Reconsideration Request 01-4 Recommendation of the Committee Date: 11 January 2002

Recommendation

In reconsideration request 01-4, Verio, Inc. ("Verio"), requests that "ICANN reconsider the new policy set forth in the recently posted Registrar Accreditation Agreement limiting the marketing uses of Whois data acquired through bulk access." The substantive issue Verio raises concerns the contractual language in ICANN's accreditation agreements with registrars concerning use by third parties of bulk Whois data for mass commercial solicitations by telephone and facsimile. The bulk Whois data includes personal data relating to registrants, technical contacts, and administrative contacts for registrations sponsored by the registrars. For the reasons described below, the reconsideration committee recommends that the ICANN Board call the issue to the attention of the DNSO for its consideration of possible policy adjustments in this area, but that until development and adoption of policy adjustments through that process, the language of the existing accreditation agreements remain unchanged.

Factual Background to the Request

The factual background to Verio's request is complex, but can be summarized as follows:

1. The November 1999 Registrar Accreditation Agreement. In November 1999, ICANN adopted a standard form of agreement for use in accrediting registrars in the .com, .net, and .org top-level domains (TLDs). That agreement required registrars to provide bulk Whois data to third parties on a weekly basis, for a cost of US$ 10,000 annually, subject to restrictions on use of the data, including that "the third party [shall agree with the registrar] agree not to use the data to allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail (spam)." (Section II.F.6.c of November 1999 Registrar Accreditation Agreement.)

2. The Register.com v. Verio Controversy. This form of registrar accreditation agreement was used until May 2001. During that time, controversy arose between Verio and an accredited registrar, Register.com, regarding the meaning of Section II.F.6.c above, and specifically whether the prohibition on unsolicited advertising extended only to e-mail or included telephone solicitations as well. That controversy was one of several litigated in a lawsuit filed by Register.com against Verio in the United States District Court for the Southern District of New York (No. 00-Civ-5747 (BSJ)) over alleged misuse by Verio of Register.com's Whois data. This lawsuit ultimately led to judgment in favor of Register.com, which is currently on appeal.

3. Reformulation of the Registry Agreements in Early 2000. In November 2000, ICANN selected seven new TLDs for introduction into the Internet DNS, subject to entry of appropriate agreements between ICANN and the registry operator or sponsor. In addition, beginning in early 2001, the ICANN community engaged in an intensive discussion of proposed revisions to the registry agreements under which VeriSign (which had purchased NSI) operated the .com, .net, and .org TLDs. These community discussions concerned many issues, including the terms under which third parties should use Whois data for unsolicited commercial solicitations. An understanding of the detailed procedural history of these discussions is important to resolution of the procedural objections raised in Verio's request for reconsideration:

a. The Proposed New TLD Registry Agreements. On 26 February 2001 , after consulting with the four companies selected to operate the new unsponsored TLDs (.biz, .info, .name, and .pro), ICANN posted on its website for public comment a proposed form of the registry agreement to be entered between ICANN and the operators. That agreement required the operators, which proposed to operate "thick" registries containing registrant data, to provide public access to Whois data, subject to the restriction that it not be used to "allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers . . . ." (See Subsection 3.10.3 of 26 February 2001 Proposed Unsponsored TLD Agreement.) Thus, this agreement made clear that the Whois data could not be used for telephone or facsimile mass commercial solicitations.

Also on 26 February 2001, ICANN posted a proposed Appendix N to the registry agreements, which provided for public bulk access to zone files with the same restrictions on commercial use as provided for the use of Whois data. The combined practical effect of these provisions was to prevent third parties from accessing data about individuals stored for non-business purposes and using it to solicit business in mass via facsimile or telephone, in addition to the already prohibited solicitation via e-mail.

b. The Proposed Revisions to the .com/.net/.org Registry Agreements. On 1 March 2001, proposed revisions to the registry agreements for the .com, .net, and .org TLDs were posted on ICANN's web site. One of the goals of these proposed revisions was to put .com, .net, and .org on a closely similar footing to the new TLDs, and the proposed .com, .net, and .org agreements included the same language concerning use of Whois data as quoted in item a above. They also referenced Appendix N concerning use of data obtained by bulk-zone-file access.

c. Community Discussion of the Agreements. Both the 26 February 2001 proposed unsponsored TLD agreement and the 1 March 2001 proposed revisions to the VeriSign agreements were the subjects of extensive discussion within the ICANN community. Web-based forums were established for public comments, additional comments were received by e-mail and postal mail, and both topics were included in the in-person Public Comment Forum held at ICANN's meeting in Melbourne, Australia on 12 March 2001.

d. ICANN Board Action at Melbourne. At the Melbourne meeting, the ICANN Board adopted resolutions 01.25 and 01.26, under which the ICANN President and General Counsel were authorized to complete the unsponsored New TLD agreements along the lines proposed and, subject to a seven-day "last call" procedure, to enter into those agreements. The Board also adopted resolutions 01.22 and 01.23 soliciting comment on the proposed revisions to the VeriSign agreements and the public through 31 March 2001.

e. Subsequent Community Comment and Board Action. During the comment period, various groups (including the DNSO Names Council) provided comments on the proposed revisions to the VeriSign agreements. Although these comments mostly concerned aspects of the agreements other than those now at issue, on 30 March 2001 Verio submitted objections to the provisions of both the proposed VeriSign registry agreements and the proposed unsponsored TLD agreements relating to limitations on use of the registry bulk-zone-file and Whois data for unsolicited commercial marketing.

