Cybercrime

ACPA Applies to Noncommercial Use of Domain Name

A recent decision by the Ninth Circuit confirms that "commercial use" by the defendant is required for a Lanham Act trademark or dilution claim, but is not required in a cybersquatting claim under the Anticybersquatting Consumer Protection Act (ACPA). Michael Kremer, a dissatisfied hair transplant patient, used the domain name www.BosleyMedical.com as a site critical to the Bosley Medical Institute, a hair transplant clinic. Bosley sued. The district court entered summary judgment for Kremer on the grounds that his conduct was not commercial... more

The Highest Threat TLDs - Part 2

In the first article of this two-part blog series, we looked at how frequently domains were used by bad actors for phishing activity across individual top-level domains (TLDs) or domain extensions, using data from CSC's Fraud Protection services, powered by our DomainSecSM platform. In this second article, we analyze multiple datasets to determine the highest-threat TLDs, based on the frequency with which the domains are used egregiously for a range of cybercrimes. more

ICANN’s Contract Not Enforceable on WHOIS Accuracy

This may or may not come as a shock to some of you, but ICANN's contract with the Domain Name Registrars, in terms of WHOIS inaccuracy is not enforceable. Bear with me. The ability of ICANN to enforce against a Registrar who fails to correct or delete a domain with false WHOIS does not exist. more

The Highest Threat TLDs - Part 1

A domain name consists of two main elements: the second-level domain name to the left of the dot - often consisting of a brand name or relevant keywords - and the domain extension or top-level domain (TLD) to the right of the dot. Domain names form the key elements of the readable web addresses allowing users to access pages on the internet and also allowing the construction of email addresses. more

HTTPS Web Hijacking Goes From Theory to Practice

I've been privately talking about the theoretical dangers of HTTPS hacking with the developers of a major web browser since 2006 and earlier last month, I published my warnings about HTTPS web hacking along with a proposed solution. A week later, Google partially implemented some of my recommendations in an early Alpha version of their Chrome 2.0 browser... This week at the Black Hat security conference in Washington DC, Moxie Marlinspike released a tool called SSL Strip... more

A Safe Pharmacy Environment in the Digital Age

Today's ever-evolving, digital world has fundamentally changed, enhanced and challenged the way in which businesses all over the world must operate. For organizations and professions that have existed for centuries, this has created the opportunity and the test of adapting to change to remain successful and relevant. The National Association of Boards of Pharmacy (NABP) was founded in 1904, at a time when there was little uniformity in the practice of, or standards for pharmacy. more

Cornucopia: A Radically Different Approach to TLDs

Much of the discussion about proposed TLDs centres around domain names as a form of classification: ".mobi" for mobile device content, ".kids" for child-safe content, language codes for language-specific content, ".museum" for museum-related entities, and so on. Notoriously little activity has been forthcoming in actually implementing these proposals, and the select few that have been allowed out into the world are, shall we say, a tad arbitrary. I'd like to engage in a little thought experiment where we abandon the "few TLDs with carefully chosen meanings" paradigm, and instead consider the benefits of a cornucopia of completely meaningless TLDs. more

The Hack Back Bill in Congress is Better Than You’d Expect

Rep's Graves and Sinema recently introduced H.R. 4036, the catchily named Active Cyber Defense Certainty Act or ACDC act which creates some exceptions to criminal parts of computer crime laws. Lots of reports have decried "hack back" but if you read the bill, it's surprisingly well targeted. The first change is to what they call Attributional Technology, and says it's OK to put bait on your computer for an intruder intended to identify the intruder. more

2.6 Billion Records Were Stolen, Lost or Exposed Worldwide in 2017, an 88% Increase From 2016

Over the past five years, nearly 10 billion records have been lost, stolen or exposed, with an average of five million records compromised every day. more

Orange Bowl ICANN UDRP Case Explores Fair Use

The resale of genuine products presents particular difficulties in domain name disputes, testing the application of fair use doctrine. Several domain name disputes involving the resale of event tickets illustrate the point. I served as a panelist in one such case The Orange Bowl Committee, Inc. v. Front and Center Tickets, Inc., D2004-0947 (WIPO 2005). The decision, which issued with a dissent, explored fair use in the domain name context and addressed several related ticket resale disputes. more

Equifax Breach: 9 Fraud Prevention Steps Everyone Should Take

The U.S. Internet Revenue Service now says that criminals already had most of the information that credit bureau Equifax lost in a breach that revealed personal information about nearly 150 million people. The incident at Equifax and the IRS' mid-October admission of how much-stolen data was already in criminal hands may force changes in how the world handles personal information. more

Google Sued in Domainer Lawsuit: Vulcan Golf v. Google

Domainer litigation is heating up, and this lawsuit may be the most ambitious anti-domainer lawsuit to date. First, it is a putative class action lawsuit. Second, in addition to naming four leading domainer firms, the plaintiffs provocatively go after Google for providing ads to domainer sites. I believe this is the first lawsuit against Google for its domainer relationships. The complaint itself is a 121 page, 638 paragraph (with one paragraph enumerating 47 defined terms), 4.3MB behemoth alleging trademark infringement and dilution, ACPA violations, RICO and other claims. more

Emerging Cyber-Security Threats and Implications for the Private Sector

The new gTLD program will have a profound impact on the private sector's increasing dominance over Internet information resources and ownership of critical registry technical infrastructure assets. It is already anticipated that only the private sector will take full advantage of the commercial possibilities... However, the successful introduction of new gTLDs will also create new challenges of security for the private sector. more

Freedom of Expression Part 2: Blocking, Filtering and Removing Online Content

The Internet is a catalyst for what has revolutionised and transformed human societies in giving extraordinary access to information that has catapulted development and economic growth. It also comes with threats of exploitation by those who wish to do harm. In Part 1 of these series, we looked at how Twitter banned Graham Linehan for his tweet where we saw that to an extent, it was justifiable under Californian law but that a Judge in the Fiji courts would disagree with. more

Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)

On Wednesday September 29th at 1PM there will be a meeting in the Old Executive Building in Washington D.C. with Registries and domain Registrars to discuss illegal Internet sales of prescription drugs. ICANN was originally invited but declined because citing "inappropriateness" . One "U.S." Registrar who definitely will not be in attendance is OnlineNIC more