Public comments to inform Board action, regarding Ombudsman

["Garth Bruen" <gbruen@xxxxxxxxxx>]

Dear ICANN Board of Directors, 
        
The accountability structure of ICANN has an accountability issue. I am
extremely concerned that too much power and control is placed in the hands
of one individual in the form of the Ombudsman office. The role which is
supposed to hold ICANN accountable and speak for the "little man" is itself
unaccountable. The ombudsman office should not receive any additional
authority, expansion or funding without a comprehensive and truly external
review of its function and staff. The reasons are explained below. In
addition to the serious case detailed, the following questions should be
pondered: 

-       To whom does someone complain if the Ombudsman office fails to
investigate facts? 

-       To whom does someone complain if the Ombudsman office publishes
false information about members of the community?

-       To whom does someone complain if the Ombudsman office is used to
provide cover for ICANN's mistakes?

-       To whom does someone complain if the Ombudsman office abuses its
power?

The global body which is supposed to represent all Internet uses in a
multi-stakeholder model is reduced to an undemocratic function when disputes
arise concerning ICANN's core functions. There must be a better method, or
at least one with more accountability. 

The current execution of the office of the Ombudsman does not function as
presented to the community in that it is not responsive to the community and
does not perform its existing professed duties. The ICANN Ombudsman is
defined by their own statements as an independent, impartial, and neutral
reviewer of facts and investigator of complaints about unfairness. However,
in response to complaints by dozens of Internet users on very serious
matters the office of the Ombudsman, instead of conducting an impartial
investigation of facts issued an uncited "report" dismissing the complaints.
The Ombudsman report is located here: https://omblog.icann.org/?p=1023 and
does not present a fair or factual review of the initial complaint. The
Ombudsman actually refused to consider information brought to the office by
people who had firsthand knowledge of the cases presented. Instead of
addressing why ICANN failed to respond to over 5000 complaints, the
Ombudsman report focuses analysis on the complainant. This is basically an
ad hominem attack. A proper response would be based on refutation and
counterargument, not omission or clams without citation. Overall the
Ombudsman process appears arbitrary, capricious and irresponsible. The
details of the issued are appended below.

The Board should be aware that the Ombudsman specifically requested that
particular individuals contact him, but then excluded their testimony from
the record.

The Ombudsman conclusion that: "I consider that there is no substance to the
complaints" only reflects the way in which the Ombudsman has described the
complaint. The Ombudsman report contains omissions, factual errors, claims
without citation, and material not included within the original complaint. 

The omissions, inaccuracies and irrelevant references in the report
(https://omblog.icann.org/?p=1023) are enumerated below:

1. No Response to Specific Issues

The Ombudsman report does not directly address the specific issues in the
complaints (and there are over 8000 examples which have been dismissed as
being "the same"). For example in the issue of WDPRS complaint
#c6e6d0835bdb4112636fceb7d8c5c1a27744cabe neither the Ombudsman report nor
ICANN have provided any explanation or rationale for how it is possible that
the "Registrar verified that the data was correct" when all presented
evidence shows this simply technically impossible. There is no address or
discussion of this bald fact in the Ombudsman report. As another larger
example there is no mention or explanation for the 5,000 or more complaints
filed with ICANN Compliance which received no response. This is not
addressed in the report.

2. Reference to Extraneous Material

The Ombudsman report leads with a reference to LinkedIn forum discussions
(Page 1). LinkedIn Forum discussions are not the complaint. LinkedIn forums
are a place for discussion within the community. This should not be the
focus as they were not part of the material submitted directly to the
Ombudsman. The highlighting of LinkedIn discussions serves as a distraction
from the core material. This should be stricken from the response and
replaced with actual complaints submitted to the Ombudsman. 

3. Citation of Current and Future Changes

The complaints submitted to the Ombudsman concern specific cases where ICANN
Staff failed to properly process or investigate WDPRS reports. The Ombudsman
report does not address any of the specifics of these cases and instead
includes long recitations of modified ICANN policy and promises of future
changes.  This is not an investigation but rather reads as an advertisement
without any practical application of the cited polices. 