On 2 April 2001, the ICANN Board approved the proposed revised VeriSign agreements (with further revisions) in resolution 01.47. These registry agreements provided that bulk-zone-file and Whois data provided to third parties as required by the agreements could not be used for mass commercial marketing by telephone and facsimile, in addition to by e-mail. On 2 April, the Board also adopted resolution 01.48, authorizing the President "to take such actions as appropriate to implement the [revised VeriSign registry] agreements."

The first two new TLD agreements, for .biz and .info, were completed with all their appendices and posted on ICANN's web site on 26 and 27 April 2001. On 7 May 2001, the Board adopted resolution 01.61, which authorized entry of the registry agreements for those TLDs, containing the same restrictions on third-party use of bulk-zone-file and Whois data as in the newly revised VeriSign agreements. The Board also adopted resolution 01.62, providing:

that the President is authorized to implement the agreements once they are signed, including by accrediting registrars for the .biz and .info top-level domains (in that regard, registrars already accredited and in good standing for .com, .net, and .org may be accredited for .biz and/or .info without additional qualifying procedures upon entering an accreditation agreement that the President determines is consistent with the existing accreditation agreement for .com, .net, and .org, conformed to variations in contractual terminology and circumstances of the new TLDs).

f. Entry of New Registrar Accreditation Agreements. As contemplated by Board resolution 01.62, the ICANN staff prepared a new form of registrar accreditation agreement. That agreement allowed registrars to choose which TLDs (including the new TLDs) for which they wished to be accredited. It also incorporated several adjustments to the November 1999 .com/.net/.org accreditation agreement to "conform[] to variations in contractual terminology and circumstances of the new TLDs." These conforming changes included a revision to the bulk registrar Whois provision so that its language concerning third-party marketing use of the data matched exactly the bulk-zone-file and Whois provisions of the new registry agreements for .biz and .info, and the revised agreements for .com, .net, and .org, all as approved by the Board.

Analysis of Verio's Reconsideration Request

Analysis of Verio's request is complicated by uncertainty as to what it seeks to have reconsidered. From the request, it is clear that Verio objects to the provisions in the May 2001 registrar accreditation agreement providing that bulk Whois data that registrars are required to provide to third parties may not be used for mass commercial solicitation by telephone and facsimile, in addition to by e-mail. What is not clear, however, is whether Verio is challenging:

(a) the Board's 7 May 2001 authorization for the President to enter new registrar accreditation agreements "conformed to variations in contractual terminology and circumstances of the new TLDs", or

(b) the 17 May 2001 action by the President under that authorization, by which the language of the former agreements was adjusted in various ways, including in the provision concerning mass marketing by telephone and facsimile.

The validity of these two actions is considered in turn below. In the future, however, those requesting reconsideration are strongly urged to state clearly in their requests "the specific action of ICANN for which review or reconsideration is sought", as required by the Reconsideration Policy.

The Validity of the Board's Actions. Verio challenges the change from the prior version of the registrar accreditation agreement on two procedural grounds:

(a) Verio argues that the change was not made in conformity with the notice and comment provisions of ICANN's Bylaws. See Bylaws, Art. III, § 3(b).

(b) Additionally, Verio argues that Section II.F.7(a) of the prior registrar accreditation agreement required ICANN to follow the procedures for demonstration of consensus outlined in Section I.B of that agreement.

a. Bylaws Article III. Article III, § 1 of ICANN's Bylaws requires ICANN to operate "in an open and transparent manner." In order to facilitate this goal Article III, § 3(b) of the Bylaws provides that "[w]ith respect to any policies . . that substantially affect . . . third parties . . . the Board will . . . [1] provide public notice . . .; [2] provide a reasonable opportunity for parties to comment . . .; and [3] hold a public forum at which the proposed policy will be discussed."

As described in the Factual Background section above, the adjustment of the provisions relating to mass-marketing use of bulk-zone-file and Whois data was made after extensive public consultation in connection with the new TLD registry agreements (e.g., .biz and .info) and the revisions of the VeriSign registry agreements (.com, .net, and .org). The notice and comment period before the adoption of the registry agreements provided the public with detailed notice of the various changed provisions that were proposed in the registry agreements regarding the acceptable uses of bulk-accessed Whois data; members of the public were provided extensive opportunities to comment; and a Public Comment Forum was held in Melbourne on the changed provisions.

