At their best, UDRP panelists are educators. They inform us about the ways in which parties win or lose on their claims and defenses. What to do and not do. In addressing this issue, I'm referring to less than 10% of cybersquatting disputes. For 90% or more of filed complaints, respondents have no defensible answer and generally don't even bother to respond. But within the 10%, there are serious disputes of contested rights (contested even where respondent has defaulted). In following the decisions in these disputed cases, we learn that those who lose (whether complainant or respondent) fail in the mechanics of argument: marshaling the right facts, supporting their contentions with documentary evidence, and organizing materials into coherent narratives.

Panels help us to see this. Complainant in Distinct Holdings, Inc., d/b/a Diversified v. Robert Schweitzer, FA1706001737080 (Forum July 27, 2017) owner of DIVERSIFIED succeeded in having four domain names transferred, while Complainants in High Adventure Ministries v. JOHN TAYLOE / VOICE OF HOPE, FA1706001737678 (Forum August 9, 2017) owner of VOICE OF HOPE and Opus Group AB v. Opus Group LLC, D2017-1061 (WIPO July 12, 2017) owner of OPUS lost in gaining control of domain names corresponding to their marks. In all three disputes, the marks are either dictionary words—DIVERSIFIED and OPUS—or common expressions—VOICE OF HOPE.

In Distinct Holdings, Complainant carefully anchors facts to documentary proof. This technique calls for a response (it demands rebuttal), but the Panel concluded that "Respondent's whole case [is] unpersuasive. The known facts are those set out [by Complainant] and it was incumbent on Respondent to give to the Panel an explanation for" acquiring <onediversified.com>, <onediversified.info>, <onediversified.net>, and <onediversified.org> when it had actual knowledge (as a former employee) that Complainant was in the process of rebranding itself to "One Diversified."

To the same extent it was "incumbent on Respondent" in Distinct Holdings, so it was (in reverse) with Complainants in High Adventure Ministries and Opus Group. They either had no provable facts (as summarized, their "facts" are essentially conclusory or allegations of inference) or if provable facts exist they failed to marshal them. In High Adventure Ministries, the Panel stated that it was "unable to find that Complainant has made out a prima facie case." Even, "if there were a prima facie case [the Panel continued], the totality of the evidence has clearly rebutted it."

In Opus Group, Complainant failed in two ways. First, by blindly assuming it had an exclusive right to a string of characters that before they could ever be recognized as a mark is simply a generic term (Respondent defaulted, but there were unresponded to facts of record). The Panel found no

justification on the evidence before it for the Complainant's assertion that "it is obvious that the Respondent was well aware of the Complainant's trademarks and business when registering the Domain Name." The Panel does not accept that, even if there were evidence that the person registering the Domain Name <opusgroup.com> was aware of an entity carrying on business as Opus Prodox that owned the registered trademark OPUS PRODOX, this would demonstrate that the registration was likely to have been in bad faith.

Secondly, Complainant made no effort to deal with the fact of record (that is, a category of facts that parties ignore at their peril):

The Complainant entirely ignores the fact that the WhoIs-listed Registrant Organisation is "Opus Group LLC" and that, leaving aside the corporate tag "LLC", the Respondent may not only commonly be known by the Domain Name but, on its face at least, the Domain Name is its name. The Complainant has not disputed this or adduced any evidence throwing doubt on the bona fides of the Respondent as to its name, or as to when the Respondent was incorporated by that name or as to the activities of the Respondent company.

These last two decisions involve respondents engaged in businesses of their own. This is also true of Respondent in Commune de Versailles Collectivité Territoriale v. Kimberly Kubalek, Kubalek, LLC, D2017-0985 (WIPO August 24, 2017) (<visitversailles.com>). She operates websites incorporating geographical terms, so it's a business built around a theme as opposed to acquiring domain names for resale. "Versailles" is generic but since Complainant owns a French trademark in the term it had standing to maintain the proceeding. However,

The disputed domain name itself uses a first element "visit" as a prefix for "Versailles" which is entirely consistent with a descriptive use of a geographic name for a place, rather than the abusive use of a trademark.

The Panel notes further that

in terms of demonstrable preparations, Respondent does operate an active tourism website at "www.visitsanmiguel.com", which provides travel information to visitors of San Miguel in Mexico and that at the bottom of such website Respondent includes the message "Visit our other sites", and links to websites referring to other geographical locations, such as "www.visitcuernavaca.com" and "visit-tahoe.com".

The Commune de Versailles Respondent offered a coherent narrative together with proof of her business model. These were the persuasive elements of her defense.

Different demands are made on high-volume acquirers. Respondents in the business of monetizing and reselling domain names, and others experienced or knowledgeable in Internet technology and culture early came under additional scrutiny. This is particularly the case with domain names that incorporate marks combined with generic terms that could reference back to complainants, which if passively held support lack of rights or legitimate interests.

The scrutiny is illustrated in an early case, Red Nacional De Los Ferrocarriles Espanoles v Ox90, D2001-0981 (WIPO November 21, 2001). Respondent (admittedly a knowledgeable Internet analyst) registered the recently lapsed domain name <renfe.com>. The Panel held that

where there is an intentional registration of a domain name by one with obvious reason to believe that it might be the trademarked name of another, combined with an intentional or reckless failure to verify whether that is the case and without making even the most basic inquiry, constitutes registration of that domain name in bad faith.

There was a vigorous dissent in this case, but the majority view for lapsed domain names (assuming the marks have established themselves in the marketplace) is the consensus opinion: "when the facts demonstrate clearly that someone else has been extensively using the Domain Name and that it has obvious value, at least some minimal investigation is required in order to dispel the logical inference that the Domain Name is someone else's trademark or at least another s well-known business name."

If panelists have a skeptical view, respondents must anticipate it. It applies equally to high-volume registrants who "through automated programs . . . snap up domain names as they become available, with no attention whatsoever to whether they may be identical to trademarks." Media General Communications, Inc. v. Rarenames, WebReg, D2006-0964 (WIPO September 23, 2006) (<wcmh.com>). "Such practices" (the Panel continued) "may well support a finding that respondent is engaged in a pattern of conduct that deprives trademark owners of the ability to register domain names reflecting their marks." "Pattern of conduct" is a showing complainant must make and respondent rebut.

Whether there are such "patterns of conduct" is answered by taking into account respondents' business histories. I think it can be said that as a general rule, though, investors specializing in curated categories of names, such as 2 to 5 letter strings, place names, surnames, dictionary words, and descriptive terms that have market values independent and unrelated to any association with complainants' marks and used for their common meanings are less vulnerable to losing their domain names than high-volume registrants who must explain how their acquisition policies avoid sweeping in infringing domain names (indicated in Media General Communications). These vacuuming cases had their day but are not much seen recently, although they could return as major portfolios change ownership.

The cases that are seen involve domain names that are identical or confusingly similar to weak marks. In this group Respondents (generally well represented by counsel knowledgeable of the jurisprudence) are careful to include their histories (and copies of their websites) in responding to complaints:

• dictionary words — Fakir Elektrikli EV Aletleri Diş Ticaret Anonim Şirketi v. Development Services, Telepathy, Inc., D2016-0535 (WIPO May 21, 2016) (<fakir.com>);
• descriptive terms — Nilson Group AB v. Domain Admin, Frontline Media, D2016- 0334 (WIPO May 27, 2016) (<feetfirst.com>); FPT Industrie S.p.a. and REM Industrie S.r.l. v. HugeDomains.Com, D2017-0842 (WIPO July 7, 2017) (<fastmill.com>);
• idioms — Easton Corp Pty Ltd v. Privacydotlink Customer 951873/DNS Admin, Best Web Limited, D2016-1975 (WIPO November 12, 2016) (<hottie.com>);
• surnames — Micah Hargress v. PARAMOUNT INTERNET, FA1509001638609 (Forum November 13, 2015) (<hargress.com>); and
• three or four letter strings — SOG Specialty Knives and Tools, LLC v. Val Katayev / Poise Media Inc., FA170400 1726464 (Forum May 23, 2017) (<sog.com).

The more deliberate strategy for acquiring domain names for specific purposes (curating a portfolio of domain names) the greater the likelihood that the registrations will not be found unlawful.

The expectations that respondents of themed domain names prevail is upended in a surname case, Ruffino SRL v. Stanley Pace, FA1706001735061 (Forum July 20, 2017) (RUFFINO and <rufino.com>). Respondent owns a portfolio of 10,000 surnames including which Complainant argues is a typo infringement of RUFFINO while Respondent argues the name (purely and simply) is a surname, albeit not in the category of "Smith" or "Brown" but nevertheless lawfully registered. The question in Ruffino SRL is whether Respondent offered the right balance of evidence or the Panel reached its decision by drawing negative inferences from conclusory allegations.

If the Panel stepped into error, we are destined to learn since Respondent has commenced an ACPA action for declaratory judgment that the registration was not unlawful.

For complainants and respondents alike it is not sufficient to make conclusory allegations or allegations based on inferences. The evidentiary demand is for facts supported by documentary evidence; or evidence of sufficient weight to permit the drawing of reasonable inferences. This is not party specific!

Written by Gerald M. Levine, Intellectual Property, Arbitrator/Mediator at Levine Samuel LLP

After its first edition in Valencia, Brands and Domains will travel this time to the Netherlands where the second conference will take place from the 2nd to 3rd of October 2017.

This time, Dot Stories, the main organizer, chose the Hotel Amrath Kurhaus for the event. Nowadays, more than 600 applicants hold already the right to start their own dot brand, but there are not so many who have been brave enough to use it.

The objectives of the Brands and Domains conference are:

• Inform and educate brands about the existing use cases. Support the integration of dotBrand in the global digital marketing tools landscape.
• Educate communication and web agencies about the potential of dotBrand domains.
• Raise awareness of dotBrand global programme.
• Connect the world of digital marketing and branding with the domain name ecosystem.

In this second edition of Brands & Domains conference, there will be featuring speakers such as Akram Atallah, Deputy CEO and President, Global Domains Division of ICANN and Georges Edouard Dias, CEO of Quantstreams and ex Chief Digital Officer of l'Oreal. We will also exclusively share the results of an SEO contest run by web agencies, and will also involve universities and researchers.

The conference is a neutral and non-biased platform, where attendees and speakers will debate and exchanges point of views. The topics are organized in four main categories:

• Governance
• Brand Protection
• Customer Experience
• Brand Communication

Attendees are executives or senior managers from brands and agencies around the world. Registrars and registries will connect with marketers and brand specialists to help develop and generate brand value.

For more information, visit brandsand.domains

Written by Sara Vivanco, Marketing Manager

Despite the launch of more than 1,200 new generic top-level domains (gTLDs) in recent years, .com remains — far and away — the top-level domain that appears most frequently in decisions under the Uniform Domain Name Dispute Resolution Policy (UDRP). But, some new gTLDs are attracting more disputes, including .site, which has become the new gTLD that, so far this year, has appeared in the most UDRP decisions.

The rise of .site represents a change from last year, when .xyz was the most-often disputed new gTLD. Indeed, in 2016, .site was only the ninth most-disputed new gTLD, trailing not only .xyz but also (in descending order) .top, .club, .online, .vip, .store, .website and .cloud.

None of these new gTLDs is giving .com a run for its money in the domain name dispute arena. So far this year, 71.83% of all domain names in UDRP disputes include .com. In a distant second place is .net, with 5.45%. Domain names that include the .site gTLD account for 2.18% of UDRP disputes.

(As always when I report on domain name dispute statistics, this data is based solely on UDRP cases filed at WIPO, which is the only UDRP service provider that publishes real-time statistics. But, since WIPO is the most popular of the UDRP service providers, its data may be informative.)

Despite the relatively small numbers, the increase in the number of .site disputes is significant. In 2016, only 18 domain names that included .site were the subject of UDRP cases at WIPO; yet, in less than nine months this year, the number has risen to 74.

A search of UDRP decisions at the Forum (the second-most popular UDRP service provider) identifies an additional 10 .site disputes. Plus, the Forum has had eight .site domain names in determinations under the Uniform Rapid Suspension System (URS). (WIPO does not accept URS cases.)

So, why is .site suddenly a popular new gTLD to dispute? I have a few thoughts:

• .site domain name registrations overall are relatively popular. With more than 538,000 domain name registrations, .site is now among the top 10 new gTLDs, according to nTLDStats.
• .site domain name registrations are being offered for only 99 cents for the first year — which may mean that domainers are attracted to them without much regard for potential trademark issues that arise in UDRP and URS proceedings.
• As a short and simple new gTLD, .site has probably attracted the attention of trademark owners, who consider cybersquatting to be more problematic than in other new gTLDs, such as (to name just two) .engineering or .scholarships — which so far have not appeared in any UDRP cases at WIPO or the Forum.
• In many cases, .site domain names are being registered by cybersquatters along with other new gTLDs. For example, Philip Morris filed a UDRP complaint for 18 domain names, only one of which included the .site gTLD (<marlboro-cigs.site>); and Tinder filed a complaint for 15 domain names, but only one (<tindersafe.site>) was not a .com.

Whether .site domain names will continue to attract more disputes than any other new gTLD is far from certain. I wouldn't be surprised if a different new gTLD takes the lead later this year or next year, but I suspect there will always be a correlation between the popularity of a top-level domain and the number of disputes that it attracts.

Written by Doug Isenberg, Attorney & Founder of The GigaLaw Firm

Over the past couple of weeks, following the events in Charlottesville, Virginia, there has been significant discussion in social and traditional media about various technology companies removing websites from their servers, or otherwise making them unavailable.

As the operators of Canada's Internet domain, we at CIRA are getting numerous inquiries about our stance and policies on this issue. I'd like to use this opportunity to make a couple of clarifications about how CIRA works and what CIRA actually does.

First, and perhaps most importantly, CIRA has no involvement on the content of .CA websites. Our role is to manage the registration of the domain name and to ensure that Registrants (those that register .CA domain names) and Registrars (the organizations that sell the .CA domain to Canadians) meet CIRA's legal and policy requirements, such as Canadian Presence Requirements. We are also responsible for the safe, secure and stable operation of the underlying domain name system (DNS). We are one part of Canada's Internet ecosystem, working with registrars and web hosting companies who interact directly with Canadian organizations and individuals who purchase a .CA domain and host relevant content. Policing content is not what we do.

