Scenes from the history of the IEDR

The .ie Domain Registry (the IEDR) has been in the news lately following a compromise which left Google.ie and Yahoo.ie redirected to an Indonesian server controlled by hackers. This reminded me to scan and upload some documents from a 2003 Freedom of Information Act request to the Department of Communications about the IEDR - while of little contemporary relevance, they are very informative indeed for anyone with an interest in the history of the .ie space and hopefully will be a useful follow on to the massive set of documents Michele Neylon obtained under FOI relating to the formation of the IEDR.

ENN has some background about the precarious state of the IEDR in 2003.

Apologies for the poor formatting - the documents are as received from the department: FOI re IEDR, 2003

Protecting a .ie domain: hacking, hijacking and heedlessness

This summary is not available. Please click here to view the post.

Moriarty-Tribunal.ie v. MoriartyTribunal.com - Denis O'Brien takes the PR battle online

Today's Sunday Business Post has an interesting article about Denis O'Brien's latest salvo in his ongoing PR battle against the Moriarty Tribunal investigation into how he came to be awarded Ireland's second mobile phone licence.

The official website of the Tribunal is moriarty-tribunal.ie and O'Brien has now launched a full frontal attack on the findings of the tribunal at moriartytribunal.com, which bills itself as presenting "the true picture of the Moriarty Tribunal's 8 1/2 year inquiry into the awarding of the second mobile phone licence" - including confidential correspondence between the Tribunal and parties.

Is a UDRP claim on the cards? Probably not (though there has been one case where an Irish public body has unsuccessfully invoked the IEDRP). Nevertheless, I'll be interested to see whether the Tribunal will object to the use of such a similar domain name.

Sutherland Institute v. Continuative: Is it time to take the U out of UDRP?

OUT-LAW has a good report of the WIPO panel decision in Sutherland Institute v. Continuative LLC - a decision which by focusing on the location of the parties makes me wonder whether it's misleading to describe the UDRP as a "Uniform" Dispute Resolution Policy.

On the face of it this was a relatively straightforward case. The complainant was a right wing Utah think thank hosted at SutherlandInstitute.org while the respondent set up a parody site at SutherlandInstitute.com. A screengrab of a portion of both pages shows the difference:

Despite the fact that the respondent did not defend the proceedings, the panelist found in their favour, holding that it had not been established that they had registered and used the domain "in bad faith" as required by the UDRP. This isn't of itself a surprising outcome, but it's the reasoning underpinning this conclusion which I find interesting. The key passage is this:

Because this proceeding involves political speech that is strongly protected under the U.S. Constitution, the Panel will not in these proceedings involving two U.S. parties attempt to identify bad faith elements that are not specifically enumerated in the Policy. If the right of political speech is to be interfered with based upon Complainant’s service mark incorporated in Respondent’s disputed domain name, it is preferable that a federal or state court make that application of the concept of “bad faith”.

This passage relies on the fact that the parties are both US based to apply US law. As such it takes advantage of rule 15(a) of the UDRP which gives a panel a remarkably wide discretion to decide claims based on "any rules and principles of law that it deems applicable". This has often been used by panelists to apply domestic rules of law where the parties are both from the same jurisdiction - to the extent that the Berkman Center's excellent Analysis of UDRP Issues assumes this to be the norm. Indeed, this practice is supported by paragraph 176 of the WIPO Final Report which led up to the adoption of the UDRP, which states:

In applying the definition of abusive registration given above in the administrative procedure, the panel of decision-makers appointed in the procedure shall, to the extent necessary, make reference to the law or rules of law that it determines to be applicable in view of the circumstances of the case. Thus, for example, if the parties to the procedure were resident in one country, the domain name was registered through a registrar in that country and the evidence of the bad faith registration and use of the domain name related to activity in the same country, it would be appropriate for the decision-maker to refer to the law of the country concerned in applying the definition.

