expect any such groups to be awarded TLDs.
As I reported in September, the AGB no longer contains the explicit mention of “terrorism”, which had caused complaints to be filed by a few members of the community.
But it does contain text that makes it abundantly clear that any group or nation the US considers a supporter of terrorism will have an extremely hard time finding approval.
Under a new section entitled “Legal Compliance”, ICANN notes that it “must comply with all U.S. Laws, rules, and regulations” including the sanctions program overseen by the US Office of Foreign Assets Control.
OFAC administers a List of Specially Designated Nationals and Blocked Persons. If you’re on the SDN list, American companies cannot do business with you without a license.
While ICANN has applied for exemption licenses in the past, in order to be able to deal with organizations in US-unfriendly nations (on ccTLD matters, presumably), the AGB now states:

ICANN generally will not seek a license to provide goods or services to an individual or entity on the SDN List. In the past, when ICANN has been requested to provide services to individuals or entities that are not SDNs, but are residents of sanctioned countries, ICANN has sought and been granted licenses as required. In any given case, however, OFAC could decide not to issue a requested license.

If you’ve never seen this list before, it can be downloaded here. It’s currently 475 pages long, and while it’s certainly a globally inclusive document, parts of it do read like the Baghdad phone book.
(Interestingly, many of the listed a.k.a’s are actually domain names)
Anybody who wanted ICANN to replace the amorphous term “terrorism” with something a little more specific have had their wishes granted.
No more hypothetical debate is required about whether Hamas, for example, is a terrorist group or a movement of freedom fighters. It’s in the book, so it’s probably not getting a TLD.

Anti-terror rule dropped from new TLD guidebook

ICANN will cut references to terrorism from its Draft Applicant Guidebook for new top-level domains, after criticism from some Arab stakeholders.
The ICANN board of directors decided on Saturday at its retreat in Trondheim that it will revise its policy of doing background checks on new TLD applicants:

The background check should be clarified to provide detail and specificity in response to comment. The specific reference to terrorism will be removed (and the background check criteria will be revised).

The reference to “terrorism” first showed up in DAGv4, the latest draft. It caused a bit of a stir, with at least two Arab community members harshly criticizing ICANN for its inclusion.
Khaled Fattal of the Multilingual Internet Group told ICANN it would “be seen by millions of Muslims and Arabs as racist, prejudicial and profiling” while Abdulaziz Al-Zoman of SaudiNIC observed that’s it’s not globally accepted “who is a terrorist and who is a freedom fighter”.
It appears that their complaints have been heard.