I've written before about an open and free Internet, and I stand firm in this belief. I must take this stance even when it supports content that differs from my personal beliefs. Open means open for all.

This doesn't mean that I don't struggle with it. I find many of the websites in question repugnant — websites that express derogatory views of people based on their religious beliefs, race, gender or sexual orientation. They go against everything I believe in and the values I teach my children.

But I stand firm that the Internet must remain free and open, and taking actions to remove websites, regardless of how repellent the content, would go directly against this approach. A free and open Internet precludes my personal beliefs related to its content, and I couldn't continue to lead CIRA, an organization committed to managing Canada's domain, if I didn't support this viewpoint for all Canadians, even those I disagree with. One individual should not have the power to make these decisions based on personal beliefs or as an emotional reaction. CIRA has policies in place to ensure this can't happen.

There is, however, a clear line to this open and free Internet: when laws are broken.

CIRA will assist authorities to remove sites that are breaking the law, be that through hate speech, fraud and others, when presented with a Canadian court order or other judicial instrument. For example, a .CA domain was recently seized by the Edmonton Police Service. This fraudulent site was stealing financial information and money from people, and through a court order, CIRA assisted the Edmonton Police. This is a prime example of a line that was crossed. The proper authorities were involved, a judicial order was sent, and CIRA took appropriate action. We support the ideals of an open Internet but not at the expense of the laws of the land.

To those who reached out to us concerned that we may be participating in what they feel is censorship, you can rest assured we are not. And to those who would like to see us engage in this more heavily by taking down hateful sites, we would ask you to examine these sites and if you feel they are promoting hate speech or breaking the law, contact your local authorities and work with them first. The processes exist for CIRA, as well as our channel partners and Canadian hosting companies, to work with the legal system to prevent criminal activities in our digital space.

An open and free Internet includes the zealots that spout outlandish ideas, and on the other end of the spectrum, cat videos. More importantly, it includes helpful information, art, science and transformative, democratizing thinking. And that is worth protecting, even it if means protecting the others as well.

While I don't agree with the content of all websites that hold a .CA, I support their right to exist as long as they remain within the bounds of Canadian law. Sites that are racist, sexist or homophobic make sense to many of us to take down. But just because that makes sense to you or me it doesn't make it right.

Take the Miller test (read up on it here), which is the United States Supreme Court's three prong obscenity test. One of those prongs relates to the community within which the content exists. The Internet muddies the water here. While content may be published in one community, it can be consumed in another. So how do you define "community" in the Internet age? What is offensive to some, is not to others.

The Internet connects us all, across Canada and beyond. It includes divergent opinions and perspectives on many different issues. It is not for me or CIRA as a whole to decide which opinions are right or wrong, but rather, it is our responsibility to stand by the continuation of an open and free Internet — while also working to protect the .CA space by working within — and helping enforce — Canadian law.

Written by Byron Holland, President and CEO of CIRA

The Uniform Domain Name Dispute Resolution Policy (UDRP) is known as an inexpensive alternative to litigation (and that's true), but some proceedings can end up costing a trademark owner more than it may have expected.

There are generally two additional types of expenses that can arise during the course of a UDRP proceeding: (1) extra filing fees for certain aspects of a case filed at the Forum, and (2) an increased filing fee if the domain name registrant wants a three-member panel to decide the case.

These fees are in addition to the initial filing fee that a trademark owner is required to pay a UDRP service provider when it submits a complaint.

Mandatory Filing Fee

The initial filing fee (required in every UDRP case) is approximately the same at the World Intellectual Property Organization (WIPO) and the Forum, which together account for about 97% of all UDRP proceedings: At WIPO, the filing fee starts at $1,500 for a complaint that includes up to five domain names and a single-member panel. At the Forum, the starting fee is $1,300 for up to two domain names and a single-member panel.

(The fees at two of the smaller providers — the Asian Domain Name Dispute Resolution Centre (ADNDRC) and the Arab Center for Domain Name Dispute Resolution (ACDNDR) — are comparable, starting at $1,300 and $1,500, respectively. But the fees at the Czech Arbitration Court, which is much less popular, start at $500.)

Since a trademark owner can choose where to file its UDRP complaint, it should know at the beginning what fees to expect.

Additional Fees at the Forum

If a trademark owner files its UDRP complaint at the Forum, it should be aware of three instances in which additional fees may arise.

The first possible increased filing fee at the Forum applies where a complaint contains "arguments alleging Respondent aliases."

Specifically, the Forum's Supplemental Rules state:

If a Complainant alleges that a single Respondent is using multiple aliases and makes such arguments in the Complaint for Panel consideration..., the filing fee shall be increased proportionately to the number of aliases involved. Please contact the FORUM… with the number of domain names and the number of aliases to obtain a fee quote.

This would arise where a complainant believes that a single person or entity is the registrant of multiple domain names and has used "aliases" or different names when registering the domain names. Cybersquatters sometimes do this to frustrate a trademark owner's ability to include all of the domain names in a single complaint, something the UDRP allows where "the domain names are registered by the same domain-name holder."

Alleging respondent aliases is an efficient tactic for a complainant but could lead to significant additional work by the UDRP service provider, which, I assume, is why the Forum charges an additional fee in those cases.

The second possible increased filing fee at the Forum applies where a party (either the complainant or respondent) submits "additional written statements and documents" — that is, a submission in addition to the complaint or response.

This situation would typically occur if a complainant wants to respond to a response (sometimes referred to as a "Complainant's Supplemental Filing") or if a respondent wants to respond to a Complainant's Supplemental Filing. The UDRP itself does not expressly allow these additional filings (if submitted without solicitation by the service provider or panel), so the Forum charges an additional fee for them.

This additional fee of $400 is somewhat controversial, not only because none of the other UDRP service providers charge it, but also because some panels won't consider supplemental filings even if the extra fee is paid.

The third possible increased filing fee at the Forum applies where a respondent requests extra time to submit its response.

While the UDRP Rules state that a provider "shall automatically grant [an] extension" upon request for four days, a respondent can also request a further extension of up to 20 days. If a respondent makes that request, the Forum requires payment of a $100 "extension fee."

Additional Fees for Three-Member Panels

A different type of additional fee that a trademark owner should know about when filing a UDRP complaint applies at all of the UDRP service providers — the Forum, WIPO, ADNDRC, CAC and ACDNDR — because it is in the UDRP Rules, not in any of the providers' supplemental rules.

This fee arises in a very limited but important situation: when a complainant has requested only a one-member panel but, the respondent requests a three-member panel. In that case, the complainant would have paid the filing fee for a single-member panel, but the rules state that each party shall pay half of the fee for a three-member panel.

Here's an example of how this plays out:

1. Complainant pays an initial filing fee to WIPO of $1,500 for a UDRP complaint with one domain name, requesting a single-member panel.
2. Respondent files a response and requests a three-member panel. The fee for a three-member panel in this situation is $4,000. The respondent must pay half of this fee, that is, $2,000, when filing its response.
3. The other half of the fee, that is, the other $2,000, must be paid by the complainant. Because the complainant initially paid $1,500, it must now submit an additional fee of $500.

While this situation ends up costing a complainant more ($2,000 total) than it had paid when it chose a one-member panel ($1,500), it is less expensive for the complainant than if it had elected a three-member panel itself when filing the complaint, in which case it would have been responsible for the entire $4,000 filing fee.

Conclusion

In most UDRP cases, none of these additional fees arise. Typically, a trademark owner pays the filing fee for a one-member panel and may not incur any further expenses. But because they are possible, it is important to be prepared (and ready to pay) when filing a complaint.

Written by Doug Isenberg, Attorney & Founder of The GigaLaw Firm

Excerpt from my Internet Law casebook discussing transborder content removal orders, including the Equustek case.

From the Internet's earliest days, the tension between a global communication network and local geography-based laws has been obvious. One scenario is that every jurisdiction's local laws apply to the Internet globally, meaning that the country (or sub-national regulator) with the most restrictive law for any content category sets the global standard for that content. If this scenario comes to pass, the Internet will only contain content that is legal in every jurisdiction in the world — a small fraction of the content we as Americans might enjoy, because many countries restrict content that is clearly legal in the U.S.

Perhaps surprisingly, we've generally avoided this dystopian scenario — so far. In part, this is because many major Internet services create localized versions of their offerings that conform to local laws, which allows the services to make country-by-country removals of locally impermissible content. Thus, the content on google.de might vary pretty substantially from the content on google.com. This localization undermines the 1990s utopian vision that the Internet would enable a single global content database that everyone in the world could uniformly enjoy. However, service localization has also forestalled more dire regulatory crises. So long as google.de complies with local German laws and google.com complies with local U.S. laws, regulators in the U.S. and Germany should be OK...right?

Increasingly, the answer appears to be "no." Google's response to the European RTBF rule has highlighted the impending crisis. In response to the RTBF requirement that search engines to remove certain search results associated with their names, initially Google only de-indexed results from its European indexes, i.e., Google would scrub the results from Google.de but not Google.com. However, European users of Google can easily seek out international versions of Google's search index. An enterprising European user could go to Google.com and obtain unscrubbed search results — and compare the search results with the localized edition of Google to see which results had been scrubbed.

The French Commission Nationale de l'Informatique et des Libertés (CNIL) has deemed this outcome unacceptable. As a result, it has demanded that Google honor an RTBF de-indexing request across all of its search indexes globally. In other words, if a French resident successfully makes a de-indexing request under European data privacy laws, Google should not display the removed result to anyone in the world, even searchers outside of Europe who are not subject to European law.

The CNIL's position is not unprecedented; other governmental agencies have made similar demands for the worldwide suppression of content they object to. However, the demand on Google threatens to break the Internet. Either Google must cease all of its French operations to avoid being subject to the CNIL's interpretation of the law, or it must give a single country the power to decide what content is appropriate for the entire world — which, of course, could produce conflicts with the laws of other countries.

Google proposed a compromise of removing RTBF results from its European indexes, and if a European attempts to log into a non-European version of Google's search index, Google will dynamically scrub the results it delivers to the European searcher. As a result, if the European searcher tries to get around the European censored results, he or she will still not see the full search results. (Of course, it would be easy to bypass Google's dynamic scrubbing using VPNs). CNIL has rejected Google's compromise as still unacceptable.

If CNIL gets its way, other governments with censorious impulses will demand equal treatment. But even Google's "compromise" solution — walling off certain information from being available in a country that seeks to censor that information — will be helpful to censors. In effect, the RTBF ruling forces Google to build a censorship infrastructure that regulators can coopt for other censorious purposes. Thus, either way, the resolution to the RTBF's geography conundrum provides a preview of the future of global censorship.

The Equustek Case

The local violation/global removal debate is taking place in other venues as well. In 2017, the Canada Supreme Court ordered Google to globally remove search results based on alleged Canadian legal violations. Google Inc. v. Equustek Solutions Inc., 2017 SCC 34.

In that case, Datalink, a competitor of Equustek, sold products that allegedly infringed Equustek's intellectual property rights. After Equustek sued Datalink, Datalink relocated to an unknown location outside of Canada, putting it out of the reach of Canadian courts. Equustek asked Google to deindex Datalink's website. Google partially deindexed the site from google.ca, but Equustek sought more relief. The Canada Supreme Court ordered global deindexing of Datalink's website:

The problem in this case is occurring online and globally. The Internet has no borders — its natural habitat is global. The only way to ensure that the interlocutory injunction attained its objective was to have it apply where Google operates — globally. As Fenlon J. found, the majority of Datalink's sales take place outside Canada. If the injunction were restricted to Canada alone or to google.ca, as Google suggests it should have been, the remedy would be deprived of its intended ability to prevent irreparable harm. Purchasers outside Canada could easily continue purchasing from Datalink's websites, and Canadian purchasers could easily find Datalink's websites even if those websites were de-indexed on google.ca. Google would still be facilitating Datalink's breach of the court's order which had prohibited it from carrying on business on the Internet....

The order does not require that Google take any steps around the world, it requires it to take steps only where its search engine is controlled....

This is not an order to remove speech that, on its face, engages freedom of expression values, it is an order to de-index websites that are in violation of several court orders....

This does not make Google liable for this harm. It does, however, make Google the determinative player in allowing the harm to occur.

The court noted that Google admitted it would be easy to deindex Datalink's domain name, and the court noted that Google regularly deindexes content for other reasons, such as the DMCA online safe harbor.

The court dismissed the risk of international conflicts-of-laws because everyone apparently accepted that Datalink would violate Equustek's IP rights under other countries' laws. However, the court was surprisingly unspecific about the alleged IP violations, which apparently included trademarks and trade secrets. Due to the ambiguities about the alleged IP violations, the court avoided some subtle IP issues, such as the scope of Equustek's trademark rights (usually trademark rights don't reach beyond a country's borders, so a Canadian court could not order a defendant to stop infringing trademark rights in other countries) and the likelihood that Canadian trade secret laws and remedies differ from the laws and remedies of other countries. See Ariel Katz, Google v. Equustek: Unnecessarily Hard Cases Make Unnecessarily Bad Law, ArielKatz.org, June 29, 2017.

Because the court sidestepped the international conflicts-of-laws issue, the Equustek case's facts do not implicate the more problematic situation where Datalink's content violates Canadian law but is legal in other countries, yet a Canadian court order under Canadian law prevents the content from being available in countries where it was legal. (The CNIL-demanded rule would reach this outcome, because RTBF-scrubbed content illegal in Europe would be almost certainly legal in the U.S.). The court said that Google could challenge the injunction in Canadian courts if the injunction violates other countries' laws — but will Google really spend substantial money and time to defend a third party content by going back to a Canadian court to adjudicate the content's legitimacy?

In response to the opinion, Canadian law professor Michael Geist wrote:

What happens if a Chinese court orders it to remove Taiwanese sites from the index? Or if an Iranian court orders it to remove gay and lesbian sites from the index? Since local content laws differ from country to country, there is a great likelihood of conflicts. That leaves two possible problematic outcomes: local courts deciding what others can access online or companies such as Google selectively deciding which rules they wish to follow. The Supreme Court of Canada did not address the broader implications of the decision, content to limit its reasoning to the need to address the harm being sustained by a Canadian company, the limited harm or burden to Google, and the ease with which potential conflicts could be addressed by adjusting the global takedown order. In doing so, it invites more global takedowns without requiring those seeking takedowns to identify potential conflicts or assess the implications in other countries.