Against this, however, is a strong body of opinion which argues that national law should not be imported into the UDRP - that to do so will lead to a lack of uniformity and to inconsistent outcomes. For example, in McMullan Bros & Maxol v. Web Names, the panelist ruled that:

5.10 Paragraph 15(a) of the Rules requires a Panel to make its decision "in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable." This might justify applying the without prejudice doctrine in this case, but the Panel is unconvinced. The Policy provides an international procedure for international application by a panel comprising panelists who may come from a jurisdiction unconnected with either party. To import a national rule simply because both parties come from the same jurisdiction may result in similar cases being decided in a different manner dependant upon geographical accident. This is a conclusion that this Panel finds inherently unattractive. At times resort to national law may be unavoidable (for example when determining the existence of a trademark recognised by the Policy), but the Panel sees no reason for doing so in this case.

Similarly Wotherspoon & Cameron argue that:

The UDRP was developed by reference to the status of national laws and international treaties. In our view, it already reflects a somewhat harmonized version of these laws. The practice of referring to territorial laws undermines a central purpose of the UDRP — to provide a uniform mechanism for resolution of domain name disputes in the face of the borderless nature of the Internet. By continuing to refer to national laws, Panels will reinforce jurisdiction specific intellectual property rights and undermine the goal of a global uniformity in resolving domain name disputes.

This clash of views highlights an unresolved tension within the UDRP as to how to deal with choice of law issues. There is an obvious attraction in the use of national law where a matter is very closely connected with one jurisdiction. But doing so - even if permitted by the UDRP - does run the risk of eroding its "uniform" nature. Also, this growing practice adds an extra layer of complexity to UDRP proceedings - forcing parties to address choice of law issues as well as the substance of any claim - and may also result in registrants and trademark holders gaming the system by choosing to establish themselves in the jurisdictions which they see as most friendly to their side.

Gerald Levine has more, including an interesting discussion of an alternative choice of law approach under the UDRP.

ComReg to Regulate .ie ccTLD

Important news for the Irish internet with the announcement that Comreg has completed its consultation process and now proposes to introduce a new framework for regulation of the .ie top level domain. The press release summarises the changes as follows:

- ComReg will, by way of regulation, appoint IEDR as the authority authorised to register .ie domain names in accordance with Section 32(4)(a) of the Act of 2007,
- IEDR will set up and maintain a Policy Advisory Committee (PAC) representative of all stakeholders with a focus on more transparent policy development,
- IEDR will continue to adopt the "managed approach" to .ie registrations to ensure continued protection for .ie domain name holders and consumers,
- ComReg will implement a monitoring framework and will participate in the PAC to keep abreast of activities in the marketplace,
- Further regulatory measures may be considered in the future, as warranted.

Daithi has an excellent post discussing the ComReg proposals and their background, which I won't attempt to follow until I've had a chance to look at the proposals in more detail - but I can't help wondering whether this will now mean that the IEDR may be subject to judicial review.

How not to protect a domain name - the D4hotels saga

Remember D4hotels.com - the low cost hotels site which completely failed to protect variants of its name against cybersquatters? Well it now transpires that the ownership of D4hotels.com itself is now contested:

A dispute over ownership of the D4hotels.com domain name and website has come before the Commercial Court.

MJBCH Ltd, the leaseholder of the former Berkeley Court Hotel and the former Jury's hotels in Ballsbridge and The Towers, claims exclusive entitlement to the operation and management of the domain name and website.

It has alleged it had a hotel operation and management agreement with the two defendant companies -- Cloud Nine Management Services Ltd and Beechside Company Ltd, trading as The Park Hotel, Kenmare -- to manage the hotels as the Ballsbridge Inn, Ballsbridge Towers and the Ballsbridge Court hotel, but that agreement was terminated in February.

In those circumstances, it claims the defendants have no entitlement to use the d4 domain name and website.

...

The defendant companies deny the claims and say they at no time abandoned their rights to or property in the domain name, website or business name.

They companies say that, under their agreement with MJBCH of October 2007, they were authorised to act as the exclusive operator and manager of the hotels and that the domain name D4hotels.com was registered by Beechside in September 2007.

