[gnso-lockpdp-wg] Continuation of lock / Whois discussion from today

["Schneller, Matt" <Matt.Schneller@xxxxxxxxx>]

Hey everyone,

I wanted to follow up on one of the related threads that we closed the call 
today discussing.  (I think I slightly messed up the e-mail address last time - 
my apologies if you get this twice.)

Impact of the lock

The mandatory "lock" needs only to prevent changes to another "holder," UDRP 
8(a), or another "registrar," UDRP 8(b).  Any other changes may be permitted or 
denied based on registrar's policies, but that's a matter of contract between 
registrar and registrant.  I do not think we should either require or rule out 
any other steps by registrars, given the wide variance in registrar practice 
observed in our poll.

When changes of a "locked" field during a UDRP are permitted

Registrant changes are not permitted at all, except in one rare circumstance.  
UDRP 8(a) and 8(b) both have complete bars on transfers to new registrants or 
registrars during the pendency of the UDRP.  Full text:

8(a): You may not transfer your domain name registration to another holder (i) 
during a pending administrative proceeding brought pursuant to Paragraph 4 or 
for a period of fifteen (15) business days (as observed in the location of our 
principal place of business) after such proceeding is concluded;

8(b): You may not transfer your domain name registration to another registrar 
during a pending administrative proceeding brought pursuant to Paragraph 4 or 
for a period of fifteen (15) business days (as observed in the location of our 
principal place of business) after such proceeding is concluded.

It is possible that a Party can file a lawsuit or (if they have a contractual 
right to do so or are ordered by a court to do so) enter arbitration during the 
pendency of a proceeding under the UDRP.  This has the effect of "taking over" 
from the UDRP proceeding, and the Provider steps back until the other 
litigation or arbitration is complete.  UDRP 5-7.  The Policy recognizes that 
the court or arbitrator may issue an order affecting ownership of the domain.  
The Policy simply recognizes that it doesn't have any say-so over courts and 
arbitral panels that operate outside of the Policy, and so UDRP permits changes 
of registrants or registrars in this situation, under certain circumstances.

8(a): ... during a pending court proceeding or arbitration commenced regarding 
your domain name unless the party to whom the domain name registration is being 
transferred agrees, in writing, to be bound by the decision of the court or 
arbitrator

8(b): You may transfer administration of your domain name registration to 
another registrar during a pending court action or arbitration, provided that 
the domain name you have registered with us shall continue to be subject to the 
proceedings commenced against you in accordance with the terms of this Policy.

Thus, other than the tiny minority of UDRP proceedings that have 
contemporaneous lawsuits or non-UDRP arbitrations, there is no ability to 
change the registrant (and then only with the new registrant's written consent 
to be bound) or registrar (again, with the acquired registrar's agreement to be 
bound).

How the "lock" fits with other Whois policies

I do not believe that a complete lock requirement on registrant/registrar 
changes is in any way inconsistent with other ICANN policies related to WHOIS.  
I hope the specificity of the following paragraphs provides enough value in 
clarity to make up for its boring-ness.

The Whois Data Reminder Policy requires registrars to remind registrants using 
their service on a yearly basis to suggest that registrants correct inaccurate 
data.  
www.icann.org/en/resources/registrars/consensus-policies/wdrp<http://www.icann.org/en/resources/registrars/consensus-policies/wdrp>.
  That policy flows from two provisions in the RAA that are more directly 
applicable here. 
www.icann.org/en/resources/registrars/raa/ra-agreement-21may09-en.htm<http://www.icann.org/en/resources/registrars/raa/ra-agreement-21may09-en.htm>.

First, registrars are required to include a provision in their agreements with 
registrars that registrants provide them with "accurate and reliable contact 
details and promptly correct and update them."  RAA 3.7.7.1.  RAA 3.7.7.2 
provides (some) teeth in cases where registrants fail to live up to either the 
requirement to provide accurate data up front and/or the requirement to keep 
that data accurate: it permits but does not require a registrar to cancel a 
domain name registration due to (1) the customer's "willful provision of 
inaccurate or unreliable information"; (2) the customer's "willful failure 
promptly to update information provided to" the registrar; or (3) the 
customer's "failure to respond for over fifteen calendar days to inquiries by 
Registrar concerning the accuracy of contact details."  Registrars are given 
considerable latitude to decide whether and how quickly to enforce its rights, 
e.g., to take slow or no action where the inaccuracy is a minor and harmless 
error and to act quickly when severe inaccuracies that are being used to 
exploit, say, a fraud.  See 
www.icann.org/en/news/announcements/advisory-03apr03-en.htm<http://www.icann.org/en/news/announcements/advisory-03apr03-en.htm>.

Therefore, the Registrar can exercise its discretion under the RAA and simply 
note that a UDRP is pending, and thus changes to registrant information are 
temporarily barred due to the lock.  Failure to further update of the Whois 
record (prevented due to the UDRP-related lock) thus cannot be a "willful" 
failure to update the registrant's information under situation (2).  If the 
inaccurate information was willfully provided, it must have been provided prior 
to the imposition of the lock, and so violated situation (1) in any event, but 
the registrar cannot unilaterally cancel a registration during the pendency of 
a UDRP anyway.  UDRP 3, 7.  As to situation (3), the registrant can meet its 
obligation by simply responding to Registrar - it does not actually need to 
update the contact information: as ICANN advised at the time, (3) "is only 
triggered when the customer fails to respond to an inquiry; it is not triggered 
when the customer responds to the inquiry but does not complete any corrections 
to inaccurate or out-of-date Whois data within 15 days."  
www.icann.org/en/news/announcements/advisory-03apr03-en.htm<http://www.icann.org/en/news/announcements/advisory-03apr03-en.htm>.

The owner can still update its contact information for the purposes of the UDRP 
proceeding under UDRP Rule 2(e), but this update won't necessarily be reflected 
in the Whois records while the UDRP proceeding is pending (definitely not if 
the change is to the registrant, maybe or maybe not if the change is to other 
fields, depending on the registrar's policies).  If the UDRP proceeding is 
resolved in the Respondent's favor, the registrant can then update Whois if 
necessary.

Sorry to drone on at such length.  I look forward to hearing everyone else's 
comments!

Matt Schneller | Attorney | Bracewell & Giuliani LLP
701 Fifth Avenue, Suite 6200, Seattle, WA 98104-7043
T: 206.204.6241 | F: 800.404.3970 | C: 206.679.1895
matt.schneller@xxxxxxxxx<mailto:matt.schneller@xxxxxxxxx> | 
www.bgllp.com/schneller<http://www.bgllp.com/schneller>