ICANN 87 Bali: show me the data

“Data is a precious thing and will last longer than the systems themselves.”
Tim Berners-Lee

Back from Bali, and something was different this time. The meeting was a lot less confrontational than usual. Fewer raised voices, less finger-pointing, and almost nobody accused registrars of living off abuse. Almost.

Peace, love and data

Maybe it was Bali's welcoming atmosphere. Maybe it was ICANN Compliance finally showing its teeth: at the end of August, a registrar lost its accreditation for failing to act on DNS abuse reports, the first termination based on the 2024 DNS abuse amendments to the RAA. Or maybe it is because the first PDP on DNS abuse mitigation, on Associated Domains Checks (ADC), is moving well and fast. Probably a bit of all three.

Some are still publishing so-called reports that are closer to gaslighting than to research, but nobody takes them seriously anymore. I wrote about one of them after Seville. And for anyone still convinced that registrars make money from abuse, the RrSG shared two short explainers with the GAC in Bali: Why Registrars Want to Mitigate DNS Abuse, and Financial Impacts on Registrars of DNS Abuse. Spoiler: abuse costs registrars money, it does not make them any.

What really changed is that everyone now wants a common data set. The community seems to have realised that without data, there is no effective policy. Only opinions.

Social distancing, gTLD edition

Since Reveal Day on 7 October, new gTLD applicants competing for the same extension may not talk to each other about their applications or about how to resolve the contention. The ICANN community isn't that big, so even people who know each other well had to keep their distance for the whole meeting, just in case.

Crossing half the planet to see people you only meet at ICANN meetings, and then avoiding them at the coffee break, is kind of funny when you think about it.

ADC: look around, not everywhere

As a reminder, the ADC PDP was launched to make registrars who only act when they receive an actionable report take off their blinders. If other names associated with an abusive one are blatantly abusive too, they should act on the whole account. Think login-bankofluxembourg.com sitting in the same account as login-bankoffrance.com: if a registrar receives an actionable report for the first one, it should not wait for a second report to suspend the other.

It was never meant to send registrars on witch hunts, checking every payment made on a given day or every domain name using Cloudflare name servers. It requires discernment, and in Bali the working group accepted that two registrars looking at the same evidence may reach different conclusions. Some will call it inconsistency. We call it judgement.

As mentioned in the Seville post, this policy should positively impact the industry, but measuring that impact will be difficult. And registrars are no longer the only ones saying it. The SSAC, aka the council of techies, published SAC135, which recognises that searching for and identifying associated domains will look different from one registrar to another, and that its effects will be hard to measure.

OCTO-044: the view from outside

After ordering and funding the INFERMAL study, OCTO (the Office of ICANN CTO) keeps publishing. Its latest report, OCTO-044, is about ADC and identifies associated domains using only public registration and DNS data. It does highlight some interesting data points. But public data only shows the surface.

OCTO needs to move beyond content and URLs and work with contracted parties, who hold the data and the operational knowledge that public data will never show. That would also help OCTO monitor DNS abuse better.

And that matters, because OCTO plans to use its Domain Metrica platform to compare how long abuse stays online, TLD by TLD and registrar by registrar. Considering ICANN Compliance will rely on this data for its enforcement action: better make sure the data is right first.

Registration at Scale: same problem, better name

Which brings us to the second DNS abuse PDP, first presented as “API access gating” and now renamed “Registration at Scale”. The new name is better: the problem is abuse at scale, not the API itself.

The charter should be ready around late December, and the PDP should start as soon as the ADC PDP ends. However, bandwidth is limited and volunteer fatigue is real. The same handful of people cannot sit on every working group forever.

No API knowledge, no API policy

Another volunteer issue came up during the meeting with the contracted parties: some volunteers lack operational knowledge. Being appointed as a representative does not magically come with technical knowledge. The SSAC offered to help train future working group members.

In yours truly’s opinion, training should even be mandatory. If you do not know what an API is, you should not be drafting policy about APIs. Nobody would ask me to write the rules for brain surgery, and that is probably for the best.

Batch is not bulk

OCTO was really active during this meeting, another sign that the community recognises the need for data. It held a session explaining how it identifies malicious domain registrations at scale.

The terminology has moved away from the dreaded “bulk registration” towards something more granular, which is a positive sign. Domain names registered at the same time are not necessarily part of the same attack, and names registered weeks apart can be. OCTO distinguished “batch” registrations, tightly grouped in time, from “bulk” registrations spread over a longer period.

Since the current draft of the PDP charter still relies on “speed and volume of registrations”, this precision is worth highlighting. The team drafting the charter should not focus on how many domain names can be registered at once through a registrar, but on what the registrar’s automated tools actually allow, be it an API, an MCP server, an agentic tool or whatever comes next. Counting domains is easy. Understanding the tools is what will make the policy useful.

API access is not a human right

Although the charter is not finalised yet, the Non-Commercial Stakeholder Group presented a human rights impact assessment on registering domains at scale. Its concern: gating API access could prevent charities and associations from registering many domain names at once to avoid censorship.

To be frank, this seems far-fetched. Registrants can always use the registrar’s public interface, the API is just another door to the same platform. And if one registrar cuts your API access, there are plenty of others happy to take your business.

Access to a registrar’s services, including its API or any other tool, should follow the same criteria for everyone, and whoever uses it against the terms gets disconnected. That is not a human rights issue. That is a terms of service issue.

The blind men and the elephant

During the ICANN Public Forum, the BC Chair compared measuring DNS abuse to a blind man touching an elephant: depending on where his hands are, he thinks he is touching a different animal. It is a pretty apt analogy.

Registrars see one part of DNS abuse, registries another, security vendors and users yet another. CleanDNS, NetBeacon and co. see clusters spread across several registrars that no single registrar can see, while registrars hold account data that researchers never see.

No view is complete, and everyone fills the gaps with assumptions. Which is exactly why a common data set matters.

Some standards, please

Data was not the only thing missing in Bali. Two topics showed that the community also needs common rules.

Suspended, now what?

This gap is real, and it had its own plenary session in Bali. ICANN does not require registrars to offer a proper recourse procedure once a domain name has been suspended. The Registrants’ Benefits and Responsibilities only entitle registrants to information about “how to raise concerns and resolve disputes with your Registrar”.

Knowing where to complain is not the same as having a procedure to challenge a suspension. Some ccTLD registries already have one.

The plenary broadly supported a minimum standard: a channel to challenge a suspension and a good faith review of new evidence, without forcing anyone to reverse a justified decision.

At EuroDNS, if you disagree with a suspension or any other action we have taken, you can submit a claim and we will handle it following the procedure described here: https://www.eurodns.com/report-abuse

Privacy/proxy accreditation: split it in two

The team responsible for implementing the privacy/proxy accreditation policy is still trying to turn an outdated policy into a workable process. Progress is being made, but the main issue is yet to be solved.

Registrars fully control the privacy/proxy services they operate. They have no control over third-party services offered by law firms or web agencies.

In Bali, we proposed solving this by splitting implementation into two tracks, without reopening the policy recommendations. The first track, almost ready to be published, would cover registrar-affiliated services through an annex to the RAA. The second would cover third-party providers, which would have to seek full accreditation from ICANN.

Let’s hope this proposal helps the group move forward and finally brings some standardisation to how privacy/proxy services operated by ICANN-accredited registrars work.