Michael Geist, Global Internet Takedown Orders Come to Canada: Supreme Court Upholds International Removal of Google Search Results, MichaelGeist.ca, June 28, 2017.

Does the Equustek ruling mean that plaintiffs (both Canadian and non-Canadian) will flock to Canadian courts to sue non-Canadian defendants solely to get global deindexing orders?

Note that Equustek ruling (and the CNIL dispute) avoid an underlying jurisdictional issue because Google has substantial physical presence in both Canada and Europe. Would Canada or Europe have jurisdiction over an Internet service that operates exclusively from the United States?

I encourage you to do a thought exercise: project yourself 20 years in the future. What do you think will be the state of the law on global removals based on local violations? Do you think most countries will have embraced the Equustek approach broadly? If so, do you think the Internet (however you define it) will be better or worse as a result?

* * *

After I wrote this, Google sought legal relief in US courts from the Equustek ruling. For useful perspective on Google's move, read Daphne Keller's analysis.

Written by Eric Goldman, Professor, Santa Clara University School of Law

When ICANN implemented the Uniform Domain Name Dispute Resolution Policy (UDRP) in 1999, it explained its purpose as combating "abusive registrations" of domain names which it defined as registrations "made with bad-faith intent to profit commercially from others' trademarks (e.g., cybersquatting and cyberpiracy)." (The full statement can be found in the Second Staff Report on Implementation Documents for the Uniform Dispute Resolution Policy, Paragraph 4.1(c)). Bad actors employ a palette of stratagems, such as combining marks with generic qualifiers, truncating or varying marks or by removing, reversing, and rearranging letters within the second level domain (typosquatting). They are costly to police and likelier even more costly to maintain forfeited domain names, but for all the pain they inflict they are essentially plain vanilla irritants.

While these kinds of disputes essentially dominate the UDRP docket, there has been an increase in the number of disputes involving malicious registrations. The first instances of "phishing" and "spoofing" appear in a 2005 case, CareerBuilder, LLC v. Stephen Baker, D2005-0251 (WIPO May 6, 2005) in which the Panel found that the "disputed domain name is being used as part of a phishing attack (i.e., using 'spoofed' e-mails and a fraudulent website designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc.")

The quainter forms of abuse are registrants looking to pluck lower hanging fruit. They are so obviously opportunistic respondents don't even bother to appear (they also don't appear with the malicious cases, but for another reason, to avoid identity). The plain vanilla type is represented by such cases as Guess? IP Holder L.P. and Guess? Inc. v. Domain Admin: Damon Nelson — Manager, Quantec LLC, Novo Point LLC, D2017-1350 (WIPO August 24, 2017) (<guess accessories.com>) in which Complainant's product line includes "accessories." In these types of cases, respondents are essentially looking for visitors.

In contrast, malicious registrations are of the kind described, for example, in Google Inc. v. 1&1 Internet Limited, FA1708001742725 (Forum August 31, 2017) (<web-account-google.com> in which

respondent used the complainant's mark and logo on a resolving website containing offers for technical support and password recovery services, and soliciting Internet users' personal information). . . . Complainant's exhibit 11 displays a malware message displayed on the webpage, which Complainant claims indicates fraudulent conduct.

Malicious registrations are a step up in that they introduce a new, more disturbing, and even criminal element into the cyber marketplace. Respondents are not just looking for visitors, they are targeting brands for victims. Their bad faith is more than "profit[ing] commercially from others' trademarks" but operating websites (or using e-mails) as trojan horses. It aligns registrations actionable under the UDRP with conduct policed and prosecuted by governments.

The UDRP, then, is not just a "rights protection mechanism." The term "abusive registration" has enlarged in meaning (and, thus, in jurisdiction) to include malicious conduct generally. Total security is a pipe dream. ICANN has working groups devoted to mapping the problem, and there are analytical studies assessing its extent in legacy and new TLDs. Some idea of the magnitude is seen in "Statistical Analysis of DNS Abuse in gTLDs Final Report” commissioned by an ICANN mandated review team, the Competition, Consumer Trust and Consumer Choice Review Team (CCTRT). Incidents of abusive and malicious activity online and radiating out to affect the public offline represent the universe of cyber crime and uncivil behavior of which UDRP disputes play a minor, although important role in policing the Internet. In initiating complaints, mark owners are on the front line not only in protecting the integrity of their mark but also protecting visitors landing on fake websites by shutting down infectious domain names.

It is interesting to learn that disputes filed with UDRP providers are the tip of the iceberg. There are a number of organizations devoted to collecting, analyzing, correlating, and reporting incidents of abusive and malicious activity on the Internet. Stopbadware.org, for example, reports that there are currently blacklisted 3,918,603 domain names; Securedomain.org compiles "badness" indices of TLDs, registrars, spammers, and bot ISPs; Antiphishing.org and Arwg.org warn us to be vigilant against malware infected domain names and e-mails. Not surprisingly, cyberspace is a microcosm of the social world — calm on the surface; turbulence below.

Malicious registrations are reserved for more outrageous conduct (a step above abusive), not only threatening mark owners but also consumers. It is a kind of misconduct that has (I believe) become more common, even to the point of including miscreant complainants who have no actionable claims for cybersquatting but file complaints anyway (not without a spice of malice) for the cost of incurring a minor penalty. Somewhere on the time-line between the implementation of the UDRP and now there has been a marked increase in the number of these kinds of registrations. "Phishing" ("spoofing" is a less used term and appears to have become folded into phishing) became more common after 2008, and increasingly so in 2011 and 2012. Already in September 2017 there have been 8 decisions; over 20 in August of spoofing, phishing, and distribution of malware. This upward trajectory has been an evolutionary process in the direction of criminal conduct.

To take some examples of the various forms of malicious conduct. In CommScope, Inc. of North Carolina v. Chris Lowe / comm-scope / Chris Lowe / comm-scopes / Chris Lowa / commmscope, FA1707001742149 (Forum September 7, 2017) Respondent "used the domain names as an email suffix and has solicited third parties to submit personally identifiable information." In Novartis AG v. CHRIS TAITAGUE, FA170800 1744264 (Forum September 11, 2017) (<sandozcareers.com>) Respondent targets job seekers. In Goodwin Procter LLP v. GAYLE FANDETTI, FA1706001738231 () Respondent target a law firm to "to misdirect funds in an e mail for an illegal and fraudulent purpose."

The target is not necessarily the mark owner but consumers drawn to the website because of what the domain name implies. In the case of Yahoo Holdings, Inc. v. Registration Private, Domains By Proxy, LLC / Technonics Solutions,. D2017-1336 (WIPO August 11, 2017) (<yahoodomainsupport.com>) it offers "support":

The evidence supports the inference that Respondent sought to use the disputed domain name to create a false association with Complainant to perpetuate a phishing scam. Although Respondent has no affiliation with Complainant, the website associated with the disputed domain name purports to offer technical support for Yahoo-branded services and urges customers seeking assistance to call a provided phone number.

Also, Hill-Rom Inc. v. Jyoti Bansal, FA1703001724573 (Forum May 3, 2017) <himlrom.org>) in which Respondent was using the e-mail to send messages

to Complainant's distributors, fraudulently attempting to create the impression that the emails originate from Complainant and requesting payment from the recipients, in what Complainant describes as a "phishing attack."

Similarly in The Travelers Indemnity Company v. jack Halua / Google Inc., FA1707001739643 (Forum August 21, 2017) (<travelerschampionshipgolf.org>); Home Depot Product Authority, LLC v. Jim Brainard, FA1707001739571 (Forum August 8, 2017) (<homedepotmemphis.com>), and The Travelers Indemnity Company.

Good examples of spoofing (not always called as such, but that's the term for payment instruction fraud) are found in Arla Foods Amba v. ESMM EMPIRE staincollins, CAC 101578 (ADR.eu August 14, 2017) and optionsXpress Holdings, Inc. v. David A., FA1701001711999 (Forum February 15, 2017) (<optionexpress.net>). In Arla Foods, Respondent was both spoofing the mark owners and phishing for personal information. The general complaint is that Respondent was engaged in a "fraudulent scheme to deceive Internet users into providing their credit card and personal information." Respondent was using the domain name to "send emails in the name of Complainant's employees, in an attempt to commit fraud and deceptively steal sensitive information by "impersonat[ing] the Complainant and fraudulently attempt[ing] to obtain payments and sensitive personal information" or by "solicit[ing] payment of fraudulent invoices by the Complainant's actual or prospective customers."

At bottom, respondents are engaged in a hunt to syphon funds from mark owners and anyone who deals with them such as distributors and customers.) In Shotgun Software Inc. v. Domain Admin / Hulmiho Ukolen, Poste restante, D2017-1273 (WIPO August 23, 2017) (<shotgunstudios.com>) Respondent added another layer of deceit by diverting visitors to "sponsored links" for the purpose of distributing malware:

The disputed domain name resolves to different successive websites after repeated access, named by the Complainant as a "Scam Page", a "Disable Tracking Page", "Malware Pages", and sponsored links. The "Scam Page" is designed to trick the visitor into taking action, through a specified telephone number, to eliminate a virus but is an attempt to phish for confidential information. The "Disable Tracking Page" is designed to trick visitors into supposedly disabling their Internet search history but leads to a phishing attempt. The "Malware Pages" may attempt to download malware on to the visitor's computer. The sponsored links pages lead to advertisements including those of the Complainant's competitors.

What brands are now experiencing with domain names can be seen as similar to the mischievous and criminal hacking of corporate aggregators of sensitive personal data. The business model employed by these registrants (if it can be dignified as such) is using domain names to commit fraud and larceny by testing how much they can get away with before they are shut down; only to reappear with other fraudulent and larcenous schemes. Cyber security is not just a matter of data protection; it extends to protection of reputation and general public on the Internet.

Written by Gerald M. Levine, Intellectual Property, Arbitrator/Mediator at Levine Samuel LLP

As you've undoubtedly heard, the Equifax credit reporting agency was hit by a major attack, exposing the personal data of 143 million Americans and many more people in other countries. There's been a lot of discussion of liability; as of a few days ago, at least 25 lawsuits had been filed, with the state of Massachusetts preparing its own suit. It's certainly too soon to draw any firm conclusions about who, if anyone, is at fault — we need more information, which may not be available until discovery during a lawsuit — but there are a number of interesting things we can glean from Equifax's latest statement.

First and foremost, the attackers exploited a known bug in the open source Apache Struts package. A patch was available on March 6. Equifax says that their "Security organization was aware of this vulnerability at that time, and took efforts to identify and to patch any vulnerable systems in the company's IT infrastructure." The obvious question is why this particular system was not patched.

One possible answer is, of course, that patching is hard. Were they trying? What does "took efforts to identify and to patch" mean? Were the assorted development groups actively installing the patch and testing the resulting system? It turns out that this fix is difficult to install:

You then have to hope that nothing is broken. If you're using Struts 2.3.5 then in theory Struts 2.3.32 won't break anything. In theory it's just bug fixes and security updates, because the major.minor version is unchanged. In theory.

In practice, I think any developer going from 2.3.5 to 2.3.32 without a QA cycle is very brave, or very foolhardy, or some combination of the two. Sure, you'll have your unit tests (maybe), but you'll probably need to deploy into your QA environment and do some kind of integration testing too. That's assuming, of course, that you have a compatible QA environment within which you can deploy your old, possibly abandoned application.

Were they trying hard enough, i.e., devoting enough resources to the problem?

Ascertaining liability here — moral and/or legal — can't be done without seeing the email traffic between the security organization and the relevant development groups; you'd also have to see the activity logs (code changes, test runs, etc.) of these groups. Furthermore, if problems were found during testing, it might take quite a while to correct the code, especially if there were many Struts apps that needed to be fixed.

As hard as patching and testing are, though, when there are active exploitations going on you have to take the risk and patch immediately. That was the case with this vulnerability. Did the Security group know about the active attacks or not? If they didn't, they probably aren't paying enough attention to important information sources. Again, this is information we're only likely to learn through discovery. If they did know, why didn't they order a flash-patch? Did they even know which systems were vulnerable? Put another way, did they have access to a comprehensive database of hardware and software systems in the company? They need one — there are all sorts of other things you can't do easily without such a database. Companies that don't invest up front in their IT infrastructure will hurt in many other ways, too. Equifax has a market capitalization of more than $17 billion; they don't really have an excuse for not running a good IT shop.

It may be, of course, that Equifax knew all of that and still chose to leave the vulnerable servers up. Why? Apparently, the vulnerable machine was their "U.S. online dispute portal". I'm pretty certain that they're required by law to have a dispute mechanism, and while it probably doesn't have to be a website (and some people suggest that complainants shouldn't use it anyway), it's almost certainly a much cheaper way to receive disputes than is paper mail. That opens the possibility that there was a conscious decision that taking the risk was worthwhile. Besides, if many applications needed patching and they had limited development resources, they'd have had to set priorities on whic web servers were more at risk. Again, we need more internal documents to know.

Some text in the announcement does suggest either ignorance or a conscious decision to delay patching — the timeline from Equifax implies that they were able to patch Struts very quickly after observing anomalous network traffic to that server. That is, once they knew that there was a specific problem, rather than a potential one, they were able to respond very quickly. Alternatively, this server was on the "must be patched" list, but was too low down on the priority list until the actual incident was discovered.

We thus have several possible scenarios: difficulty in patching a large number of Struts applications, ignorance of the true threat, inadequate IT infastructure, or a conscious decision to wait, possibly for priority reasons. The first and perhaps last would seem to be exculpatory; the others would seem to leave the company in a bad moral position. But without more data we can't distinguish among these cases.

