Update On Steps To Combat Abuse And Illegal Activity

I want to take this opportunity to update the community on the progress we've made since my previous blog, Community Outreach On Interpretation and Enforcement of the 2013 RAA, as well as share with you our plans for convening a roundtable discussion at ICANN54 in Dublin.

Since my previous blog, I have had a number of conversations with registrars, parties that submit complaints to ICANN Contractual Compliance and other interested community members. My goal has been to facilitate a common understanding with respect to the issues surrounding the submission and handling of reports of abuse and illegal activity.

Submission of Abuse Reports: What Should a Valid Report of Abuse or Illegal Activity Look Like?

Registrars have indicated that some reports of abuse and illegal activity are so broad and vague that it makes it nearly impossible to investigate and respond. For example, a complaint may be submitted that says a website, www.hypothetical.example, is infringing, with no indication of what specific url(s) on the website are alleged to contain infringing materials, whether the complaint is about copyright infringement or trademark infringement or the sale of counterfeit products via the website, what work is alleged to be infringed, or whether the complaining party is the owner or an authorized agent of the intellectual property alleged to be infringed. Or a complaint may be submitted that says this website, www.hypothetical.example, is engaged in illegal activity or unfair trade practices, with no indication of the specific activity alleged to be illegal or unfair or what country's laws or regulations are alleged to be violated. It is nearly impossible for a registrar reasonably to understand, evaluate, investigate or respond to such reports.

Registrars also sometimes receive complaints of abuse or illegal activity, with no indication of who the complaining party is or how to contact the complaining party to respond. Some complaints are sent from a do-not-reply email address that makes it impossible for a registrar to respond or communicate with the complaining party.

Registrars also receive complaints on occasion that have been generated by automated programs. Sometimes a registrar will receive the identical complaint from an automated program multiple times on the same day or over the course of a week.

Sometimes a complaining party who is dissatisfied with a registrar's response to a complaint keeps submitting the identical complaint over and over again.

Some registrars also receive complaints that are specific to the laws of a particular jurisdiction, when the registrar believes that it is not subject to the provisions of those laws. ICANN recognizes that issues surrounding applicable law and jurisdiction are complex, and that registrars and those submitting complaints may have differing views on whether a registrar is subject to a particular law or regulation.

ICANN Contractual Compliance considers it reasonable for a registrar to expect that a report of abuse or illegal activity should meet at least the following criteria, absent extenuating circumstances or reasonable justification:

1. The complaining party should be identified in the abuse report and should provide a way for the registrar to contact the complaining party.
2. The specific url(s) that are alleged to be the source of the abuse or illegal activity should be identified, i.e., the registrar should not have to guess or search the website to understand where the offending material is located or offending activities are being conducted.
3. The nature of the alleged abuse or illegal activity should be identified with specificity, including identification of the relevant law or regulation alleged to be violated and the applicable jurisdiction where such law or regulation is in effect.
4. If the complaint alleges infringement or violation of an individual or entity's rights under a law or regulation, the report should identify the individual or entity whose rights are alleged to be violated or infringed, and the relationship between the complaining party and such rights holder (e.g., is the complaining party the individual or entity whose rights are alleged to be violated or infringed, or an authorized agent of that party or is there some other relationship).
5. If a court, regulatory authority or law enforcement agency has made a formal determination that abuse or illegal activity is taking place, that formal determination should be submitted if available.
6. If the abuse report requests the registrar's compliance with a particular law or regulation, it should set forth the basis for believing that the registrar is subject to that law or regulation.
7. A complaining party should not submit multiple abuse reports complaining about the same instance of the same activity if the registrar has previously responded to an abuse report about that activity.

Handling of Abuse Reports: What Constitutes an Investigation and Appropriate Response?

Parties submitting reports of abuse or illegal activity complain that registrars fail to conduct a reasonable investigation and don't respond appropriately.

There are considerable differences of opinion among members of the multistakeholder community regarding what constitutes an appropriate response to an abuse report. ICANN Contractual Compliance considers it reasonable for a complaining party who submits a complaint meeting the criteria outlined above to expect that a registrar will undertake at least the following steps in response to a report of abuse or illegal activity, absent extenuating circumstances or reasonable justification:

1. Acknowledge receipt of the complaint.
2. Look at the specific url(s) that are alleged to be the source of the abuse or illegal activity. (Examples of extenuating circumstances or reasonable justification for not doing so might include, for example, where the url is alleged to contain child pornography and accessing the content might subject the registrar to liability, or where the registrar might expose itself to malware by accessing the url.)
3. Promptly notify the registered name holder of the complaint, or where the name was registered through a reseller, notify the reseller and ask the reseller to notify the registered name holder of the complaint.
4. If submitted by the complaining party, consider and evaluate any formal determination by a court, regulatory authority or law enforcement agency regarding abuse or illegal activity. In doing so, the registrar may choose to take into account considerations such as jurisdiction and due process.
5. Communicate to the complaining party the substance of any response to the abuse report that is provided to the registrar or reseller by the registered name holder.
6. Communicate to the complaining party, within a reasonable period of time, the registrar's position and what actions, if any, the registrar proposes to take.

(Note that for purposes of Paragraphs 5 and 6 above, the complaining party may be ICANN if a complaint is sent by ICANN Contractual Compliance or may be a third party if a third party submits a complaint directly to the registrar.)

Sometimes a complaining party takes the position that that there is only one appropriate response to a report of abuse or illegal activity, namely to suspend or terminate the domain name registration. In the same circumstances, a registrar may take the position that it is not qualified to make a determination regarding whether the activity in question is illegal and that the registrar is unwilling to suspend or terminate the domain name registration absent an order from a court of competent jurisdiction. I am continuing to work toward finding ways to bridge these gaps.

Roundtable at ICANN54: The Role of Voluntary Standards in Combatting Abuse and Illegal Activity

When I was appointed to the position of Chief Contract Compliance Officer last October, I made a commitment to the community that I would look for ways that ‭ICANN‬ can help safeguard Internet users and registrants that may go beyond the contractual enforcement tasks for which we are responsible.

In a variety of other contexts, parties have voluntarily undertaken steps to combat perceived abuse and illegal activity on the web.

For example, a number of companies have established themselves as trusted providers of spam and malware blocklists, and many software companies, Internet Service Providers and others voluntarily use these blocklists to combat spam and malware. Some advertisers and payment processors have voluntarily agreed to adopt and implement a set of best practices to address the sale of counterfeit or infringing goods or services on websites. Some payment processors, advertisers, registrars and logistics companies have voluntarily developed and enforced policies intended to discourage or prevent the support of websites that are principally dedicated to selling illegitimate prescription drug products.

ICANN Contractual Compliance plans to convene a roundtable discussion, during ICANN54, to discuss whether any of these might provide a model for registrars and registries to voluntarily adopt standard practices to combat abuse and illegal activity. This discussion will revolve around the role that the adoption of voluntary self-regulatory practices by contracted parties in these areas may play in combatting abuse and illegal activity; it is not intended to lead to mandated practices.

I look forward to continuing dialogue with the community regarding ways to address illegal activity and abuse. Please join us on Wednesday, 21 October 2015 in Dublin for the session entitled Role of Voluntary Practices in Combatting Abuse and Illegal Activity.