4. Irrelevant Rhetorical Question

On page 3 of the Ombudsman report, the following comment is found: "I am
unsure whether the complainants have read the relevant pages on the
Compliance pages of the ICANN site." This investigation should be factual;
this comment appears as internal musing about the detail level of research
conducted by the complainants. Other than this statement being purely
internal dialogue, there are two main problems with the statement. One is
that the Ombudsman has not determined if the complainants read the
Compliance - therefore it is not a fact. The second problem concerns
relevance of the topic. As discussed previously, changes to ICANN's
procedures now or in the future have no relevance in determining whether
ICANN staff performed duties as claimed in the cited cases.

5. Out-of Context Comments on Aging

The Ombudsman report regularly claims that the complaint issues are "old"
without citing reason for the aging. This has been a long process, mostly
due to ICANN's response to it. The Ombudsman has been made aware of the
following, but these facts do not appear in the report:

.       The community collaborated for over 10 months on the details of many
of these tickets, going through long periods of back-and-forth with ICANN
staff. At the end Compliance simply refused to discuss the issues further,
leaving details and resolution in the lurch. 

.       Following this disappointment, an attempt was made through the ALAC
to discuss the problem with ICANN's CEO. The result of this was a
teleconference in which ICANN's CEO requested that Bruen submit the report
directly to the CEO and his office would respond publicly. ICANN took 8
months to post this report in the CEO's correspondence and then did not
respond to the report publicly as promised (see
http://archive.icann.org/en/news/correspondence/bruen-to-chehade-22apr13-en.
pdf). 

.       It was only after these efforts to work within the system failed did
we file a complaint with the Ombudsman. The Ombudsman in fact received
detailed information about the issues in April 2013 and then again in July
2013.

It is not accurate to say the Ombudsman complaint was filed after the "60
day" deadline since this was an ongoing problem and all possible options
were exhausted before filing with the Ombudsman. The Ombudsman report fails
to mention that the complaint was preceded by extensive attempts to work
within the boundaries established. 


6. Omission of contract language

Page 6 contains the following critique of the complaint: "The complainant
has asserted that the registrant must provide verifiable information. In
fact the agreement provides for reliable information, which is substantially
different. This is not the same as verifiable."

The contractual test is actually "accurate" and something is only accurate
if it can be verified. The RAA reads "accurate and reliable contact
details." The Ombudsman report only cites half of the test in its critique. 

Additionally, ICANN staff regularly uses the term "verify" in its own tests
of registrar compliance. As an example please refer to the language used the
matter of WDPRS # 6fa41d93452f769d933df57864000047fbadbfcb (which is part of
the complaint): "Registrar verified data was correct on 16 June 2011.
W-Ticket closed pursuant to compliance process, as registrar suspended
domain name after previously verifying that the data was correct. Ticket
Closed(see
http://archive.icann.org/en/news/correspondence/bruen-to-chehade-22apr13-en.
pdf)." Therefore, ICANN's own test includes verification and requirement of
the registrar to verify. The inclusion of this language in the complaint
only reflects the ICANN use of the term. 


7. Inaccurate Statement about Motivations

Page 5 contains the statement:

"Garth Bruen goes to some pains to explain the commercial services which his
company provides which are designed to cope with spam, phishing and other
dubious sites."

The use of "commercial" in this context is completely unfounded and not
factual. All of our members and everyone who participated in this process
are represented free of charge. This work is done on behalf of the community
on a voluntary basis. There are no citations of the "pains to explain the
commercial service" anywhere in this response. In terms of this statement I
am formally requesting you remove this reference from the document. 


8. Invalidated Claim

The Ombudsman report contains the following paragraph:

"The complainant's issue is that Compliance is not doing its job. This
requires however a leap in their argument from the role of Compliance within
ICANN, through to the ability to deal with the spam and phishing issue,
which is mentioned by many of the complainants. This regrettably is a
fundamental misunderstanding of the role of Compliance within ICANN."

This regrettably is a fundamental misrepresentation of the complaint which
does not make any claims as cited in the Ombudsman report. The complaint
maintains the issue is about ICANN procedure and policy. Supplemental
correspondence with the Ombudsman on this issue further clarifies the issue
in part stating:

"The abuse Internet users experience is a byproduct of unchecked violations,
which are the subject of our complaint. In the cases submitted to you spam
was the trigger of analysis, not the issue. The issue is that the
registrant, registrar and ICANN failed in their obligations.(Bruen email)"


9.  Unsubstantiated Claim

The Ombudsman report contains this statement:

"During my discussions with the registrars I was told that complaints had
been made about domains which they administered, but which had no validity
at all. I have seen such a complaint provided by one of the registrars by
Knujon, which makes it clear that the information is not only inaccurate but
out of date."

