[gnso-consumercci-dt] Consumer trust: continued disagreement over the premise

[Wendy Seltzer <wendy@xxxxxxxxxxx>]

Hi Consumer Metrics team,

I write because I continue to have strong disagreement with the "trust"
metrics and their presentation. Since I have been unable to make the
calls due to persistent scheduling conflicts, I wanted to spell out the
concerns I discussed with several of you in Prague. I appreciate the
work that has gone into the metrics, but believe that the "trust"
metrics rely on a faulty premise, that gTLDs should be predictable,
rather than open to innovative and unexpected new uses.

The current draft mistakes a platform, a gTLD, for an end-product. A key
value of a platform is its generativity -- its ability to be used and
leveraged by third parties for new, unexpected purposes. Precisely
because much innovation is unanticipated, it cannot be predicted for a
chart of measures. Moreover, incentives on the intermediaries to control
their platforms translate into restrictions on end-users' free
expression and innovation.

Just as we would not want to speak about "trust" in a pad of printing
paper, on which anyone could make posters, and we don't ask a road
system to interrogate what its drivers plan to do when they reach their
destinations, I think we shouldn't judge DNS registries on their users'
activities.

ICANN's planned reviews of and targets for gTLD success should not
interfere with market decisions about the utility of various offerings.

In particular, I disagree with the second group of "trust" metrics, the
" Measures related to confidence that TLD operators are fulfilling
promises and complying with ICANN policies and applicable national
laws:" namely,
* Relative incidence of UDRP & URS Complaints; Relative incidence of
UDRP & URS Decisions against registrant;
* Quantity and relative incidence of intellectual property claims
relating to Second Level domain names, and relative cost of overall
domain name policing measured at: immediately prior to new gTLD
delegation and at 1 and 3 years after delegation;
* Quantity of Compliance Concerns w/r/t Applicable National Laws,
including reported data security breaches;
* Quantity and relative incidence of Domain Takedowns;
* Quantity of spam received by a "honeypot" email address in each new gTLD;
* Quantity and relative incidence of fraudulent transactions caused by
phishing sites in new gTLDs;
* Quantity and relative incidence of detected phishing sites using new
gTLDs;
* Quantity and relative incidence of detected botnets and malware using
new gTLDs
* Quantity and relative incidence of sites found to be dealing in or
distributing identities and account information used in identity fraud; and
* Quantity and relative incidence of complaints regarding inaccurate,
invalid, or suspect WHOIS records in new gTLD

Separately, I disagree with the targets for the "redirection,"
"duplicates," and "traffic" measures. All of these presume that the use
for new gTLDs is to provide the same type of service to different
parties, while some might be used to provide different services to
parties including existing registrants.

Thanks,
--Wendy


-- 
Wendy Seltzer -- wendy@xxxxxxxxxxx +1 617.863.0613
Fellow, Yale Law School Information Society Project
Fellow, Berkman Center for Internet & Society at Harvard University
http://wendy.seltzer.org/
https://www.chillingeffects.org/
https://www.torproject.org/
http://www.freedom-to-tinker.com/