A more interesting question is why it took Equifax so long to detect the breach. They did notice anomalous network traffic, but not until July 29. Their statement says that data was exposed starting May 13. Did they have inadequate intrusion detection? That might be more serious from a liability standpoint — unlike patching, running an IDS doesn't risk breaking things. You need to tune your IDS correctly to avoid too many false positives, and you need to pay attention to alerts, but beyond dispute an enterprise of Equifax's scale should have such deployed. It is instructive to read what Judge Learned Hand wrote in 1932 in a liability case when some barges sank because the tugboat did not have a weather radio:

Indeed in most cases reasonable prudence is in fact common prudence; but strictly it is never its measure; a whole calling may have unduly lagged in the adoption of new and available devices. It may never set its own tests, however persuasive be its usages. Courts must in the end say what is required; there are precautions so imperative that even their universal disregard will not excuse their omission… But here there was no custom at all as to receiving sets; some had them, some did not; the most that can be urged is that they had not yet become general. Certainly in such a case we need not pause; when some have thought a device necessary, at least we may say that they were right, and the others too slack… We hold [against] the tugs therefore because [if] they had been properly equipped, they would have got the Arlington [weather] reports. The injury was a direct consequence of this unseaworthiness.

It strikes me as entirely possible that Equifax's exposure is greater on this issue than on patching.

This is a big case, affecting a lot of people. The outcome is likely to change the norms of how corporations world-wide protect their infrastructure. I hope the change will be in the right direction.

* * *

Update – Monday, Sep 18:

A news report today claims that Equifax was hacked twice, once in March (which is very soon after the Struts vulnerability was disclosed) and once in mid-May. The news article does not say if the same vulnerability was exploited; it does, however, say that their sources claim that "the breaches involve the same intruders".

If it was the same exploit, it suggests to me one of the possibilities I mentioned above: that the company lacked an comprehensive softare inventory. After all, if you know there's a hole in some package and you know that you're being targeted by attackers who know of it and have used it against you, you have very strong incentive to fix all instances immediately. That Equifax did not do so would seem to indicate that they were unaware that they were still vulnerable. In fact, the real question might be why it took the attackers so long to return. Maybe they couldn't believe that that door would still be open…

On another note, several people have sent me notes pointing out that Susan Mauldin, the former CSO at Equifax, graduated with degrees in music, not computer science. I was aware of that and regard it as quite irrelevant. As I and others have pointed out, gender bias seems to be a more likely explanation for the complaints. And remember that being a CSO is a thankless job.

Written by Steven Bellovin, Professor of Computer Science at Columbia University

Here's another apparent limitation of the Uniform Rapid Suspension System (URS), the domain name dispute policy that applies to the new generic top-level domains (gTLDS): Proceedings are unlikely to unmask cybersquatters hiding behind privacy or proxy services.

Domain name registrants often use these privacy and proxy services to hide their identities when they register domain names. The services have legitimate uses but are controversial.

In proceedings under the Uniform Domain Name Dispute Resolution Policy (UDRP), the privacy veil is often lifted after a complaint has been filed, allowing a trademark owner to learn the identity of the so-called underlying registrant. Doing so can be beneficial to a trademark owner complainant, creating leverage and possibly leading to further evidence of bad faith or links to additional domain names.

At WIPO (the leading provider of UDRP services), a complainant is typically offered an opportunity to amend a complaint after the underlying registrant has been identified during the administrative compliance phase. Here's what WIPO's Overview 3.0 says (in part) on the topic:

When provided with underlying registrant information which differs from the respondent named in the complaint, a complainant may either add the disclosed underlying registrant as a co-respondent, or replace the originally named privacy or proxy service with the disclosed underlying registrant. In either event, complainants may also amend or supplement certain substantive aspects of the complaint (notably the second and third elements) in function of any such disclosure.

However, the URS — a quicker process that is "not intended for use in any proceedings with open questions of fact, but only clear cases of trademark abuse" — does not provide for such amendments or supplements to a complaint. Indeed, the Forum (the leading provider of URS services) has a supplemental rule that expressly says: "The Complaint may not be amended at any time."

As a result, a review of URS cases shows that many identify the respondent only as a privacy or proxy service, such as the popular Domains By Proxy, because the underlying registrant is never disclosed during the course of a URS proceeding. Had the trademark owner elected instead to file a UDRP complaint for the same domain name (which is usually always an option, given that all new gTLDs are subject to both the URS as well as the UDRP), then the record might have identified the underlying registrant rather than the privacy or proxy service.

Of course, the URS continues to offer some advantages over the UDRP (notably quicker, less expensive resolutions), but the URS has long been criticized for its shortcomings (such as its ability only to suspend, not transfer, a disputed domain name).

Now, it seems that the URS has yet another shortcoming that trademark owners should consider when deciding whether to file a URS or UDRP complaint: If learning a hidden registrant's true identity is important, then a UDRP proceeding might be a better option than the URS.

Written by Doug Isenberg, Attorney & Founder of The GigaLaw Firm

Panels adjudicating cybersquatting claims, defenses, and rebuttals under the Uniform Domain Name Dispute Resolution Policy (UDRP) expect parties to prove their contentions, and this means having a working understanding of what this entails. There is, first, a set of fundamental rules or principles — such as pending applications for a mark do not constitute a right, or recognizing unregistered marks as constituting rights under paragraph 4(a)(i) of the Policy; or accepting a prima facie showing that respondent lacks rights or legitimate interests as conclusive under paragraph 4(a)(ii) absent persuasive evidence to the contrary; or use in bad faith is not limited to active websites, paragraph 4(a)(iii). The development of principles was contemplated by the WIPO Final Report, 150(5):

[I]t is desirable that the use of the administrative procedure should lead to the construction of a body of consistent principles that may provide guidance for the future."

This has, in fact, come about.

In addition to principles, there is a set of factors which I like to think of as hinges because ultimately claims, defenses, and rebuttals hinge on them. Factors include strength or weakness of marks and their lexical compositions (dictionary words, descriptive phrases, acronyms); the location of the parties; the timing of the respective acquisitions of domain names and marks. Marks composed of lexical strings that are not particularly associated with complainants cannot possibly be in violation of the Policy. Thus, Blue Star Limited v. Blue Star International, CAC 101582 (ADR.eu August 22, 2017) for descriptive phrases and NTI Cadcenter A/S v. Domain Admin, Ashantiplc Limited, CAC 101591 (ADR.eu September 21, 2017) for random letters. In the case of NTI Complainant claimed a common law right in the three letters but lacked proof of any reputation that would have put Respondent on notice of its right. Establishing a reputation is a factor, a hinge; a party may have a present reputation but none when the domain name was registered.

A third set consists of elements. These are found within the Policy requirements. For example, the domain name has to be identical or confusingly similar to the mark. If it is neither complainant has no standing to complain — Fabricators & Manufacturers Association, International v. NameFind, FA 1728625 (Forum June 1, 2017) (THE FABRICATOR and <fabricator.com>). Other elements include the circumstances spelled out in subparagraphs 4(b)(i — iv) and 4(c)(i — iii) of the Policy. For example, offering the domain name for sale to the mark owner is evidence of abusive registration under subparagraph 4(b)(i) (although it is not bad faith if the complainant approaches respondent to negotiate a sale) while evidence of fair use (as criticism) supports lawful registration under subparagraph 4(c)(iii) of the Policy.

Particularly with factors parties, must recognize what they are for the specific factual matrix of their cases if they are to prevail. Complainants do not succeed by having trademarks (BLUE STAR); and respondents do not forfeit their domain names by defaulting in appearance (Ajnaware Pty Ltd v. Domain Administrator, FA170800 1744102 (Forum September 25, 2017).

I do not mean to suggest that these sets are hermetically sealed; some principles are also factors and factors can also be thought of as elements (even though not specifically demanded in the Policy).

The first UDRP complaint was filed in December 1999, World Wrestling Federation Entertainment, Inc. v. Michael Bosman, D1099-0001 (WIPO January 14, 2000). It is the plainest of plain vanilla cases: the second level domain was identical to Complainant's mark, Respondent (who did not appear) offered to sell the domain name to Complaint, and the proof established cybersquatting. What is memorable about the case is that the Panel ruled that to prevail in a UDRP dispute complainant must prove both registrations in bad faith and use in bad faith. This conjunctive requirement can be thought of as the first principle of domain name jurisprudence, namely that bad faith registration alone is insufficient to support cybersquatting although it can be inferred from bad faith use.

World Wrestling was also plain vanilla in that the mark was well-known and distinctive when Respondent registered the domain name. Cases of this kind represent 90% or more of the UDRP docket; respondents rarely appear, there is no counter-narrative, and the domain names are canceled or transferred. Examples drawn at random are Comerica Bank v. Micheal Ard, D2017-1487 (WIPO September 14, 2017) (COMERICA and <comericacashloans.com>); Ubisoft Entertainment v. Josephine Smith, D2017-1402 (WIPO September 4,2017) (JUST DANCE and <justdancelive.com>) The additions of "cash loans" and "live" do not create new associations (which could be a factor in determining rights or legitimate interests) but reinforces Complainants' products or services).

Moving away from the plain vanilla are disputes in which marks are distinctive but not well-known or, well-know but unregistered. The factors are strength and composition of marks, respective locations of the parties, reputation of the mark when domain name was registered, the kinds of goods or services offered, and the content of the resolving website. In the absence of a strong showing of goodwill and reputation, a respondent's explanation for its acquisition can make a difference to the outcome of the dispute. This is the gist of the Panel's findings in Real Estate Edge, LLC. v. Rodney Campbell, D2017-1366 (WIPO September 5, 2017) (GREATER AUSTIN REALTY and <greateraustinrealty.com>):

As viewed by the Panel, the Complaint does not make out a particularly strong case. The Complainant's service mark does not appear to be especially well-known within Austin, Texas, that both the Complainant and the Respondent inhabit. Moreover, being composed of one geographical and two dictionary terms, the mark is not particularly strong on its own. Furthermore, even though it has established valid service mark rights, the Complainant has presented neither assertions nor any evidence whatsoever of the extent to which it has used the GREATER AUSTIN REALTY mark for business purposes.

The Panel concluded that having proof of these facts is "critical if the Panel is to assess rights and interests in a domain name relative to such a descriptive service mark." Complainants of weak and unregistered marks must show the domain names were registered with them specifically "in mind," which is difficult if the marks are composed of generic and descriptive elements.

The same issues are raised in Altamira Asset Management, S.A. v. Luis G. Mota, D2017-1298 (WIPO September 11, 2017) (ALTAMIRA and <altamirarealestate.com>). The parties reside on different continents (a factor) and there was no evidence the registration was capitalizing on the mark (another factor). The "distance" factor was not considered, but without addressing it Complainant could not possibly prevail.

As long as complainants' marks predate domain name registrations complainants have actionable claims, but none if the marks postdate the registration. These complaints must fail because of the first principle, conjunctive bad faith, and first factor, namely priority. Ajnaware, supra (Respondent did not appear but prevailed); FIBO Consulting, LTD v. MohammadReza FakhrMoghaddam, FA1708001744548 (Forum September 15, 2017) (FIBO and <fibogroup.org>); Shesafe Pty Ltd v. DomainMarket.com, D2017-1330 (WIPO August 22, 2017) (SHESAFE and <shesafe.com>).

Shesafe also illuminates other factors. When Respondent (an investor) registered the domain name Complainant had no market presence, but even it had an earlier use in commerce with a common law mark, infringement of a right depends on the infringer having knowledge of the mark's existence. "Knowledge" or "awareness" of the mark is a critical factor. The Panel held that it could not "discern any basis for finding that the Domain Name was registered in bad faith." On the contrary, it found that "the Domain Name was acquired bona fide by the Respondent as a domain name that might be of value on account of its descriptive elements" (my emphasis).

Before Respondent-investor received the complaint, it was offering the domain name for around $10,000 dollars. Following denial of the complaint, the value of the domain name escalated into the stratosphere as graphically described in a post on DomainGang:

Since the decision, Mike Mann has jacked up the price tenfold, seeking now no less than $94,888 dollars! (Bold in the original).

"Jacking up" the price is only a factor when the registration of the domain name is unlawful, but is not a factor when the domain names is acquired "for its descriptive elements." The situation would have been different if Complainant had proved unregistered rights. That sound you hear is Complainant gnashing its teeth.

It must be a party's first duty to ask itself, what do I have to prove? What factors will a Panel be expecting me to prove? If I don't have a registered mark can I prevail on a common law theory? It is not just "first use" in commerce that has to be proved but reputation. (Complainant in Shesafe did not consider the critical factors so presumably, it had no common law rights).

As marks descend to the weaker end of the classification scale, complainants must work harder on the factors. Dictionary words, alone or combined, and descriptive strings of characters as marks are particularly vulnerable. In Blue Star, supra Complainant did not have the evidence it needed to persuade the Panel that was registered in bad faith. The Panel pointed out that there is "a very wide range of uses of the phrase BLUE STAR in commerce . . . by (it appears) the Respondent, and by many others." Even though Respondent did not appear there was evidence on the resolving website that undercut Complainant's allegations:

[T]he Complainant makes an expansive and not wholly persuasive case regarding the uniqueness of the phrase and the existence of common law rights. The Complainant appears unaware of the great number of other marks containing the text BLUE STAR in a range of industries and trademark classes around the world.

Complainant failed to pay attention to two factors, namely "ubiquity" in the use of an adjectival phrase adopted as a mark and protection of its credibility by making easily refutable statements. The claim for "uniqueness" is undercut by use "in a range of industries and trademark classes around the world." There is no evidence Respondent chose the domain name with Complainant's mark in mind. The Panel denied the complaint on credibility grounds for (among other reasons):

contrary to the assertion of the Complainant, a website is and has been [in] operation at the disputed domain name throughout the period of registration, providing what appears to be accurate information regarding the activities of a company with the same name as that used in the disputed domain name.

I have focused particularly on factors because, as I mention, they are the hinges that determine cybersquatting or lawful registration of domain names. There's a kind of inevitability in the adjudication of disputes, that when the record is silent on proving certain factors, the party that must present them will lose.

Written by Gerald M. Levine, Intellectual Property, Arbitrator/Mediator at Levine Samuel LLP

I'm an engineer, and I firmly believe that Internet matters and, in general, Information Society, should be kept separate from politics, so usually, I'm very skeptical to talk about those and mix things.

Let's start by saying that I'm Catalonian. Despite the dictatorial regime when I was born, forbidden teaching Catalonian, I learned it, even despite, initially for family reasons and now for work reasons, I live in Madrid. However, I keep saying everywhere I go, that I was born in Barcelona, where I consider myself from, and how wonderful is that region. I'm proud of my name, Jordi, and I don't allow anyone to call me Jorge, with is the Spanish translation.