They also say the management agreement was summarily terminated by MJBCH in February and that at no stage had it been agreed the D4 domain name and website would become the property of MJBCH.

While there's very little detail in this report, it suggests that there was no explicit agreement as to ownership of the intellectual property in the domain name and the site itself - which if true is one of the most fundamental mistakes one can make when establishing an online business. This, together with the failure to protect domain name variants, means that I will be using this case in class as a cautionary tale.

Update (27.1.09): It now seems that this case has been settled.

Domain Name Registrars - The New Points of Control?

Jonathan Zittrain has pointed out that regulation of the internet has tended to proceed - whether by way of litigation or legislation - by identifying particular intermediaries and compelling them to act as points of control over user behaviour. The intermediaries targeted have included hosts, ISPs, search engines, hyperlinkers and financial intermediaries (which have been compelled, for example, to stop credit card payments to gambling sites). Some relatively recent developments suggest that domain name registrars are joining them in the firing line - and that this may result in some interesting cross-border legal issues.

An early example took place in the Rate Your Solicitor saga, where the plaintiff in an Irish defamation action succeeded in 2006 in persuading US registrar Godaddy to disable the rateyoursolicitor.com domain (apparently for false WHOIS data) notwithstanding that Godaddy would appear to have enjoyed immunity under section 230 CDA. (Not that this deterred the critics of Irish lawyers, who promptly moved to rate-your-solicitor.com where they remain today.)

At around the same time, the plaintiffs in the Spamhaus litigation set out to persuade an Illinois court to order ICANN (rather than the Canadian registrar!) to suspend the Spamhaus domain name - on the basis that Spamhaus (located in the UK) could not otherwise be made to comply with that court's order. (Ultimately, however, the court accepted that ICANN and the registrar were not involved in the defendant's actions nor able to control them, and consequently an order should not be directed towards them.)

The Spamhaus case didn't, however, deter the lawyers acting for Bank Julius Baer in its attempt to silence Wikileaks.org, who succeeded (albeit temporarily) last month in persuading the Californian courts to issue an interim order requiring the registrar (Dynadot) to disable the Wikileaks.org domain name and remove all DNS hosting records. (This despite the lack of any obvious role for the Californian courts in adjudicating on a dispute between a Cayman Islands bank, its Swiss parent company, a Swiss former employee, and the various individuals around the world responsible for Wikileaks, and despite the lack of any full hearing.) Daithi has a particularly good post on why this amounted, in effect, to an internet death penalty and was a disproportionate prior restraint on speech.

Now the New York Times reports that the US government has ordered domain name registrars to disable domain names which it alleges breach its ban on trade with Cuba:

Steve Marshall is an English travel agent. He lives in Spain, and he sells trips to Europeans who want to go to sunny places, including Cuba. In October, about 80 of his Web sites stopped working, thanks to the United States government.

The sites, in English, French and Spanish, had been online since 1998. Some, like www.cuba-hemingway.com, were literary. Others, like www.cuba-havanacity.com, discussed Cuban history and culture. Still others — www.ciaocuba.com and www.bonjourcuba.com — were purely commercial sites aimed at Italian and French tourists.

“I came to work in the morning, and we had no reservations at all,” Mr. Marshall said on the phone from the Canary Islands. “We thought it was a technical problem.”

It turned out, though, that Mr. Marshall’s Web sites had been put on a Treasury Department blacklist and, as a consequence, his American domain name registrar, eNom Inc., had disabled them. Mr. Marshall said eNom told him it did so after a call from the Treasury Department; the company, based in Bellevue, Wash., says it learned that the sites were on the blacklist through a blog.

Either way, there is no dispute that eNom shut down Mr. Marshall’s sites without notifying him and has refused to release the domain names to him. In effect, Mr. Marshall said, eNom has taken his property and interfered with his business. He has slowly rebuilt his Web business over the last several months, and now many of the same sites operate with the suffix .net rather than .com, through a European registrar. His servers, he said, have been in the Bahamas all along.

