Verisign is in receipt of your email below. Verisign is the top-level registry operator. As such, Verisign has no relationship, contractual or otherwise, with the registrant of a domain name nor does Verisign provide any services to the registrant or the webhost. Therefore, Verisign will not take any actions pertaining to a domain name absent an order from a court of competent jurisdiction directing it to take actions that are within its technical capabilities. I recommend that you contact the relevant registrar or hosting service, who may be able to assist you with this request.

Yes, a contract change could enhance procedure but this is a VERY long road. Many of the parties who would be required to approve such a modification would be dead set against it. Changes to the contract have been made over the years to great benefit of Interest users, but this was very long and hard work. Additionally, contracted parties are usually allowed to wait to sign on to a new contract until their current contract has expired. By the way the memo can be found here: https://community.icann.org/display/atlarge/ALAC+Top+10+Issues?preview=/2262135/64076614/DONT_analysisoficannwdprs.pdf

Seems like this shouldn't require a contract change. ICANN can set policy, eg. saying that any domain that receives a valid WDPRS complaint may not be transferred until the registrar has responded to the complaint. Then when the automated notification is sent to the registrar, the registry gets a copy. The registry's required by existing contract to comply with ICANN policy, so they aren't supposed to accept a domain transfer if the registrar ignores policy and allows a transfer out. If the registry won't accept the transfer, nothing the registrars can do will transfer the domain or alter the WHOIS information. As Charles noted, doing this locking-down at the registry level isn't a hard problem since the software to do it already exists (that a registry might not want to make the effort to use the software is Not ICANN's Problem, only whether they comply or not). No, I'm not being naive. I fully understand the political problems involved. I just feel they should be handled by simply ignoring them as irrelevant to the point at hand.

Great points, Todd. :)

It's more that ICANN doesn't want to enforce things. The registrar you mention should've had their ability to be a registrar terminated on the spot, for instance, by either the registry or ICANN, and information recorded to keep the owners from ever operating any registrar ever again. As for Verisign, transferring the registry for .com to another operator would deliver the message clearly. ICANN controls the root nameservers, if it changes the configuration so they refer .com queries to someone other than Verisign there's not much Verisign can do about it. And Verisign's definitely one of the worse operators out there. They are, after all, the ones who caused the delegation-only configuration to be added to Bind to block them from returning false DNS responses (which blocks second-level hosts in all new TLDs without custom configuration by sysadmins). None of this requires any new technical capability or legal authority. It just requires the will to actually enforce the rules, which is where ICANN's lacking.

Let's just assume ICANN wanted to enforce here, they actually don't have many options. ICANN compliance issues breach notices with the intent to cure the breach, meaning there is an issue which the registrar must fix or face termination. For example, they have to pay an outstanding bill to ICANN, they have to restore a removed WHOIS service, they have have to provide some document etc, etc. So in this case, the domain is already transferred. What condition would need to be cured calling for a breach? You see there is no "court' here which finds acts of wrongdoing. As for ICANN taking .COM from Verisign, we'll hear Gabriel's Trumpet first (in the Biblical AND the mathematical sense)

The breach to be cured is the failure of the registrar to reject the transfer out of the domain after it's been suspended and they know the transfer isn't allowed. The cure is to not do that again. Second time, they've failed to cure the breach and they lose their status for breach of their agreement with the registry and with ICANN. And probably, because ICANN doesn't want to or is afraid to, which one makes no difference. Failure to use the tools they have doesn't make those tools not exist.

>I have to agree with Todd and Garth here, Charles, >in that there's clearly a problem here. We all agree. > I don't necessarily think we should terminate a registrar's >contract on ONE mistaken permitted transfer of a domain name You never heard me say such a thing. The problem is the transfer itself should have been IMPOSSIBLE, and is IMPOSSIBLE with other TLDS ... So what is that telling you? Please see the ICANN policy text and FAQ answers, I quoted in this post to this thread: http://www.circleid.com/posts/20140314_icann_complaint_system_easily_gamed/#11667

ICANN does not exist without the money flowing up from contracted parties. There is very little interest here in protecting the consumer.

"ICANN does not exist without the money flowing up from contracted parties. There is very little interest here in protecting the consumer." Agreed, and worth repeating. At the Sydney ICANN meeting a number of us via the webcast asked the question "How does ICANN serve registrants needs?" The question was taken and publicly asked, and the response was to shame us for even asking ... And the guy that presented the question is no longer with ICANN, what a surprise. A peer once asked the ICANN members "How many domains do each of you own?" ... Similar result.

RegFly also tried to steal some of my domains, but they were different domains and that is a story for another day.

LOL, I, too, remember RegisterFly. Shudder. eNom wasn't much better. Hopefully, Tucows will merge eNom's system onto its own, superior system. I went with RegisterFly on cost and it took forever to get them transferred over to GoDaddy (I'm now with Uniregistrar). However, that's a great example of a hard-lined negotiating approach by ICANN created WHOIS data escrow. :)

>Hopefully, Tucows will merge eNom's system onto its own, superior system. Tucows is notorious for keeping expired domains for themselves. No auctions, no nothing, from customers account into their own account. GoDaddy started doing that and then stopped once publicly exposed. Given eNom is one of the preferred registrars of dominers, i can see expired domains alone being motive for Tucows to gain access to that domain base ... Again, the backend stuff that goes on in this industry is far beyond what most good people are aware of.