Having traveled over 120 countries in the last 15 years, training people on IPv6 and doing IPv6 consultancy/deployment services, I consider myself "citizen of the world, " and I don't think, in the actual global world, there is any reason for being a nationalist or patriotic in the heart.

That being said, I have good friends and colleagues at every remote place in the world, and that's what really matters.

I think this clearly shows that I'm objective enough to write down this and not being biased by my origins, or my actual living town, on the other way around, being very open-minded as a world traveler.

I've been astonished the last few days because about the endless exchange of letters addressed to ICANN, the European Commission, ISOC chapters, and other Internet-related institutions, even blogs, articles, etc., which make no sense if you know the real history behind all this, instead of those letters with false information.

Let's set the stage. There is a region, within a democratic country, that has some percentage of the population that want to declare their independence. This group of people didn't ask the rest of the citizens in the country, even other people like myself, that was born there. In fact, because I don't live there right now, I will not be allowed to participate in the so-called "process". Even further, I don't know if I will get a passport from there, or if some of the friends I have there who don't want to split, will be expelled from the country, or if they will be allowed to sell their properties there, or if they will be confiscated, etc.

So, we are talking about a departure, asking the people to vote for it, not knowing at all what actually that means, including every small detail, and what will be the exit door for each of the possible cases.

I guess each region or town in our country has the same rights. I want to do it for my own house. I have the right of doing that… it is my property… my land!

Can you imagine this in your own country?

As we are a democratic country, there is a power separation (legislative versus juridical), and by the way, we have a Constitution, that all the Spanish citizens approved after the end of the dictatorial regime, and the corresponding Constitutional Court.

The Constitution is clearly not perfect, and now that we got more experience, since 1978, it could be amended for improving it, by consensus. This could even mean that we change our state model into a federal one, such as the German model, or many other options.

This is nothing different than what we do in IETF, making Internet standards, or in the RIRs, making public policies, or even in ICANN. Right?

Guess what, now some of the participants of a given Regional Internet Registry (RIR), decide to unilaterally change some of those rules, or even split in a different group — let's say a new RIR. Yeah, we could do that, but we need to agree on the process. Hey, coincidently we've had a similar situation recently — IANA/PTI — so we are familiar with that already.

Do you think we will agree in that group in my example, changing the policies before we complete the process? Do you think somebody will agree in finding consensus in a policy proposal not knowing all the details of it? Do you think we will keep allocating IP resources to that group according to new policies that they develop by themselves against the community consensus on the existing policies?

So, this is what the Catalonian Government has done. They have approved, against the law, special laws to make that process, to play games and act like in a theatre, and they try to convince citizens as puppets by means of lies and misinformation, which they are investing public money to propagate in a global world.

Law and order: In a democratic system, we all obey the law. If we don't like it, we have the system to change it. What we can never do is to disobey or call for disobeying before going for a change. Otherwise, this will be a crazy world. Everybody will be able to change his/her mind every other day and create risks for the rest of the citizens. Definitively not the way!

So of course, our Constitutional Court has called for obedience to our Constitution, which means no public money can be invested in the process, and the Catalonian Government, their maximum representatives, has forced people that disagree with the process to resign or pushed them against the law, or involved volunteers, asking for illegal actions, and invested in having embassies of a non-country, which cost a lot of money despite having difficulties to pay the public servants, to cover the cost of the education and health system, and so on, and asked for more money to the Spanish Central Government, from the taxes of all the citizens, which in part is being invested, in an illegal process.

Obviously, and despite, the wish to make this soft, and not being provocative, the Constitutional Court, during the last few days, was finally forced by the Catalonian Government provocation, to order the Spanish Police to execute the necessary steps to block ONLY the websites which make the propaganda of the process. However, the Catalonian Government and also volunteers used .CAT, among many other institutions, to duplicate those websites, once and again.

There is nothing against freedom of speech, there is nothing against .CAT, just making sure that the court orders are fulfilled by all the citizens, including public servants, regardless of the organization where they work. Public servants, individuals working for the Information Society, TLDs or other kind of registries, Service Providers, etc., all have the same obligation to follow the law as the rest of the citizens.

Where is the limit of the freedom of speech in Internet? Do you agree that if I publish a website with information about how to do a robbery at your home, call for volunteers to organize a terrorist attack, or to help me in any unlawful or criminal activity, and there is a court order against that website, this can't be considered as measures to restrict free and open access to Internet?

Censorship can be enforced in many ways. One of those ways is to publish false information and confuse people about the real facts, hiding the reality with lots of extra background noise.

When organizations and persons that have been elected by the Internet community take advantage of their positions to, instead of have objective positions, and not correlate those institutions and enact false accusations and misinformation, we can't anymore trust on those persons and they must resign.

The most open organizations, using their influence in the global information society, can actually execute a censorship action which is even much worse than any restriction to freedom of speech.

There are other relevant facts in this history. Many politicians that have been governing Catalonia for many years are being prosecuted for illegal activities, such as 3-5% commissions in public tenders, using public money for promoting the independence process, and such.

Guess what? Their only way-out is the independence, otherwise, they are going to need to pay for all what they have robbed to the public treasury, and it means money and prison. Is not that curious?

Is not curious that the Catalonian Autonomy is the one that in the last years got more credit from the Central Government? Do you expect they will be able to reimburse it?

Do you think if any of us, disobeys the law the same way, as this process is doing, will be ignored by the authorities, or we will be detained and requested to explain every detail of all the illegal actions in front of a judge?

Or do you expect authorities to ignore every illegal action from all the citizens and then we all get crazy, and we go into an anarchic world?

The Spanish Government has been very prudent, too much probably, as they could have used article 155 of our Constitution to suspend the Catalonian Autonomy, but they decided not to go that way, at least for the time being. This is not a clear demonstration of democracy and freedom of speech?

In Europe, since a long time ago, we are trying to integrate and be stronger. Splitting countries is against that spirit, don't make any sense.

Our community must be smart enough and ignore messages with false or incomplete information. Those messages are even considered apology of sedition, same as if we start creating websites doing apology of terrorism or any other illegal activities.

Let's avoid going on with all this misinformation and I plea to those having only the real facts and complete information to spread the message to avoid others getting confused.

Internet-related institutions must not trust anymore those individuals or organizations who are misinforming the rest of the world. Internet-related institutions must respect the law of democratic countries. Only when it is clearly proven that democracy is not real, we must act, otherwise, we are damaging our own credibility.

Those that have already published false information, must apologize. It is clear that they have got confused because the Catalonian Government and many of their actors in this theatre, have been far noisier than the rest of the community, but it's time to review. I will not point to them right now, but clearly, I will not mind doing so in a couple of days if they decide to keep their false accusations which are an insult for the rest of the Spanish citizens, including the majority of the Catalonians which aren't part of this and by extension an insult to the rest of the Internet community.

Written by Jordi Palet Martinez, IPv6 training and consultancy

Russia threatens to block access to Facebook next year unless the company complies with a law that requires websites which store the personal data of Russian citizens to do so on Russian servers. Reuters reports: "The threat was made by Russia's communications watchdog Roskomnadzor, agencies said, the organization which blocked access to LinkedIn's website last November in order to comply with a court ruling that found the social networking firm guilty of violating the same data storage law. ... Twitter Inc had already notified Roskomnadzor that it would aim to localize the personal data of its users by the middle of 2018."

What is Bitcoin? Is it electronic money?

There's a deluge of hype around Bitcoin and blockchain technologies right now, and policymakers and regulators in the Caribbean are doing their best to wrap their heads around the advantages and disadvantages of this virtual currency. Similar questions are being contemplated in the ICTs for development (ICT4D) community, taking into account that electronic money (e-money) platforms such as Safaricom's M-PESA have essentially solved the financial inclusion quandary for millions of people in Kenya. The service has now even expanded to Eastern Europe, Afghanistan, and India.

Besides sharing the characteristic of being digital, how do Bitcoin and e-money compare, especially with regards to reaching individuals who have previously been unable to access traditional financial services? Presently, there appear to be more differences than similarities between the two, and it's critical not to confuse virtual currency with e-money.

Blockchain, in brief, is a record of digital events, distributed across multiple participants. It can only be updated by consensus between participants in the system, and when new data is entered, it can never be erased. The blockchain contains a true and verifiable record of each and every transaction ever made in the system. Launched in 2009, Bitcoin is a virtual, private currency that uses blockchain as an underlying, immutable public ledger. Bitcoins are 'mined' using distributed processing power across a global network of volunteer software enthusiasts. The supply mechanism is designed to grow slowly and has an upper limit of 21 million units as determined by a built-in algorithm. There is no central authority that controls blockchain or Bitcoin. There are no central banks that can be politically manipulated; and no way to inflate the value of a national currency by simply printing more money. Economic libertarians are ecstatic at the very thought of this. However, competing virtual currencies can be created that could have the net effect of devaluing the original.

Contrastingly, e-money is not a separate currency and is overseen by the same national regulatory authority that governs the printing of fiat money — as is the case with M-PESA and the Central Bank of Kenya. It's an extension of a national currency like Jamaican dollars or Netherland Antilles guilders for use over digital networks to reduce the costs associated with handling physical cash. More specifically, it's a one-to-one electronic store of value pegged to the cash receipt of the equivalent amount. To mitigate against risks like money laundering, terrorist financing, consumer protection, etc., the cash against which e-money is issued most often has to be deposited with fully regulated financial institutions.

The issue of financial exclusion

The issue of financial exclusion can be summarized into two categories: unbanked and underbanked. Unbanked individuals do not have an account at a regulated financial institution, while underbanked individuals have accounts, but frequently use alternative or unregulated financial services.

Before elaborating on the key factors behind financial exclusion, it is important to detail the effects of being unbanked to illustrate the severity of the problem. Unbanked individuals are faced with a heavy economic burden when conducting even the most basic financial transactions. For example, cashing a cheque can cost the average person with full-time employment as much as USD$20,000 over his/her lifetime. Retailers, which several people use for check cashing, charge non-trivial fees. For example, charges can be as high as USD5$ for cashing a check. Other alternative financial services providers employ even more extortionary fee structures. Western Union, as an example, charges as much as USD$42 to send a USD$500 remittance to Barbados. 'Underground' alternative financial service providers levy as much as USD$10 on every USD$100 transferred. All in all, fees for conducting basic transactions can accrue large costs. And given that the majority of unbanked households are low- and medium-income families, this significantly reduces the monies available for daily consumption.

There are numerous interwoven reasons, both from the customer and supplier end, which contribute to the overall dilemma of financial exclusion. Fundamentally, the decision on whether or not to open a bank account can often be attributed to the volatility and quantity of the individual's earnings. This means the more volatile a person's income is, the higher the chance they are unbanked. Simply put, they are large numbers of Caribbean nationals who do not have enough money to maintain a bank account. As the majority of banks require a mandatory minimum deposit to open an account, as well as an average balance to avoid monthly service fees, an inadequate and/or inconsistent flow of income automatically serves as a barrier to using banking services for low-income earners who live paycheck to paycheck. Initially, this may seem paradoxical as alternative financial services are very expensive, yet they are primarily used by low-income individuals. Nonetheless, it must be acknowledged that alternative financial services do not have strict requirements for maintaining a consistent account balance, and consequently are easier to access up front. The high costs of alternative financial services accumulate due to prolonged usage, or at the conclusion of a lending agreement, whereby the interest rates are regularly double or triple of those offered by traditional banks. Basically, the cost of regular bank accounts is known in advance of setting up an account, whereas the true cost of alternative financial services emerges over time. This is a major reason that alternative financial services are more appealing to low-income households.

Another reason for unbanked individuals is attitudinal and behavioral; they really do not trust banks. A large percentage of them believe that banks are not in any way interested in serving their needs. This sentiment may not be all that unfounded, as a number of the banks across the Caribbean region have been reducing the teller services that unbanked individuals are familiar with and prefer, forcing more (non-technical) customers to online channels, regularly increasing service fees, and even worse, looking to divest their retail operations in favor of corporate banking and wealth management business units. Even though the commercial reasons may be legitimate, these types of actions are not improving the already unfavorable views of traditional banks.

However, it must be emphasized that the reasons for being unbanked are not restricted to consumers. The actions, or rather inaction, of private sector commercial banks, play just as large of a role in the issue. The prior discussion of low-income households being unable to obtain bank accounts due to the high minimum balances highlights the unavailability of inexpensive banking options for this specific market segment. The commonly held belief is that banks lose too much money in servicing accounts for low-income individuals to make them a valuable market. Actually, one can forcefully contend that banks are pricing their products intentionally to keep these customers away. For example, as of June 2017, CIBC FirstCaribbean (Barbados) charges a $15 monthly service — in addition to various other transactional fees — and offers to waive the fee for customers who can maintain an average balance of $1,000. These types of pricing structures and expectations are difficult for poor people to meet.

Why Bitcoin isn't a financial inclusion panacea

Bitcoin currently has no formal strategy or roadmap to guarantee, for instance, that even at its current rate of adoption, it can replace the variety of fiat currencies across the region. Investment is key to solving these types of problems. However, in quantitative terms, investment in the Internet at its nascent stages was several orders of magnitude greater by comparison.

There is a lot of controversy around attempts to regulate Bitcoin. It is not very clear to what social and economic areas and most importantly, to what extent the state or agencies will be admitted into the development process to design compliance into the system. One theoretical problem lies in the fact that blockchain's main strengths (security, legitimacy, privacy, safety and availability) are patterned off a set of algorithms — math, cryptography and distributed computing.

Renowned writer and amateur cryptographer Edgar Allan Poe once stated "… it may be roundly asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve… Thus, what is encrypted by one person, can always be decrypted by another." Similar thought processes have led many security experts to claim that Bitcoin is one major hack away from total failure (can anyone say 'quantum computing'?). My concerns about Bitcoin's future, and more importantly its status as a solution for financial inclusion, are nowhere close to being so ominous or skeptical. In the sections that follow, I will fully outline why I think Bitcoin has a long way to go before it solves the financial inclusion dilemma in the Caribbean region.

