Comments from Demys Ltd on the RAA 2013 draft

["Gordon Dick" <G.Dick@xxxxxxxxx>]

ICANN RAA 2013 public comments on behalf of Demys Ltd.

As a declaration of interest we start by stating Demys Ltd provides
Internet Intellectual Property protection services for corporate clients
and celebrities, as part of the wider business we are an ICANN
accredited registrar for the purposes of protecting and managing our
clients' domain names.  We do not operate on a mass market, automated
panel basis but act as professional advisers who seek to protect their
clients' interests.

Firstly we would like to thank the registrar negotiating team for their
hard work on this topic and note our significant concern that ICANN's
determination to meet a self-imposed deadline to force the use of the
new RAA may undermine the credibility of the continuance of the current
multi-stakeholder model. It is imperative that ICANN get the RAA 2013
correct not simply have it in place for their self-imposed deadline. 

Secondly we are very concerned with the short comment period on this
consultation and the appearance of additional documents justifying
ICANN's position in an ad-hoc fashion after publication in a manner that
means it is not clear it has been published.  This is not in line with
good governance standards you would expect from either Governments or
governing organisations.

We urge ICANN to return to the negotiating table and discuss the
remaining issues in good faith with registrars. 

We have specific comments on the following clauses:

Clause 3.3.1 - We have not seen ICANN publicly identify its rationale
for requiring registrars to duplicate the WHOIS service provision for
thick registries.  In the current situation when consolidating domain
names for clients we have seen differing information in the registrar's
WHOIS from the registry WHOIS.  This simply adds to confusion and lack
of clarity to the general public as well as adding cost that is passed
on to the registrant.  Adding cost for no tangible benefit is not in the
interests of registrants, law enforcement authorities or internet users.
In the circumstance that a registry WHOIS exists there is no
justification to duplicate service and cost at registrar level.  We note
that if the rationale is related to potential tiered access to directory
services based on data only the registrar holds then that still does not
justify the need for an open port 43 service.

Clause 6.3 - we note ICANN's stated concern that the market may develop
in a way that is not in the interests of the public and then registrars
may seek to resist contract changes that are for the good of the end
user.  This is a very worthy sentiment, however what is to protect
registrars or the end user if the ICANN model itself develops in a way
that is not in the public interest but only the ICANN board has the
power to make unilateral changes without constraint?  ICANN is at best
overlooking the problems and at worst being disingenuous with the
implications of this requirement.

ICANN prescribes in the RAA the base requirements between registrars and
registrants.  As a registrar that supplies services to National and
Local Government and international Brand names we are not in a position
to pass on a clause that allows unilateral alteration by us simply
because ICANN's board, without consensus support of any other parties,
have decreed a change to be forced upon us is allegedly in the public
interest when they cannot be in a position to understand how that
interacts with Governmental public policy, national legislation and
business model that applies to a registrar.  We note that ICANN appears
to be attempting divide and conquer tactics by suggesting it will only
be when registrars are the only ones holding out not agreeing - however
nothing in ICANN's proposed text (or even the wider justification memo)
requires anyone except ICANN's directors to agree.

We have no contention with any consumer or end user protection measures
being put in place through a consensus driven model even where only a
minority of registrars support the wider consensus.  Given the variety
of registrar business models if all registrar business models equally
reject a change then we would suggest it is likely to be unworkable and
thus in the overall scheme not in the public interest.

3.15 - We believe that ICANN should define these audit requirements in
terms of working days in the registrar's head quartered jurisdiction.
We are concerned that ICANN taking a view of a strict number of calendar
days does not take into account regional norms. 

WHOIS Accuracy program specification

While a worthy cause, sadly ICANN is over-engineering the response such
that it will not cater for the reality of the market place.

In reality we meet our clients physically at their offices, we have
their telephone numbers and speak to and email them regularly.  ICANN is
prescribing a working model that does not fit with reality, it is
nonsense to prescribe that we must at least once send them a code to
repeat to us over the telephone (and only verify manually if that
fails).  We have a greater knowledge of our clients and their business
model than the average registrar yet ICANN will add greater costs to our
business model by duplicating an authentication process we already have
in place with one that will not add any value and is more open to abuse.

We wholeheartedly endorse ICANN's wish to require registrars know their
customers and cooperate with law enforcement where they legally can but
to prescribe a flawed method will not help the situation.  

We suggest ICANN instead focus on outcomes.  It is perfectly acceptable
to have, indeed we would wholeheartedly endorse, a contractual
requirement that means we have to show we believe the information to be
true and accurate.  It is also perfectly acceptable for ICANN to cite
their proposal as a sufficient level of proof but ICANN should not
require a business model that is not compatible with every customer's
requirements, especially if accuracy can be shown to be greater through
other methods.

Data retention

Clause 2 - ICANN is currently unclear on what it believes will be a
'trigger event' to vary the contract when it conflicts with national
law.  We note that ICANN cannot through its contract require a registrar
to breach applicable law.  Therefore the only trigger event can be the
registrar's reasonable belief that in carrying out the action would put
them in breach of the law.  Negotiating with ICANN after being
prosecuted or threatened with prosecution is not acceptable - we are
required not to break the law in the first instance.  This is a matter
of compliance with national law and ICANN should not be in a position
where it has the option to withdraw accreditation from registrars that
refuse to break their national law as that provides for anti-competitive
practices by ICANN only accepting registrars in certain jurisdictions.

Registration Data Directory Service (Whois) Spec

Clause 1.4.2 - ICANN appears to be coming at this topic with a big stick
rather than with an Ombudsman last resort role in mind.  The current
specification would appear to ensure that a registrar cannot provide its
own effective complaints mechanism and promote it above ICANN's
complaint mechanism.  It is unacceptable that ICANN would seek to
encourage formal complaints to it rather than allowing for the registrar
being first line support - requiring a link to ICANN's complaints
process before the option to show any of our own text to allow dealing
with the registrar direct is unacceptable.  In the world of regulated
services parties are usually required to exhaust the service provider's
own complaints process first.  This should apply here. 

Clause 2.2 - We are concerned that the SLR defined by the SLAs in this
clause is unreasonable and out of the control of the registrar.  They
may also discriminate against Registrars from countries with poorer
connections to the internet.  (Never mind what happens to a registrar if
their country is taken off line, like has happened with uprisings or
what happens if a diverse terrorist attack takes out major data networks
supplying a highly developed country).  We accept and agree with law
enforcement on the need for the service but rather than implementing via
a strict SLA model perhaps the stick could cater for registrars being
able to comply by making all reasonable efforts to match the SLA?  


In closing we again urge ICANN to return to the negotiating table and
not to implement a flawed RAA which contrary to their public statements
negatively affects registrants and the public interest.

Best regards,
Gordon Dick, CTO
http://www.demys.com/

Demys Ltd, 33 Melville Street, Edinburgh, EH3 7JF
Telephone: +44 131 226 0660
Demys Ltd is a company registered in Scotland under number SC197176