There are two problems with this statement: the first is that there is no
verifiable proof of what is claimed; the second is that the Ombudsman report
does not respond to the more than 8000 WDPRS tickets presented in the
complaint. The Ombudsman report takes the time to cite a hearsay discussion
but does not investigate the specific complaint details.  


10. Curious Comments about Compliance Employees

The Ombudsman report states on page 7 that: 

"There has also been a criticism that staff members were fired for raising
issues of inadequate compliance action, but on my investigation I have found
that the staff members who actually did the work are still at ICANN. I am
confident from my investigation that this allegation is unsubstantiated."

During this process the complainants from the community made specific
requests of the Ombudsman to interview Khalil Rasheed, Pam Little, and Stacy
Burnette - all of whom worked within Compliance during the time period of
the complaint and worked directly on the issues cited in the complaint. It
is clear from the Ombudsman report that these former employees were not
interviewed as requested. To state that "the staff members who actually did
the work are still at ICANN" is factually incorrect. As a result this
investigation is incomplete. 

While the Ombudsman frequently states that personnel issues are outside of
charter we find that Article V of Bylaws excludes employees from resolution
of problems by the Ombudsman (Sec3:1) and grants no authority to the
Ombudsman to act in administrative or personnel matters (Sec 3:2). Neither
issue was part of the complaint. However, Article V states the Ombudsman
function is to resolve problems concerning ICANN's staff failure to act (Sec
3:1). Further, no ICANN employee may prevent or impede the Ombudsman's
contact with employees of ICANN (Sec 4:1).


11. Irrelevant Citation

The Ombudsman report contains the following statement on page 5: "However I
was also told by Compliance that Internet users often make Whois inaccuracy
complaints about spam domains without any evidence." This issue is
immaterial to the complaint at hand and is out of scope for the Ombudsman
report. The vague reference to "Internet users" does not apply to our
thoroughly documented complaint but rather refers to unknown parties not
connected to the complaint. How exactly do poorly constructed complaints by
others invalidate this complaint? 


12. Undocumented Assessment of Registrar's Compliance

The incident described below has since become the subject of a Washington
Post investigation which determined the registrant data in the cited record
is indeed invalid despite what the Ombudsman office published.

Page 5 contains this statement about the registrar BizCn:

"I also mention one registrar in particular which has been openly
criticised, being Bizcn.com. As part of the monitoring by Compliance,
scorecards of requests are kept. Compliance informed me that Bizcn.com is a
registrar that is prompt & cooperative with Compliance inquiries, including
Whois inaccuracy complaints.  I was shown the scorecard, of all complaints
since January 2013, which shows that all were resolved before a 3rd notice
was needed."

This statement flies in the face of reality and even contradicts Compliance
statements about Bizcn, most notably in reference to WDPRS complaint
#c6e6d0835bdb4112636fceb7d8c5c1a27744cabe Compliance has stated that:
"Registrar did not respond to the following tickets (see
http://archive.icann.org/en/news/correspondence/bruen-to-chehade-22apr13-en.
pdf)"

The situation cited at BizCn in our original report still exists today and
was brought to the attention of even ICANN's CEO. The Ombudsman report
contains no facts to support BizCn's compliance and does not address the
specific issues concerning BizCn documented in the complaint.

In conclusion, the Ombudsman report does not address the complaint, does not
respond factually to the items in the complaint, and includes comments
tending towards ad-hominem The idea that the Ombudsman report can only find
fault with the complainant (without addressing any of the 8000 cases in the
complaint) is incredulous to say the least. For these and all of the reasons
cited above the Ombudsman report as issued should not be considered final.
The Ombudsman report as written does not represent the interests of the
public or consider the issues in the context of the Affirmation of
Commitments.

As a result, the perceived authority of the Ombudsman's office to mediate
between the Internet community and ICANN either does not exist or is not
implemented. Furthermore, it appears the use of the office itself has been
abused. 

-Garth Bruen

Washington Post article referenced:
http://www.washingtonpost.com/business/technology/how-violent-porn-sites-man
age-to-hide-information-that-should-be-public/2013/12/06/e0861378-3773-11e3-
ae46-e4248e75c8ea_story.html

-------------------------------------

"If history is deprived of the Truth, we are left with nothing but an idle,
unprofitable tale" -Polybius