To obtain Bitcoin, you must already be "economically included" — both in terms of Internet and financial access. Let's be very honest here; the average unbanked or underbanked individual is not mildly interested in the highly technical and costly process of mining Bitcoin. In terms of investing in Bitcoin, individuals participate based on trust in the private currency and at their own risk (speculative investment is usually not the realm of low- to medium-income earners). The exchange rate of Bitcoin to US dollars has fluctuated wildly in its short existence. Once you have discretionary income available and use debit or credit cards to purchase Bitcoins on a cryptocurrency exchange such as Coinbase or BitStamp, Bitcoin has two characteristics of traditional money: when you buy products or services at participating merchants, transactions are largely anonymous and irrevocable. Again, free-market advocates love this, but it garners unnecessary attention from tax agencies and law enforcement.

Anonymity is a deliberate choice for the unbanked. Simply put, the unbanked live in a cash-driven economy. They prefer to remain anonymous for a bevy of reasons: immigration status, tax purposes, fear, or general mistrust of banks. One of the ways to remedy this is to overhaul the burdensome regulations linked to closed networks like the Western Union and MoneyGram to permit the unbanked to utilize completely anonymous platforms. Onerous rules are stymying advancements in digital movement of money because they were developed for a bygone era. For the cloud over the industry to disappear, efforts need to be made to vanquish the idea that anonymous money sending is only for terrorists and criminals. Allowing $100 in cash to move anonymously helps a poor farmer a lot more than it does an ISIS jihadist. The belief of libertarians that money will become totally anonymous, absent of any oversight or intervention by government and regulators, is illusory. The ultimate objective is to deploy technology that empowers individuals, but in tandem, we need common institutions like the judiciary and regulators that protect consumers and the integrity of the currency that drives the economy. At the end of the day, millions of people aren't going to discard the existing financial system in favor of Bitcoin on faith alone.

Predatory businesses are convenient where the unbanked live. Rural areas like Trelawny, Jamaica or Mayaro, Trinidad are home to large swathes of unbanked households. Traditional banks don't see a viable business cases for locating a branch or satellite office in such districts. This means that check cashing and money changing businesses that charge exorbitant rates are the only real means of conducting transactions. New concepts like human ATMs are popping up in locations such as Hong Kong where low-income individuals can send money home, and where several minor Bitcoin remittances players have been successful. However, like rural areas in the Caribbean, these are small markets that are in no way appealing to large banks or major investors. Kenya's M-PESA succeeded because it leveraged an existing network of agents and vendors. Bitcoin does not preclude the need for extensive networks of agents in remote locations who can provide physical cash to those seeking remittances in a local currency. There are also questions about the viability of Bitcoin in countries with poor technology infrastructure (i.e. poor cellular coverage or lack of broadband Internet in rural areas).

Traditional banks need to come to the table. Traditional banks in the Caribbean have shown little to no interest in embracing Bitcoin or distributed ledger technologies. They see it as a threat to their monopoly over transaction-based services, instead of as an opportunity to revolutionize their operations. Globally, mobile banking is overtaking branch-centered activity more and more — for example, in Norway, 91% of the population use online banking channels. The explosion of fintech companies that are 'unbundling' traditional banking functions, added to the maturity of the first generation of Internet banking solutions, are hastening this trend. Consequently, the amalgamation of omni-channel banking, fintech platforms, and open APIs are obscuring the lines between traditional and alternative finance. New banking institutions such as Skandiabanken, are making strides towards accepting Bitcoin and its altcoins as trustworthy assets. If this trend is sustained, expect cryptocurrencies to become more firmly implanted in the evolving fintech landscape. Legislators will then be under pressure to formulate comprehensive proposals for regulating a new asset class. It will also have the net effect of encouraging the development of the next generation of cryptocurrency-based services.

Bitcoin maybe better off as a back-office solution. The transparency and auditability features of distributed ledger technologies like Bitcoin could address a number of different challenges in the financial services industry. It could address the de-risking issues that are seriously impacting the Caribbean region. It could reduce compliance expenses, given that banks and other financial institutions need such personnel to ensure that regulatory requirements are being met or to respond to regulatory audits. It serves up the potential of instantaneous movement and settlement of funds, which is appealing to merchants with regards to working capital requirements, given they presently have to wait 2-3 days for each payment. As it pertains to customer service costs, fraud reduction decreases the number of incoming calls, and improved auditability lends to faster responses to customer queries. For instance, utilizing Bitcoin at the core of a payment gateway that integrates with existing core banking applications to facilitate international wire transfers, would result in significant cost savings (it would also eliminate the need for correspondent banks and provide real competition for the monolith that is SWIFT). Combining these savings with others would allow financial institutions to better service lower income customers. Akin to the underlying protocols behind email, Bitcoin can drive common services, and users will never have to interface with it.

Smaller countries do not have Bitcoin liquidity. Many fintech startups have failed because emerging economies — especially small island developing states (SIDS) — have serious challenges with Bitcoin liquidity. For example, there are some realistic obstacles that weaken Bitcoin's efficacy as an apparatus for remittances. Remittances demand that a liquid market exists between Bitcoin and the receiving nation's currency. Liquid currency markets tend to be strongest in countries with robust market institutions and entrenched local intermediaries. Countries that depend on remittances usually don't have such institutions for their national currency, far less a totally new virtual currency. This is why the leading mobile money players are focusing on airtime top-ups, bill payment, and peer-to-peer (P2P) transfers. These are alternative forms of value that can surface in countries lacking adequate infrastructure or access to cryptocurrencies and immediately help the poorest. Many of these applications can run on feature phones and use basic SMS technology to enable movement of digital value. It will take a long time before the really poor become familiar with Bitcoin, and even longer for them to actually care about it. Conversely, Bitcoin ought to be the shining star in the constellation of financial inclusion, and fintech should be engaging in the heavy lifting to develop policies today that will positively impact everyone, not just the wealthy.

Financial inclusion is more than remittances. If I got a dollar for every Bitcoin enthusiast who waxes poetically about 'Bitcoin', 'financial inclusion' and 'remittances', I would be a wealthy man. The truth of the matter is that financial inclusion is a complex issue, difficult to evaluate due to the diverse viewpoints that have to be considered to understand and quantify it. While there is no de facto definition of financial inclusion, there are three elements that are most important: access, use, and quality of financial services. Moreover, besides remittances, financial inclusion also includes micro-credit, micro-insurance, cooperatives, peer-to-peer lending, rural/agricultural credit, mobile money, mobile vouchers, and a number of other alternative financial services. Financial inclusion is multi-faceted, and Bitcoin has yet to distinguish itself in any of the aforementioned categories. What it does is position itself as a potential alternative payments system, but it has yet to effectively demonstrate how it will deliver financial inclusion tangibly and comprehensively.

From the architecture and engineering perspectives, Bitcoin is not a 'finished product.' The cost of Bitcoin transactions depends on network demand and capacity at a given time. While the number of transactions employing Bitcoin has gradually risen in the last couple of years, the processing capacity of the network (that is, the volume of transactions that can be processed per second) has remained static. In layman's terms: If transaction volumes continue on this steady trajectory without a corresponding increase in processing capacity, transaction fees will quite possibly surpass those of traditional banking services. Additionally, wait times for transactions to be completely processed have become increasingly unreliable. Contributing to these performance issues are the built-in limits on the number of transactions that can be processed at a given time. Bitcoin was not built to successfully scale, due to all their transactions and smart contracts existing on a single public blockchain, rather than on state channels. State channels are a two-way transaction channel between users or between machines. The problem of how to increase the processing capacity of the network, while simultaneously preserving its critical decentralized features, is one that needs a near-term resolution. These early 'teething problems' emphasize some of the important architecture and engineering decisions that have to be made before Bitcoin can be viewed as a reliable platform for the world's poorest.

The Caribbean region has serious online trust issues. Trust is a social, economic and political binding instrument. When trust is absent, all kinds of societal afflictions unfold — including paralyzing risk-aversion. In 2016, OAS and IDB published a report titled, 'Cybersecurity: Are We Ready in Latin America and the Caribbean?' Researchers conducted assessments of 13 Caribbean nations, including Bahamas, Barbados, Jamaica, and Trinidad & Tobago. The methodological framework covered 'Culture & Society', and one of the key findings was the extremely low levels of online trust in the region. More specifically, very high percentages of the populations in the countries surveyed did not trust the Internet as a whole. When you drill down into the data, the findings are even more alarming: Caribbean people do not trust that their online activities aren't being monitored, they do not trust their service providers, they do not trust social networks, they do not trust their search engine provider, they do not trust companies to keep their personal data safe and secure, and most relevant — they do not trust online and mobile banking platforms. Culture is extremely difficult to change; it comprises an interlocking set of goals, roles, processes, values, practices, attitudes and assumptions. It is essentially the DNA of a country. Tossing all other issues aside, getting the residents of Caribbean nations to trust in Bitcoin may be the hardest obstacle to overcome.

Conclusion

History has shown that two factors affect how a foundational technology and its commercial applications evolve. The first is novelty — the extent to which any technological use case is new to a market or to the world-at-large. The more novel it is, the more effort needs to be expended on ensuring that consumers understand what problems it realistically solves. The second is complexity, characterized by the amount of ecosystem coordination required — the quantity and diversity of actors and stakeholders that must collaborate to create value with the technology. For example, a social network with a single member is useless; its value increases only when your friends, family, colleagues, etc. have signed up. Other users of the application must be 'converted' to generate value for all involved. The same holds true for distributed ledger technologies like Bitcoin. And, as the scale and impact of such applications increase, large-scale uptake will necessitate major social, legal, and political change.

Virtual currencies must be perceived as simple, instinctive, and easy to use even in the most functionally and financially illiterate parts of the world. Talking heads often promote financial literacy and educational programs as the lynchpin in transitioning poor people to technology-based money. But the most effective adoptions happen when people learn by imitation. So, to truly demonstrate its value, Bitcoin must become ubiquitous. People should observe its use by rich and poor alike, and in developed and developing countries, in really similar ways. No one offered Internet literacy classes or programs when the technology was introduced 30 or so years ago, but Internet usage skyrocketed as the costs fell sufficiently low. Now more people use the Internet than any other technology ever known to man. Along the same vein, Bitcoin is likely to grow when middle-class consumers start using it regularly, even when transacting with the poor. My fear is that Bitcoin and its value chain are not up to the task.

Bitcoin is a commercial application or use case, but blockchain is the foundational technology (like TCP/IP which is at the core of the Internet). And similar to the Internet in the late 1990s, we have no clue how the blockchain will evolve, but I am certain that it will. Much like the Internet, blockchain must also be permitted to grow without restrictions. This will require awareness, competency, and recognition that the core technology and the applications that run on it are not the same. TCP/IP enables several financial applications that are regulated, but TCP/IP is not regulated as a financial instrument. Blockchain should be treated similarly. While the most popular and pervasive use case for blockchain today is Bitcoin, this will not be the case in a couple of years. Had Internet regulation been heavy-handed in the initial stages, humanity would have been deprived of many innovations that have become embedded in our daily existence. Blockchain is no different. Disruptive technologies seldom fit neatly into the confining spaces of regulatory oversight, but inflexible regulatory frameworks have continually stifled innovation. Chances are that innovations in distributed ledger technologies will outpace legislation. Let's not retard their progress.

Written by Niel Harper, Managing Director

Not all domain name disputes are appropriate for resolution under the Uniform Domain Name Dispute Resolution Policy (UDRP).

While the UDRP is clearly the "go-to" legal tool for trademark owners pursuing cybersquatters, some disputes are about larger — or different — issues than the UDRP was designed to address.

As stated in WIPO's Overview:

Depending on the facts and circumstances of a particular case, and irrespective of whether the parties may also be engaged in court litigation, in some instances (e.g., complex business or contractual disputes) panels have tended to deny the case not on the UDRP merits but on the narrow grounds that the dispute between the parties exceeds the relatively limited "cybersquatting" scope of the UDRP, and would be more appropriately addressed by a court of competent jurisdiction.

'Contractual and Trademark Dispute'

A UDRP panel addressed this exact issue in a dispute over the domain name <lamborghini-store.com>. The UDRP complaint was filed by the owner of the trademark TONINO LAMBORGHINI "in numerous countries all over the world" for use in connection with, among other things, cell phones, according to the decision.

The respondent in the case claimed, "that he is an official dealer of the Complainant through an authorization letter from the Complainant's licensee."

While the panel had no problem finding the disputed domain name <lamborghini-store.com> confusingly similar to the TONINO LAMBORGHINI trademark (the first element of the UDRP), the panel had concerns about even addressing the second and third elements of the UDRP (that is, whether the registrant had rights or legitimate interests in the domain name; and whether the registrant registered and used the domain name in bad faith).

As a result, the panel wrote:

The Panel notes that this dispute seems to be part of a contractual and trademark dispute that is outside the scope of the Policy. In this case, it is not clear whether or not the Respondent was an authorized agent of the Complainant or of a licensee of the Complainant when it registered the disputed domain name in 2015. The Respondent has submitted several contract and authorization letters which do not clarify this. It is beyond the scope of the Policy to interpret agreements between the Parties or to determine whether they have breached the Complainant's trademark.

Therefore, the panel dismissed the complaint, allowing the registrant to retain the domain name.

Complex Facts, Breaches of Contract, and Business Relationships

The conclusion in the LAMBORGHINI case — that the dispute was "beyond the scope" or "outside the scope" of the UDRP — has appeared repeatedly in UDRP decisions through the years.

For example:

• A very early UDRP decision raised interesting issues, including a discussion about two criminal cases in Estonia related to a possible unlawful transfer of the disputed domain name <aquastel.com>. "Under these proceedings the complete correct facts can probably not be proved," the panel wrote, also noting that it "cannot know on this record the full extent of the relationship between the parties." Thus, the panel allowed the registrant to keep the domain name because the "case is much more complex, factual and judicial than the domain name disputes suitably solved under the Policy."
• In another early UDRP decision, involving the domain name <thethread.com>, the respondent was actually a co-founder of the company that filed the UDRP complaint and purchased the domain name "on the Complainant's behalf" but in the respondent's own name. The dispute arose after the respondent resigned. "[T]his is not a garden-variety cybersquatting case," the panel wrote. "In fact, it is not a cybersquatting case at all. Rather, this appears to be a breach of contract and breach of fiduciary duty dispute between former partners."
• Similarly, another UDRP decision referred to "a long term business relationship" between the complainant and respondent, which "has evidently now unravelled," resulting in other (non-UDRP) proceedings between the parties. So, the panel terminated the case, writing: "In light of the existence of the parallel litigation, and the complex factual matrix which underlies the dispute and which has not been fully disclosed, the Panel finds that this Complaint is beyond the scope of the Policy at the present time."

