Home / Blogs

Domain Registrar Hide and Seek

John Levine

In the past year ICANN has been putting a lot more effort into its compliance activities, which is a good thing, since the previous level was, ah, exiguous. That's the good news. The bad news is that while they're paying more attention to misbehaving registrants, the registrars, gatekeepers to the world of domains, have serious issues that ICANN has yet to address.

One straightforward problem is registrar (as opposed to registrant) compliance with the Registrar Accreditation Agreement (RAA). ICANN has sent out quite a few termination notices for failure to comply, but in nearly every case the failure involves not paying their bills. Other than that, the only meaningful enforcement has been their recent attempt to shut down EstDomains for the felony conviction of one of their principals.

Registrar Dynamic Dolphin is run by infamous high volume e-mail deployer Scott Richter. In 2003 Richter pled guilty to felony charges of receiving stolen property. Earlier this year Richter settled a suit with MySpace for $6 million, for spamming MySpace users using phished accounts. Section 5.3.3 of the RAA says that ICANN can terminate a registrar if an officer:

is convicted of a felony or of a misdemeanor related to financial activities, or is judged by a court to have committed fraud or breach of fiduciary duty, or is the subject of a judicial determination that ICANN deems as the substantive equivalent of any of these ...

Why hasn't ICANN acted in this case? ICANN certainly knows about it.

As a separate issue, ICANN gadfly Knujon has discovered that at least 70 accredited registrars are in practice completely anonymous, providing no usable contact information, and in many cases appearing to operate out of countries other than the ones in which they told ICANN they were located. Knujon has not gotten a warm reception from ICANN, who has shut down Knujon founder Bob Bruen whenever he's tried to bring up registrar behavior issues at ICANN events.

While the RAA does not have specific language about publishing contact information, this is ridiculous. As a friend of mine put it, no other form of near-critical infrastructure, either privatized or public, operates with such anonymity. Section 3.7.1 of the RAA provides for the creation of a registrar Code of Conduct, and having a registrar tell its customers who and where they are would be a good start.

ICANN's basic problem here is that it never occurred to them that they would have to enforce their contracts. For a long time there was no compliance at all, and their moves toward it have been slow and painful. At some point they'll have to realize that they are in practice a regulator, every rule or agreement they have is going to be subverted by bad guys trying to make a quick buck, so compliance needs to be integrated into all of their interactions with the people and organizations they regulate.

By John Levine, Author, Consultant & Speaker. More blog posts from John Levine can also be read here.

Related topics: Cybercrime, Domain Names, ICANN, Internet Governance, Law, Policy & Regulation

 
   
WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

To post comments, please login or create an account.

Related Blogs

Related News

Explore Topics

Industry Updates – Sponsored Posts

Meet Boston Ivy, Home to Some of the Most Specialized TLDs in the Financial Services Sector

Move Beyond Defensive Domain Name Registrations, Towards Strategic Thinking

Verisign Launches New gTLDs for the Korean Market, .닷컴 and .닷넷

Verisign Opens Landrush Program Period for .コム Domain Names

Domain Management Handbook from MarkMonitor

i2Coalition to Host First Ever Smarter Internet Forum

Afilias Announces Relaunch of .GREEN TLD

New .PROMO Domain Sunrise Period Begins Today

US Court Grants DCA Trust's Motion for Preliminary Injunction on .Africa gTLD

Minds + Machines Group Announces Outsourcing Agreements, Web Address Change

.STORE Opens its Doors to Brands

United States Court Has Granted an Interim Relief for DCA Trust on .Africa gTLD

February Biggest Month to Date for Radix, Over 750K Domain Registrations

Best Practices from Verizon - Proactively Mitigating Emerging Fraudulent Activities

Radix & WHMCS Offer Free .HOST Domains to All WHMCS Customers

New .BET Domain Now Available to the Public

Radix and SnapNames Announce Exclusive Partnership

Neustar Data Identifies Most Popular Times of Year for DDoS Attacks in 2015

Radix Gives Its TLD .SPACE a Makeover

The Framework for Resilient Cybersecurity (Webinar)

Sponsored Topics

Verisign

Security

Sponsored by
Verisign
Afilias - Mobile & Web Services

Mobile

Sponsored by
Afilias - Mobile & Web Services
Afilias

DNS Security

Sponsored by
Afilias
Port25

Email

Sponsored by
Port25