[registrars] FYI re: Transfers

[elliot noss]

> Is there a "Deadbeats and Hijackers Constituency" driving these
> "clarifications"?

john, try the "average users who get screwed out of using the  
provider of their choice" constituency. membership is extremely large.

comments inline.

On 21-Sep-07, at 12:08 PM, John Berryhill wrote:

>
> Here is the utterly incomprehensible phrase that jumps out twice in  
> this
> document:
>
>> the domain name is in the registration
>> period after expiration,
>
> What is the "registration period after expiration"?
>

I will not excuse the tortured syntax but I suspect you are smart  
enough to know this refers to the registrar-defined period, not to  
exceed 45 days, after expiry and before RGP.

>
>
>>  2. A registrant change to Whois information is not a
>> valid reason to deny a transfer request.
>
> So, Registrars are to verify whois data UNLESS the Registrant  
> providing
> fraudulent whois data is requesting transfer of the domain name.   
> In that
> case, forget about verifying whois data, and let the hi-jacker, who  
> obtained
> the account login information and changed the WHOIS yesterday, run  
> with the
> name.
>

again, I think you well know that the advisory is intended to deal  
with minor changes in the whois that are used to create an excuse to  
deny transfers. the typical situation that we encounter is the  
combination of these two "security-friendly" provisions:

- renewal time approaches;
- registrant, often a small business, wants to change suppliers and  
realizes that their whois info needs to be updated (they moved,  
employee has left/was fired, etc.) and makes the change and then  
initiates a transfer;
- "security-friendly" policy 1 --------> sorry, you made a change and  
now you can't transfer the name for 60 days. of course this puts them  
past expiry leading to.......
- "security-friendly" policy 2 --------> sorry you are past expiry,  
you can now only renew not transfer.

a few things are important to note. first, what ICANN is reiterating  
is the current policy. now I am the last guy to say "a rule is a rule  
is a rule" but let's be clear that these ARE the current rules, are  
the result of consensus policy inside the ICANN process (one of the  
very very few things to actually make it through the process) and  
were put in place to facilitate registrants freedom to work with the  
supplier of their choice.

second, numerous registrars simply flout the existing policy and  
ignore it. ICANN has done nothing. I, and others, have complained  
about this loudly and publicly. they should be commended (ICANN I  
commend you!) for issuing an advisory. now they need to follow that  
with enforcement.

third, the security issues that are raised can be dealt with in a  
number of alternative ways, too numerous to enumerate here.

fourth, the inability to transfer because of the policy violations  
happens orders of magnitude more often than hijacking attempts.

last, the industry has done a FANTASTIC job of rectifying wrongdoing.  
when there is a hijacking of a name of any value registrars work  
together to rectify. in 2000 I created the indemnity system to allow  
us to cover NSI's often exposed ass. the network of compliance groups  
(bigger registrars) and operators (smaller registrars) does an  
amazing job of righting wrongs. there are simply more efficient and  
fair ways to do this than by denying transfers in violation of ICANN  
consensus policy.

the issues raised as "security concerns" are always about fraud. no  
question these happen on an exceptional basis. trying to correct them  
by restricting transfers in violation of policy as above is like  
strip searching every customer leaving wal mart in an attempt to stop  
shoplifting!

Regards
Elliot Noss