Think Before Filing

Of course, just because a dispute is complicated doesn't necessarily mean that it's not suitable for the UDRP. But, as these cases demonstrate, when the issues between the parties involve criminal allegation, contractual disputes or other litigation, a UDRP panel may decline to issue a decision on the merits of the case. (The parties may then choose to go to court for a legal resolution.)

Importantly, complicated cases of any kind are typically not appropriate for disputes under the Uniform Rapid Suspension System (URS), a different dispute policy that applies primarily to the "new" gTLDs. The URS itself makes clear that it is "not intended for use in any proceedings with open questions of fact, but only clear cases of trademark abuse."

A trademark owner thinking about filing a UDRP complaint should consider whether the issues in dispute are "beyond the scope" of the policy, to ensure that its time and financial resources are spent in the proper forum.

Written by Doug Isenberg, Attorney & Founder of The GigaLaw Firm

Experts fear European Union court case attempting to keep personal data private could backfire and prove damaging to Europe. Joe Uchill reporting in The Hill writes: "Irish courts referred the latest chapter of a longstanding legal challenge between activist Max Schrems and Facebook to the European Union courts. At issue are 'model' contractual clauses Facebook uses that are supposed to replicate the protection EU citizens have within Europe. Without model clauses, it is typically illegal to store EU citizen's data outside of Europe. Schrems argues that U.S. surveillance operations make it impossible for the model clauses..."

UDRP decisions come down from providers (principally from WIPO and the Forum) at the rate of 7 to 10 a day. Complainants mostly prevail; this is because in 90% of the cases (more or less that percentage) respondents have no plausible defense and generally don't bother appearing, although default alone is not conclusive of cybersquatting; there must be evidence of infringement. When complainants do not prevail, it is not because they lack rights; it is because, in the balancing of rights, complainants either do not have sufficient evidence of bad faith, or respondents have persuasive arguments that their registrations are lawful.

The reason for stressing that trademark rights are paramount to contracts for domain names rests on the value societies attach to identifiers of source and the universal policy of governments to protect the integrity of marks from being used opportunistically for gain at the expense of mark owners and the public. This does not diminish contract rights lawfully acquired, although the challenge of rights demands proof.

In challenging registrants complainants start with two advantages, namely 1) the UDRP is a rights protection mechanism designed for them; and 2) they own statutorily protected marks while registrants have only contractual rights to their domain names. The legal challenge can be mounted at any time, regardless the length of holding, and when challenged registrants have no choice (other than defaulting or removing the dispute to a court of competent jurisdiction) except to protect their interests in a UDRP proceeding. (Removal to a court of competent jurisdiction is extremely rare, incidentally although losing registrants have prevailed in actions under the ACPA).

The 90% forfeiture rate mostly involves domain names incorporating marks distinctive--not just, or not only because they are necessarily well-known or famous, but because knowledge of them (directly or inferentially) cannot plausibly be denied. However, as marks descend on the classification scale, complainants' proof of cybersquatting must correspondingly be of higher quality. The reverse is true as marks ascend on the classification scale, there is a correspondingly higher demand on respondents to explain their registrations.

It may come as a hard lesson for respondents insistent of their contract rights that they may be inferior to complainants' rights if they cannot convincingly explain their lexical and numeric choices or if their explanations lack credibility. The issue comes into focus in two recent cases. There are (one would think) rules for acquiring domain names. One rule is that the acquirer should undertake due diligence before making a purchase, or risk losing both the domain name and the purchase price.

In National Cable Satellite Corporation, d/b/a C-SPAN vs. Michael Mann / Omar Rivero, FA1707001741966 (Forum September 20, 2017) the real party in interest (Rivero) acquired from a well-known investor (Mann) for $75,000. Mann acquired the domain name many years earlier, although the acquisition postdated Complainant's WASHINGTON JOURNAL mark by many years (registration, 1997). (There is no indication in the record of any due diligence before Rivero purchased the domain name, and if not it violates the first rule of acquiring property).

Respondent contended that,

Complainant does not have the exclusive rights in the terms WASHINGTON JOURNAL, and there are several other registrations that contain or bear the precise terms "WASHINGTON" and "JOURNAL." [Respondent gave as an example WASHINGTON BUSINESS JOURNAL].

And

It is clear that the Complainant does not have the exclusive rights in the terms WASHINGTON JOURNAL across a broad range of goods and/or services. Without the exclusive rights in the terms WASHINGTON JOURNAL, it is impossible for Complainant to allege that the "USPTO alone sufficiently establishes the NSCS's rights to the name pursuant to Policy 4(a)(1)." Rivero also contends "...it is obvious that the USPTO did not intend for Complainant to have exclusive rights in the terms WASHINGTON JOURNAL or the [Domain Name] incorporating those terms.

The Panel (unanimous) was not persuaded:

[Respondent] is a Cornell University graduate and a Founder and Editor-In-Chief of an organization called Occupy Democrats. Moreover, he states that he acquired the Domain Name specifically to launch a website to disseminate political news. Given Rivero's background and the political news hosted on his website, the Panel finds that Rivero, on the evidence presented, was aware of Complainant's WASHINGTON JOURNAL mark and that he was aware that confusion between his website and Complainant's registered mark would help jump-start the launch of his website.

Even if Rivero neglected to perform due diligence (a case of not paying attention to Complainant's statutory rights!) given the "length and prominence of Complainant's use" use in commerce it was simply "not credible" that he

was unfamiliar with Complainant's mark, especially given that he is using the Domain Name for political news. Rivero does not deny knowledge of the mark, but instead, merely notes that Complainant has not proven his knowledge. Here, given these facts, that knowledge is easy to infer.

(Although not quite the same facts because the domain names were built on generic terms, Respondent in a 2016 case paid $175,000 dollars and forfeited <halifaxcarfinance.com>, <halifax.com> and <halifaxliving.org>, Bank of Scotland Plc v. Shelley Roberts, Diversity Network, D2015-2310 (WIPO February 15, 2016) because it violated another cardinal rule, namely offering the domain names to Complainant. I'll return to this case in a moment).

Claiming to be harassed or bullied by brand owners into giving up domain names incorporating their marks is entertaining but a not good defense, any more than offering to settle a proceeding in exchange for payment. In PayPal, Inc. v. David Weiss / Paybyweb, Inc., FA1707001740061 (Forum August 17, 2017) (<paypals.com>) the Respondent stated

[it] only redirected the website to a gripe site after it was harassed by Complainant and believed that the diversion was necessary to prevent Complainant from taking the disputed domain name.

But, the Panel was not impressed: "More importantly, one does not establish good faith merely by changing the content of a site in an attempt to make it non-infringing, especially after the receipt of a cease and desist letter." Respondent also breached the same cardinal rule of offering to sell the domain name to Complainant.

In Airbnb, Inc. v. Norman King / Target Marketing Group, FA1707001738345 (Forum July 27, 2017) involving <air-bnb.com> Respondent was indignant at being called out as a cybersquatter and made no bones that the domain name was "available for sale at $25,000" (and had in fact been offered to Complainant). Moreover,

This domain name was offered to both Brian Chesky and airbnb.com several months ago, along with Jonathan Mildenhall and Joe Gibbia and each one declined the offer, and they further indicated in their response that they were not interested in the domain name. They said it was not important to airbnb.com and they were cool with that decision. I thought they must be crazy? Now suddenly you are interested… Or maybe you simply intend to Bully us into submission with your lawyers, your huge might and your 30 Billion Dollar Valuation. (Emphasis added).

Moreover,

If you continue to Bully me I promise you that I will attach copies of all the emails between myself and Brian Chesky and Jonathan Mildenhall and I will publish this complaint on all Public Forums on the Internet. I will publicly post my response, and all documents filed in this dispute will be published on ALL public forums. I am an SEO expert so I expect to rank these articles on Page One of Google. So, To make a long story short… If you wanted this domain you should have bought it 10 years ago.

Length of time could be a factor but not for well-known marks, and not even for those marks composed of generic terms (the "Halifax" domain names noted above) where respondents are found to have offered the domain names to complainants in violation of paragraph 4(b)(i) of the Policy, although it is also true as the Panel in Bank of Scotland noted

had the evidence shown that this disputed domain name was acquired and used in connection with such a purpose [for its geographical associations with City of Halifax] then this would have been sufficient to demonstrate the Respondent's rights and legitimate interests under the Policy.

Trademarks are not paramount when the strings of lexical characters can be purposed for non-infringing products or services. Their rights extend only so far. Notwithstanding respondent exclamations, they are sometimes right. One is reminded, for example, of cases respondents lose in the UDRP proceedings against Complainants with weak marks but prevail in ACPA actions. The mark in Blue Ridge Fiberboard, Inc. v. Domain Administrator/Domain Asset Holdings, LLC., FA1602001661150 (Forum March 29, 2016) is SOUND STOP; the mark in Camilla Australia Pty Ltd v. Domain Admin, Mrs Jello, LLC., D2015-1593 (WIPO November 30, 2015) is CAMILLA. These cases are not alone in challenging UDRP awards. In both Blue Ridge and Camilla Complainants (defendants in the subsequent actions) settled without gaining control of the domain names.

I think no one would disagree that there is a marked difference between PAYPAL and SOUND STOP even though both are composed of dictionary words. (But what marks are NOT composed of dictionary words? Few I think are totally made-up). The only plausible defense to claims for brand infringement is either active use of the word or phrase for its ordinary or semantic meaning, or non use but offering a credible explanation for acquiring the domain name for its ordinary meaning and plausible non mark value.

Written by Gerald M. Levine, Intellectual Property, Arbitrator/Mediator at Levine Samuel LLP

Interstate agreement between the Austro-Hungarian Monarchy, Prussia, Bavaria and Saxony, 25 July 1850.
Original / EnglishOn 30 September 1850 at Dresden, the first international treaty was issued among the first sovereign nations to internet their national electronic communication networks. It was known as the Dresden Convention, and culminated several weeks hammering out basic requirements and techniques to implement an internet spanning the Austro-German European continent at the time, and established a continuing "Union" of signatories to evolve the provisions of the treaty.

The Dresden Convention was a remarkable achievement that necessarily included basic elements of cyber security that persist today. The endurance of the treaty provisions and the collaborative process for cyber security were underscored over the decades by applying the provisions to each new communications technology and an expanding array of nation states that emerged. The network security provisions included those relating to sovereignty over national communication networks and service provisioning, protecting network infrastructure against harm, and sovereign rights to inspect and stop communication harmful to national security.

Over the generations, the technologies included telephone networks, undersea cables, radiocommunication, radio sensing, broadcasting, out-of-band signalling, television and cable video, satellite communication, data communication, public mobile, and datagram internets, ICTs, cloud data centres and network-service virtualisation. In the 1930s, the treaty signatories would give themselves the name International Telecommunication Union.

Today, literally every nation on earth has accepted today's ITU cyber security treaty provisions that originated in 1850. Indeed, despite multiple attempts to develop new global cyber security instruments, few have been successful, and none have been as enduring or ubiquitous as the ITU provisions.

Worth special note is the adjunct ITU cyber security treaty instrument that emerged at the 1988 Melbourne Convention known as the International Telecommunication Regulations. The emergence of multiple datagram-based internets at that time for research and intergovernmental use such as the OSI Datagram and DARPA TCP/IP platforms, resulted in the ITU convening a conference to legalize transnational public internets for commercial offerings. The late Secretary-General Richard Butler convened most of the world's nations in his home town, and after five contentious weeks and two conference chairs, a treaty instrument was produced that legalized international public internets for the first time. Butler himself took considerable pride in writing and personally negotiating the internet key treaty provision known as Article 9.

From a cyber security law development standpoint, what was especially significant was unleashing of the Morris Worm on the DARPA Internet weeks before the Melbourne conference — which played out in the International Herald Tribune daily. The concern was exacerbated by an enterprising New York Times reporter discovering that Morris' father was a noted U.S. national security official. The infamous malware incident resulted in many delegations — especially the cyber security experts on the USSR delegation — insisting Butler include multiple new cyber security provisions before they would agree to any treaty legalizing public internets and services. The provisions were added and based on innovative adaption of a continuum of cyber security treaty provisions that had existed over the decades. After the treaty was signed by most of the world's nations, ITU senior officials led efforts at nation levels to amend their national laws to enable international public internet implementations.

Unfortunately, most of the security provisions of the 1988 Convention related to public global internets were never implemented. The failures to act occurred even as cyber security challenges surrounding the DARPA TCP/IP internet going public grew exponentially.

Today the quest continues among Nation States to develop new cyber security treaty instruments dealing with the same basic requirements faced 167 years ago in a far more complex and globally interconnected environment — with little success and notable failures. Unfortunately, lack of knowledge about public international cyber security law today, seems endemic and appalling — even within the ITU's own ongoing expert groups. Perhaps it is time to return to the basics and develop cyber security solutions derived from Art. 9 of the 1988 Melbourne Convention and the continuum of global network security law that has persisted since Dresden. At a treaty level, the basic network security requirements are unchanged: sovereignty over national communication networks and service provisioning including the ability to inspect and stop communication harmful to national security, and protecting those networks and services against harm.

Disclaimer: The author was Secretary-General Butler's counsellor in 1987-89, responsible for the Melbourne Conference secretariat, and ITU Chief of Telecommunications Regulations and Relations between Members until 1992.

Correcton: October 11, 2017 – An earlier version of the title misstated the years since 1850. It was 167, not 117.

Written by Anthony Rutkowski, Principal, Netmagic Associates LLC

As I've written before, the registry operators for many country-code top-level domains (ccTLDs) have adopted the Uniform Domain Name Dispute Resolution Policy (UDRP) or a variation of it, while other ccTLDs have crafted their own dispute policies, or none at all.