That's true, I hadn't thought about Tucows' somewhat sleazy tactics at "gobbling up" expired domain names as well as their "owned" domain name portfolio (what did they brand it as..."YummyNames" or something?). I just meant...I like Tucows' domain name registration system and database over eNom, which still refuses to "purge" my username from their system. :(

Doesn't the current WHOIS data escrow archive multiple versions of a domain name's underlying, not publicly-visible, ownership information at regular intervals? Also, I thought it was required now, not optional, no? Even if it's "required," yes I agree there's potentially a way a nefarious registrar could "game" that "escrow" system, too, by essentially borrowing from the "old book of tricks" from shady companies that maintain two "accounting books" of the company, one for the "tax man" and the true one for their "shareholders," by essentially having two separate domain name databases. However, there'd be a way around this, which might or might not require a contract change: subject registrars to mandatory random audits at least every two years by ICANN (or an ICANN-appointed designated forensic accounting firm) and if ICANN or the designated firm senses so much as an "inkling" of obstruction, their registrar agreement can be terminated for cause on the spot and the registry ordered to bulk transfer their domain names. Also, with the number of registrars to audit, ICANN should also increase the annual and startup costs to become an ICANN accredited registrar such that many small registrars with only 100,000 (or less) domain names are forced to sell their assets to a larger player. As an aside, my very first registrar back in 1999 was directNIC.com (then legally known as Intercosmos Media Group or something like that) and I think even they've had some questionable history, right? Boy, I have a "knack" for picking crappy registrars - directNIC.com, RegisterFly and GoDaddy. I think I've finally found a GOOD one in Uniregistrar. Cheers, Doug

>The "extra" registrars do not actually have any domains, websites >or ability for a consumer to buy a domain from them. This needs correction. They do have domains, they do have websites, and they do sell domains. This is the business I have been in. These registrars are real, but the domains they sponsor are typically accessed through some other "more public" registrar. Its a simple management issue, ICANN contracts push catchers to have more registrars to catch, but making those all publicly facing registrars is redundant. It only takes one registrar to make the catches available to the market on behalf of all the others. By placing this cost onto drop catching the registries are spared an overwhelming electronic war on their backend servers. Not a perfect solution but it is what it is. But as you suggest, this moves us off topic.

And whenever I have asked ICANN staff about the redundant registrars their response is usually something like "I don't known what you're talking about"

>"I don't known what you're talking about" And that is a fair answer Garth. You call them redundant, that are not redundant. They are redundant to what *YOU* consider acceptable use, but that is your problem not ICANNs. If you want to compete in the drop catching industry you need lots of connections to the registries, and to do that you need registrars. That is the fact of it, and the other fact of it is these businesses give a lot of visibility to the overall domain name industry. Could the rest of the industry live without drop catching? Probably. So what? This is how they make their living. And if it did not exists the only difference is domineers would be getting even less sleep. They will be sitting at their PCs during drop time, madly wearing out their keyboards trying to registrar domains. So think of drop catching as being eco friendly, its saving the landfills all those worn out keyboards. :D Regardless of HOW it happens, it WILL happen, either manual method, or the current "drop catch server war" at the registries during drop time.

I'd say that just because that's how the drop-catching industry makes it's living isn't any reason at all that the domain name system has to accomodate them. My opinion is that those registrars are redundant to the intended functioning of the domain name system and if stopping bad behavior requires removing their business model and making life harder for the dominers, then that's their problem.

>if stopping bad behavior What is the "bad behavior" you wish to stop? And once you "stop" it using a dedicated registrar, how will you stop that "bad behavior" from being accomplished using someone else's registrar (which is how the industry started)? >removing their business model What is the business model you are objecting to?

Charles, Had a few discussions about this in Copenhagen and the registry lock is recommended but not required. There are good and bad registrars, but the system can be gamed here even so. Verisign is distinct in its position here from many other registries, but they are also the biggest which highlights the issue. Because ICANN cannot see the complexity of cybercrime and abuse they are not suited to handle the issues that result, hence the deeply flawed ticketing process. Their "Ticket Closure" philosophy is equivalent to delivering an upside-down plate with uncooked ingredients at a restaurant and saying "You got what was listed on the menu". So there is no hard policy to enforce, no will to enforce, no ability to effectively track and understand the issues. The failure is top-to-bottom and the criminals know this. -Garth

Well said, Garth. I hadn't thought about utilizing the "registry lock" function within the EPP registry framework/architecture. Good idea! What would it take to make this a requirement instead of a recommendation? Can ICANN implement it with, let's say, 60- to 90-day notice to the registries/registrars as a sort of "policy guidance notice" or would that still require a contract change? Cheers, Doug

Registry status is also "ok", I say this as I trust direct from the registry data more than the publicly facing data ... Which is sometimes different. Last update was: 2017-03-19T18:48:07Z Last transfer was: 2017-02-27T05:15:48Z So last update occurred shortly after this CircleID post. FWIW

As pedicted, DONT didn't stay down for long (never does), made more escapes than Houdini. By the way this domain doesn't just offer opioids, it also sells Rohypnol, AKA "roofies" or the date rape drug. Rohypnol is used in a predatory way when attackers place it in a drink consumed by an unsuspecting victim. Like all drugs it has a legitimate use, in this case for patients suffering from extreme insomnia. Drugs, like domains, are harmless until improperly used.