The change, of which Verio now complains, to the provisions concerning telephone and facsimile marketing using bulk registrar Whois data was a necessary result of, and fully encompassed within, the lengthy process by which the Board adopted the registry agreements. The goal behind the policy change limiting uses of bulk-zone-file and Whois data for mass marketing was the protection against unwanted solicitation and invasions of privacy by those intrusive marketing mechanisms. It was apparent that this objective could not have been achieved without conforming adjustments to the registrar accreditation agreement. The conforming of the registrar accreditation agreement to changes in the registry agreements was a natural and inevitable consequence of the broader adjustment in the Whois/bulk-zone-file marketing provisions; without the conforming changes to the registrar accreditation agreement, the changes to the registry agreement would have been a dead letter, without meaning.

In fact, Verio clearly understood in late March 2001 that these specific changes proposed in the registry agreements would apply to registrars as well, as demonstrated by its objection in its letter of 30 March 2001. In that letter, Verio raised the same substantive objections to the VeriSign and unsponsored TLD registry agreements that it asserts in its reconsideration request to the registrar accreditation agreement. Moreover, at several points in the letter, Verio describes the considerations at the registry and registrar levels interchangeably.

Accordingly, the reconsideration committee concludes that the notice-and-comment requirements of Article III were satisfied in connection with the approval of the registry agreements and that the making of conforming changes to the registrar accreditation agreements to implement the then-already-adopted policies did not require a duplicative notice and comment period.

b. Prior Registrar Accreditation Agreement. Verio also argues that the November 1999 registrar accreditation agreement required ICANN to follow the detailed procedures set forth there to make any change to the policy regarding bulk access to Whois data. Verio notes that section II.F.7 of the November 1999 registrar accreditation agreement states that the registrar's obligations to provide bulk access to Whois data "shall remain in effect until . . . replacement of this policy with a different ICANN-adopted policy." Under Section II.B of the November 1999 agreement, the adoption of a different "ICANN-adopted policy" is subject to prescribed procedures for documenting consensus.

Verio's assertion, however, misperceives its role with respect to the registrar accreditation agreement. ICANN's agreements with stakeholders, such as registrars, contain commitments by the stakeholders to implement various policies developed by the community through the ICANN process. To measure the stakeholder's commitment, the agreements include provisions regarding the documentation of establishment of policies that must be implemented. In contrast, to these commitments to implement, the procedures by which the community formulates policies through the ICANN process are governed by ICANN's bylaws and related documents (such as the reconsideration policy).

Where, as here, a stakeholder (such as a registrar) voluntarily agrees with ICANN to revise the procedures for its implementation of ICANN policies by replacing an existing agreement with a new one, the terms of the old agreement are no longer effective. When a new registrar accreditation agreement is offered to a potential or existing registrar, it may at that time choose to sign it or not; if it chooses not to sign it, its rights and obligations continue to be governed by any previous agreement until its term expires.

A challenge by a third party, such as Verio, to ICANN's willingness to enter a particular implementation agreement with a stakeholder, however, is governed by the bylaws and related policies under which the community develops policy through the ICANN process, not by the cancelled agreement between ICANN and the stakeholder. This is made clear by the terms of the November 1999 registrar accreditation agreement itself, which states that the "Agreement shall not be construed to create any obligation by either ICANN or Registrar to any non-party to the Agreement." Verio is not a party to the registrar accreditation agreement, and thus has no standing to assert any claims under the agreement, even if (and we do not believe this is the case) it could be shown that there was a breach of the November 199 version of that agreement.

Validity of President's Actions. It appears clear to the committee that the President acted properly in conforming the registrar accreditation agreement to the changed registry agreements. Board resolution 01.62 authorized entry of new accreditation agreements "that the President determines [are] consistent with the existing accreditation agreement for .com, .net, and .org, conformed to variations in contractual terminology and circumstances of the new TLDs." The identical language from the new registry agreements concerning marketing uses of bulk-zone-file/Whois data was incorporated in the bulk Whois provisions of the new registrar accreditation agreement. The committee believes this adjustment to the registrar accreditation agreement was well within the President's authority.

Substantive Objections to Restrictions on Mass Marketing Use of Whois Data. Verio also raises substantive challenges to the mass-marketing restrictions in its request for reconsideration. A request for reconsideration, however, is not the appropriate vehicle for Verio to raise questions about the substantive policy justifications for the restrictions. This committee's role is to ensure that appropriate processes were followed, not to re-debate the policy choices already made by the Board after community discussion. That discussion (which included Verio's comments in its letter of 30 March 2001) led to the Board's May 2001 adoption of the new TLD and VeriSign registry agreements with the provisions.

The reconsideration committee notes that the DNSO is currently conducting a review of Whois policy, including the appropriate marketing uses of bulk Whois data. The substantive challenges raised by Verio are best addressed within that bottom-up process.

Conclusion

The reconsideration committee recommends that the Board call the issues raised by Verio to the attention of the DNSO Names Council, which has appointed a Whois committee to consider possible policy adjustments in this area. Until development and adoption of policy adjustments through that process, the Board should not take any action to require a change to the terms of the registrar accreditation agreement as sought by Verio.