What's the significance of this? As in some of the other cases, it means that internet speech may be shut down without any prior notice to a party, and without any hearing. It also means that disputes which have no underlying connection with a particular jurisdiction may end up subject to the law of that jurisdiction:

Susan Crawford, a visiting law professor at Yale and a leading authority on Internet law, said the fact that many large domain name registrars are based in the United States gives the Treasury’s Office of Foreign Assets Control, or OFAC, control "over a great deal of speech — none of which may be actually hosted in the U.S., about the U.S. or conflicting with any U.S. rights."

"OFAC apparently has the power to order that this speech disappear," Professor Crawford said.

There's also a very important practical point here. Website owners are already acutely aware that hosting liability varies from jurisdiction to jurisdiction - and for that reason many chose to host in the US where section 230 CDA makes it less likely that a host will take down a site based on vague and unjustified threats. These cases illustrate that domain owners should be equally cautious in deciding which registrar to use - pick a registrar located in the wrong jurisdiction, or one which (as Dynadot appeared to do in the Wikileaks case) caves in too easily and you may find your domain name vanishes.

.ie Domain Disputes Multiply

The amusingly named I squatted your .EU mentions some recent .ie domain decisions from WIPO, including the adidas.ie, and buy-sell.ie decisions.

There have been 10 complaints lodged with WIPO under the .ie Dispute Resolution Policy to date - resulting in four decisions transferring the domain to the complainant, three complaints which were terminated before decision (presumably because the respondent decided to voluntarily relinquish the domain), and just two complaints denied. Not a bad batting average for complainants.

Godaddy caves in rateyoursolicitor.com case?

This is a fascinating development in the ever-entertaining rateyoursolicitor.com saga. American company blocks off access to 'rate your lawyer' site - Irish Independent:

"AN American domain name provider has suspended access to the controversial rateyoursolicitor.com website after an Irish High Court issued a court order to remove offensive material about a barrister from the site.

Godaddy.com, an award winning internet site, suspended access to the rateyoursolicitor.com portal within 24 hours of an injunction issued by Judge Michael Hanna.

Last Wednesday, Judge Hanna issued an order that defamatory material posted about Jayne Maguire, a barrister, on rateyoursolicitor.com must be removed with immediate effect.

Ms Maguire has claimed that John Gill, of Drumline, Newmarket on Fergus, defamed her by posting offensive remarks on rateyoursolicitor.com.

Mr Gill, chairman of the Victims of the Legal Profession Society, denied that anything concerning Ms Maguire was published or posted on the site.

Ms Maguire is seeking damages for defamation and privacy and an interlocutory injunction of the statements about her on the site which she says is administered by Mr Gill.

Godaddy.com have locked access to the site domain name until High Court proceedings are concluded. Lawyers acting for Ms Gill served notice on www.gmax.net, an American Internet Service Provider that is host to the site.

It had been thought that Godaddy.com was hosting the site which invites Irish people to rate their lawyers, however gmax.net has now been identified as the ISP and has received notice of the High Court proceedings.

Slashdot has some interesting comments. More on this when I get the chance - but if these reports are accurate I'll certainly be moving my own registrations and hosting from Godaddy.

The curious legal status of .uk and .ie

From The Register:

The company that runs the UK's Internet registry is not officially recognised by the government and as such has no right to decide what should be done with the millions of domains that it sells each year.

That at least is the claim of Ben Cohen, former owner of iTunes.co.uk, who lost ownership of the domain to Apple in March after a ruling by an independent expert hired through Nominet's domain resolution process.

Cohen has been decrying Nominet since the decision and made a variety of legal threats over the decision. However he recently discovered that he was not able to take the actual decision made against him to the High Court for Judicial Review because of Nominet's peculiar status.

Following questions made under the Freedom of Information Act, the government was forced to state that there is "no formal relationship or written agreement" between the UK government and Nominet. As such, it is not a public body and so is subject only to the usual laws covering UK companies.

Cohen argues that this status is misleading since representatives from government bodies have permanent seats on Nominet's Policy Advisory Board (PAB). The government also accepted that this situation does not exist for any other company.