Although no ccTLD appears as frequently as .com in domain name disputes, it's interesting to see which ccTLDs are subject to dispute the most often.

At the World Intellectual Property Organization (WIPO), which hears more domain name disputes than any service provider, the most popular ccTLD that shows up in decisions is .nl (Netherlands), followed by .au (Australia), and .es (Spain).

Here are the top 10 ccTLDs that have appeared in domain name disputes at WIPO through the years (the numbers in parentheses represent total disputed domain names, as of October 18, 2017):

1. .nl (955)
2. .au (780)
3. .es (666)
4. .ch (579)
5. .co (509)
6. .mx (461)
7. .fr (373)
8. .tv (306)
9. .ro (187)
10. .ir (161)

These numbers pale in comparison to the number of WIPO disputes for .com (49,219), .net (6,298), and .org (4,094) — and WIPO is not the only dispute provider for those, so the total numbers for these gTLDs are actually much greater.

Still, it's interesting to consider why domain names in the 10 ccTLDs listed above have been disputed as often as they have. While there's probably some correlation between the total number of domain name registrations and those that end up in dispute, I also think there are some other explanations:

• Two of these ccTLDs — .co (Colombia) and .tv (Tuvalu) — have been marketed as attractive alternatives to .com and have adopted the UDRP, which may mean both that they have appealed to cybersquatters and that trademark owners are comfortable enforcing their rights against registrants.
• The dispute policy for the .nl ccTLD allows a trademark owner to file a complaint without paying a fee (the fee is due only if a mandatory mediation period is unsuccessful), so trademark owners may find that model attractive.
• The dispute policy for .au (Australia) is modeled on the UDRP but is more flexible for trademark owners because it requires only that they show a disputed domain name has been registered or is being used in bad faith (whereas the UDRP requires both).

Finally, it's important to emphasize that this list only includes ccTLDs for which WIPO provides dispute services. Some ccTLD dispute policies are administered outside of WIPO, such as .uk (United Kingdom), which has been the subject of numerous disputes under the Dispute Resolution Service (DRS) policy administered by Nominet; and .us (United States), which has been the subject of numerous disputes under the usTLD Dispute Resolution Policy administered by the Forum.

Written by Doug Isenberg, Attorney & Founder of The GigaLaw Firm

The best and most knowledgeable experts of dot Brand met in the Brands and Domains conference, on October 2 and 3 in the Hague, Netherlands. Brand and project owners were also present, coming from all around the world — from Australia or Japan to the USA and Canada.

The keynote by Georges-Edouard Dias, CEO of Quantstreams and founder of the concept of brand hospitality, explained how customers are not anymore the targets of brands. Customers have taken the power, influence their peers — and brands must now become hospitable and welcome their customers. The name "home" is the most registered second level domain, showing how dot brand domains are seen as the new home for the relationship between the brand and the customer.

Akram Atallah, president of the domains division at ICANN conversed with Jeff Neuman, Senior Vice President at Valideus and Martin Sutton, director at the BRG, noted that an increasing number of brands were using their domain names, but also said that the true success of dot brand would come from innovative and creative uses of domain names.

One of the new and original use cases was presented by Katie Espinoza and Davide de Guz from Rebrandly, where brands can create meaningful and efficient shortcuts that can then be used in social media, mails and others marketing means. HSBC presented how they are using grp.hsbc to power their short links in social media, replacing the traditional bit.ly URL shortener.

Another original and concrete use case was illustrated by Katrin Olmert from dotZon, who showed how Audi uses their dot Brand domain to empower their distribution network and offer a fully branded, secure and streamlined customer experience to all of their prospects across Germany. Associating distribution partners increases trust and avoids risks. Yuliya Morenets, from the NGO Together against Cybercrime, carried out a survey and interviewed a certain number of retailers who expressed how getting a dot brand domain would increase their visibility and improve their online presence.

On the Search Engine side, Guillaume Pahud, representing the dot brand observatory, and Benjamin Louis as dot Alsace illustrated with three independent studies and protocols, that Google does not favour, nor penalizes the dot brand:

• An SEO competition was carried out on dot Alsace domains with local web agencies.
• Google searches were carried out on the 5000 dot brand second level domains, and looked at how the dot brand domains were ranked.
• An analysis of the migration of BNPParibas, Bradesco and Saxo Bank showed that organic traffic is actually higher with the new platform and new dot brand domain name.

Presentations and pictures are available on brandsand.domains.

Written by Sara Vivanco, Marketing Manager

One of the most profoundly disruptive developments occurring in the cyber security arena today is the headlong rush by a set of parties to ubiquitously implement extreme End-to-End (e2e) encryption for communication networks using essentially unbreakable encryption technology. A notable example is a new version of Transport Layer Security (TLS) known as version 1.3. The activity ensues largely in a single venue — the informal entity known as the Internet Engineering Task Force (IETF), where the proponents cite stolen highly classified documents as the basis for their efforts.

The generally understood objective by its zealous leaders is to cause everyone except the end parties of the communications services to "go dark" — impeding even the operations of network operators to manage their infrastructures and meet legal compliance obligations. The parties and organizations pursuing this activity generally share common interests born of cryptology competition, anti-government paranoia, and libertarianism — marketed as their own extreme notion of privacy. On the commercial side, the parties involved seek competitive commercial advantages for unimpeded Over-The-Top (OTT) services or e2e encryption products.

The assumption among these parties and organizations is largely that the potentially enormous adverse consequences are not their problem, and there are no legal consequences to their actions. This article, which is taken from a larger treatise, examines some of the diverse legal mechanisms for control of this activity, especially judicial "causes of action" potentially arising from existing and emerging new case law that suggest the legal risk exposure of extreme e2e encryption zealots could be significant.

The technology

End-to-end encryption of communications is hardly new. The basic technology has been around since human antiquity and adapted with every new communication technology over the past few millennia. What is new is the ubiquitous availability of extremely high-performance computational capacity at the communication network end points like contemporary smartphones or laptops coupled with its exploitation by parties who don't bear the disastrous consequences of its widespread implementation. Those known adverse effects include a lengthy list that include the inability of network operators to manage their infrastructure, diminished resilience and performance of networks, the uncontrollable proliferation of malware and other threat vectors, the inability to meet critical compliance obligations including the detection of insider threats, and global exploitation for criminal, cyberwar, and terrorist purposes.

Responsible commercial and intergovernmental industry technical venues have for decades adopted appropriate forms of Transport, Network, and Application Layer Security — rejecting extreme e2e encryption capabilities — and instituted alternative techniques that mitigate the adverse consequences and provide a balance among the competing design requirements. However, this balance seems unsatisfactory to encryption zealots who are hellbent on leading an extremist vanguard toward some nirvana of ultimate e2e encryption. Indeed, it is ensuing now at the Singapore IETF meeting in November, notwithstanding that the implementations would likely be unlawful in that country under its Computer Misuse Act.

Non-judicial controls

The legal controls in this category include enforcement of treaty provisions, national organic law and regulations, and contractual requirements among providers and with enterprise or governmental customers.

The key provision that is dispositive in public international law is known as Article 34 and it asserts that Nation-States have a sovereign "right to cut off, in accordance with their national law, any ...private telecommunications which may appear dangerous to the security of the State or contrary to its laws, to public order or to decency." The provision has existed for 167 years, and reaffirmed without reservations by every nation in the world continually in the face of every new technology.

There is flatly no "right" to unfettered personal encrypted communication on publicly available infrastructures and services. Conversely, the Art. 34 treaty provision and its precursors are the basis for broad proscriptions against e2e encryption in many if not most nations, that include active blocking mechanisms by detecting the signature of the traffic. Although further treaty-based requirements concerning e2e encryption have not been formulated, they could see further amplification under the aegis of enabling the Art. 34 provision within any of the several International Telecommunication Union bodies. As the original home of the Transport Layer Security Protocol and an array of other encryption specifications more than two decades ago designed to meet treaty provision requirements, it has a well-established basis for action today if necessary.

Similar global technical specification requirements among all the law enforcement agencies have long existed and continue to be updated yearly. Today, communication services providers must assist in making decrypted communications available when lawfully compelled by government authorities, and the requirements for wireline and mobile services are implemented within almost all industry technical standards bodies.

The concerns and avenues of legal regress have also been amplified recently by the U.S. Deputy Attorney General who noted: "Technology companies almost certainly will not develop responsible encryption if left to their own devices. Competition will fuel a mindset that leads them to produce products that are more and more impregnable. That will give criminals and terrorists more opportunities to cause harm with impunity. Sounding the alarm about the dark side of technology is not popular. Everyone who speaks candidly about 'going dark' faces attacks by advocates of absolute privacy."

Other important non-juridical controls on e2e encryption are implemented through contractual requirements — especially for cloud data centres. Contract provisions can either require standardized capabilities to enable trusted exposure of e2e encrypted communications or block them entirely. For example, in essentially all enterprise network implementations — especially for governmental use — private individual e2e uses are broadly proscribed, and indeed, any use is a prima facie indicator of a security threat.

A significant new global initiative known as the Middlebox Security Protocol (MSP) to responsibly manage e2e encryption consists of a set of new Technical Specifications plus a report in the European Telecommunication Standards Institute (ETSI) in collaboration with an array of other industry and scholarly bodies.

Judicial controls

Judicial legal controls on e2e encryption exist in several forms — both criminal and civil. It is not apparent that criminal measures have been yet pursued — which could include criminal conspiracy or being an accessory to a crime. Both criminal causes of action are potentially available. It is civil causes of action, however, that have become prominent in recent litigation. These include both tort and the violation of anticompetitive provisions of the Sherman Act. Coupled with the tort liability is the increasing likelihood that insurers will increase premiums or outright deny coverage for those engaging in irresponsible e2e encryption as an activity with increased financial risk exposure.

The question of civil liability for end-to-end encryption became actively discussed in a seminal Lawfare two-part article in 2015. As the article notes "thinking through liability can be a useful way of thinking through how society wants to allocate risk. And one way of thinking about the regulation (or lack thereof) of end-to-end encryption is to ask who, if anyone, should pay when things go horribly wrong." The article also notes that Judge Posner's advance of notions of proximate causation helps further the potential for culpability.

This civil liability control continues to be pursued in several recent cases growing out of terrorist incidents. The cases typically argue that the defendants (variously Facebook, Twitter, and Google) have liability for: 1) aiding and abetting acts of international terrorism, 2) conspiring in those acts, 3) providing material support and resources, and 4) negligent infliction of harm, including wrongful death. Some of the litigation has been dismissed, albeit not without concern being expressed by both the judges involved and legal scholars.

Some of the cases remain ongoing. It seems like only a matter of time before one of these cases proceeds to jury trial and results in significant damage awards. In the meantime, the litigation costs are significant. Providers, organizations, and individuals advancing extreme forms of e2e encryption that are almost certain to aid and abet multiple forms of terrorism, criminal activities, and infrastructure harm seem likely to be facing civil complaints for resulting damages in the U.S. and other jurisdictions worldwide.

Another recent relevant legal development acting as a control is the case of Trueposition v. Ericsson and other companies in the context of standards-setting activities. Here the complaint under the anticompetitive provisions of the Sherman Act, alleged that some of the participants in the standards process, including those in leadership positions, engaged in a conspiracy to harm Trueposition's ability to compete in the marketplace. The case did overcome various challenges and eventually resulted in a settlement where no wrongful actions were admitted.

The case did, however, shake up the standards community into a realization that there were potential consequences to activities. In addition to the far-reaching implications concerning the court's exterritorial jurisdiction over a standards-making body discussed below, the case advanced an additional viable control on pursuing irresponsible e2e encryption that potentially causes significant adverse harm to telecommunication transport service providers and vendors. The likelihood of an antitrust complaint here is enhanced because the e2e encryption developments arguably significantly benefit OTT providers to the detriment of underlying carriers.

Jurisdictional issues and venue liability

Until recently, the organizations which supported the discussions of network technology standards and the participants considered themselves largely immune from civil liability. That changed in 2012 with the Trueposition litigation initiated in U.S. Federal Court against several companies including the standards venues European Telecommunication Standards Institute (ETSI) and the Third Generation Partnership Project 3GPP). The complaint involved alleged anticompetitive conduct that ensued within the standards-making processes. After several years of litigation costing the parties many millions of dollars, the court held that there was basis for jurisdiction even though ETSI was based in France. The parties entered into a settlement agreement recognizing that those acting in a standards-making setting can be held liable for wrongful actions occurring in that setting.

Those participating in the IETF — which only exists as a kind of virtual umbrella of individuals — face even greater exposure. Unlike a normal standards body like ETSI or 3GPP, the IETF does not exist as a legal entity. It is asserted that participants act as individuals, and several non-profit corporations provide supporting services.

Thus, there appears to be no actual anti-trust policy or rules — only a kind of guide for conduct. There is also no legal entity to reduce the exposure of individuals for technical specifications that subsequently result in significant harm. To the extent that civil tort liability exists for initiatives led in the IETF and adopted among the participants, including the pseudo-leadership positions, it is those individuals (and possibly their employers) who would appear to bear the culpability. The IETF Trust purchases liability insurance for the Trust and its Trustees for the purpose of holding the IPR. For those playing IETF roles, the Internet Society provides liability insurance and a promise of legal support for their activities. Individuals, however, would appear to participate at their own risk for potential consequences of their proffered specifications.

Potential Actions

There is a kind of simplistic, self-referential zeal among some in venues like the IETF who bandy about terms like privacy to justify technical platform actions that have extreme adverse consequences — believing they are the ultimate authorities in determining the righteousness of their actions and thereby imparted legal immunity. This activity, however, exists within a larger ecosystem of legal controls which are rapidly evolving. It is legal systems in our societies that balance consequences and determine responsibilities, not self-appointed technical groups.

There are three potential sets of legal controls that are emerging with respect to those who are developing, promoting, and implementing extreme end-to-end encryption (ee2ee) capabilities:

• Intergovernmental, Nation-State, and service provider proscription of these actions
• Litigation by parties adversely affected against those entities and individuals in the pursuit of compensation of resulting damages
• Adjustment to the insurance coverage provided by insurers to deny protection to the entities and individuals

Written by Anthony Rutkowski, Principal, Netmagic Associates LLC