[...]


"At no point has there ever been a statutory or official recognition by the Government of Nominet's position as a the sole issuer of .uk domain names to the public.

"The status of Nominet is important because their dispute resolution service acts in a quasi-Judicial manner in deciding who should lay claim to a domain name when a dispute arises. CyberBritain was planning on taking the decision made on the 10th March to the High Court for Judicial Review. However, this course of action is only open to review decisions made by public bodies.

"Nominet have always claimed to us that they are on the one hand officially recognised by the Government but not a public body, meaning that their decisions would not be subject to Judicial Review. In my mind, this is a paradox as an official or statutory recognition of an organisation to administer what is in effect a public service would generally be subject to Judicial Review. This certainly would be the case with decisions made by Ofcom who regulate telecommunications and television.

"If Nominet have no official recognition (despite civil servants being on their Policy Board) then all domain names issued by them are placed in jeopardy."

Nominet is not impressed with this logic.

"Mr Cohen has continued to threaten legal action in the press and in private, but no proceedings have ever been issued. Nominet has repeatedly explained to Mr Cohen that we believe that he has no basis for suing us and that the particular type of litigation he was threatening (called "Judicial Review") was totally inappropriate because Nominet is not a Government body.

"Nominet is not a Government body and has never claimed to be. We state on our website that we are 'officially recognised' and we explained the meaning of this to Mr Cohen previously.

"The Dispute Resolution Service forms part of the contract we have with registrants of .uk domain names and is enforced as a matter of contract law. We have told Mr Cohen this, and have never tried to suggest that Nominet's Dispute Resolution Service (DRS) is 'quasi-judcial', statutory (i.e. in an Act of Parliament or similar) or Government-backed."

Much the same problem exists in relation to the .ie domain registry which carries out a public function without any legislative or regulatory underpinning. Their FAQ addresses this point, but in a way which raises more questions than it answers:

6. What exactly is the IEDR - is it a statutory body, is it a semi-state, is it part of UCD, is it some kind of public service or is it just a monopoly like, say, the ESB?

6. The IEDR's origins are in UCD but since July 2000 it's been a private company, limited by guarantee. It has no shareholders, the company is owned by its members who are the directors. Surpluses are not distributed, they are added to opening reserves. Directors as per the company's constitution, do not receive fees or emoluments. Only the IEDR can administer .ie - which it does as a public service - but it is not a monopoly in the sense that anybody in Ireland, or elsewhere, can register from a choice of approximately 250 different national and generic TLD names. The IEDR works closely with national and international governments, governing bodies, trade associations and abides by Internet best practice principles while still operating as an independent private company.

The E-Commerce Act 2000 allows (in section 37) the government to regulate the .ie TLD - however this has yet to be done, despite Ministerial promises that the .ie domain will eventually be regulated by ComReg.

You might well ask - so what? As long as the .ie domain functions, why should lawyers nitpick about its legal foundations? The narrow answer is that there have been many complaints about the governance and transparency of the IEDR, including allegations that it is still dominated by UCD (from which it is an offshoot), all of which ultimately have their origins in the lack of a proper legal basis for the registry.

More widely, though, as a matter of principle where a body controls a public asset (the .ie domain), is exercising a public function, and has its origins in the public sector, it should be subject to rules of public oversight (such as the Freedom of Information Act and judicial review). Instead, the IEDR currently exercises a state-sanctioned monopoly without any real oversight.

Update (17/6/05): Ben Cohen has decided to proceed with the judicial review. Stay tuned to see whether the English courts will accept jurisdiction to judicially review decisions of Nominet.

Update (5/8/05): The judicial review application was rejected - but it's not clear whether the court considered whether Nominet was subject to judicial review. According to Out-Law:

the judge noted that the application was flawed in several respects, being both late and unnecessary given the right of appeal which forms part of Nominet's Dispute Resolution Service, which Mr Cohen had failed to use.

This suggests that the application was rejected on a procedural basis (delay and failure to exhaust remedies) rather than on the substantive ground that Nominet was not a public body.