The TMCA

With the holiday season upon us and online goods and services flying off the virtual shelves, companies should not lose sight of the increased risk of phishing and cyberattacks. Society’s reliance on online commerce means businesses are under immense pressure to ensure their website domain names provide a safe destination for customers. To do so, they must prevent attacks on themselves and their customers. Sophisticated domain name watching can provide an early warning of phishing attacks about to happen. According to a 2021 study from IRONSCALES, 81% of organizations around the world have experienced an increase in email phishing attacks since March 2020.1 Further, domain name registry Identity Digital recently reported that 92.9% of all of its abuse claims for Q2 2022 were related to phishing attacks.2 Due to advancing technology and the expansion of allowable characters which can be used in domain names, cyber attackers are now running sophisticated phishing schemes which are not only focused on the technologically-illiterate. See The Top 5 Phishing Scams of all Time - Check Point Software. Domain name fraud is being used to trick employees, customers, and business owners alike. Cybersquatting Cybersquatting occurs when an attacker purchases a domain name featuring a brand’s name and/or trademark and uses it for illegitimate purposes. Typosquatting Typosquatting is a form of cybersquatting in which an attacker purchases a domain name which contains typos or slight discrepancies from a legitimate brand. Ex: D0rsey.com; Dorseylawfirm.com Homoglyph Attacks Homoglyph (sometimes referred to as Homograph) attacks occur when an attacker takes advantage of the similarity between certain characters in Latin and non-Latin alphabets (such as Cyrillic and Greek) to register domain names which appear identical or very similar to the domain name of the legitimate brand. Ex: example.com vs. exαmple.com Once these fraudulent domain names are registered, attackers can set up fake websites and/or email addresses to impersonate brands and fool customers into trusting them. Often these fraudulent emails are used to entice unsuspecting users to transfer funds or interact with links which can result in data breaches or malware attacks. To proactively halt these attacks before they happen, companies can implement domain name watch services (including typosquatting and homoglyph watches) to alert them when a domain name is registered which may be of concern. For further information regarding how brand owners can implement good domain name practices to protect their brands, please see Jamie Nafziger’s article, Deepfakes, Fake News & Viral Hoaxes: How Good Domain Name Practices Can Help Prevent Truth Decay.

And the new top level domain names just keep on coming. As our readers may know, ICANN, the organization that operates the internet domain name system, authorized the launch of the New gTLD Program – the largest expansion of the generic top-level domain name (“gTLD”) system on the Internet in history. Prior to the launch of this program only 22 gTLDs had been approved and added to the Internet (e.g. .com, .net, .org). Now, you can obtain specialized domain names, such as .bank, .weather, or even .rugby. Now .music has been approved for launch for the purpose of serving the global music community. An entity named DotMusic Limited beat out Google, Amazon, and other interested groups for the right to operate the .music registry. DotMusic states that it will verify registrants to ensure that only the rightful owner of a name can obtain a corresponding domain name. DotMusic further promises safeguards to protect against both trademark and copyright infringement, including investigation practices, penalties, and takedown procedures. To register a .music domain name, registrants must (1) belong to a music community membership organization (“MCMO”) and (2) meet clear membership criteria demonstrating “requisite awareness and recognition of their community.” MCMOs, according to DotMusic, constitute “a majority of all global music entities involved in the legal production, distribution and promotion of music,” and we assume therefore include performing rights organizations, such as ASCAP and BMI, as well as music publishers and record companies. As far as we can tell, the membership criteria has yet to be defined, but we assume most musicians belonging to an accredited MCMO will qualify. If you are interested in a .music domain name and not already a member of an MCMO, now is the time to consider joining one. .music domain names can only be registered if they are: the entire or portion of the applicant’s name; an acronym representing the applicant; a name that recognizes or generally describes the applicant; or a name related to the applicant’s mission or activities. Once launched in 2020, .music domain names will be available to verified members in the following order: (1) sunrise, (2) MCMO members, and (3) general availability. .music will use a Globally Protected Marks List (link here). Registration in the sunrise period will be open to brands and trademarks in the Trademark Clearinghouse (“TMCH”). A TMCH registration entitles trademark owners to pre-register domain names corresponding to their registered marks, typically for a premium price. We will keep our readers updated as more details emerge on the membership requirements and registration process. In the meantime, interested musicians might consider seeking registration of their trademarks in the TMCH to ensure early access to their .music domain name of choice.

On August 31, 2018, the Standing Committee of the National People’s Congress of the People’s Republic of China promulgated the E-Commerce Law of the People‘s Republic of China (“Law”) which will come into effect on January 1, 2019. As Chinese e-commerce platforms such as Alibaba, Taobao, JD.com, and others are now among the world’s largest e-commerce platforms handling billions of dollars of transactions each year, this Law has been widely called for by different stakeholders to regulate the rapidly growing e-commerce market in China.  The Law is formulated with an intent to protect the legitimate rights and interests of various entities in the e-commerce ecosystem, regulate the market order, and promote the continuous and healthy development of e-commerce.  Some key provisions relating to intellectual property protection are as follows: The Law codifies that an e-commerce platform operator who is aware or should be aware that a business operator using the platform has infringed the intellectual property rights of others should take necessary measures such as deleting, shielding or disabling access to the hyperlink to the infringing activities, terminating transaction or services (the “Necessary Measures”), failing which the platform operator will be held jointly and severally liable with the infringer. Currently, Article 36 of the PRC Tort Law only provides that an internet service provider should take necessary measures if they are aware of the infringing activities.  The question of whether the internet service provider is obliged to take action if it “should be” aware of such infringing activities has mostly been left unanswered by the PRC Tort Law. The Law provides a standardized take-down procedure pursuant to which the intellectual property right owner should notify the platform operator of the infringing activities and provide prima facie evidence of infringement. The platform operator should then take the Necessary Measures and promptly forward such notice and evidence to the business operator. The business operator may submit a counter-notice of non-infringement, which should include prima facie evidence in support of the counter-notice, to the platform operator.  Upon receipt of such counter-notice and evidence, the platform operator should promptly forward them to the intellectual property rights owner, who may lodge a complaint with the competent authorities or file a lawsuit with a People’s Court within 15 days from the receipt of such counter-notice and evidence.  If no such complaint or lawsuit is filed, the platform operator should terminate the Necessary Measures and allow the business operator to resume selling on its platform.  Platform operators who fail to adopt this requisite take-down procedure against a business operator who has committed intellectual property infringement could face a fine ranging from RMB 50,000 to RMB 2 million (approximately US$7,300 to US$290,000). To avoid misuse of the take-down procedure, the Law provides that the complainant will be civilly liable for any notice it filed against a business operator who suffers damages from the loss of business during the take-down period. The Law goes even further to provide punitive damages, and the complainant will be liable to pay double compensation if the notice is filed maliciously. Under the Law, a platform operator has a duty to remind business operators to obtain business licenses from administrative authorities and to require the business operators to display their business license information online. Such requirement will help intellectual property rights owners in uncovering the identity of the infringers. While a take-down procedure is now codified in the Law, there are still a number of issues that need to be clarified.  For instance, it is unclear whether e-commerce platform operators would include social media platforms.  It is also unclear whether intellectual property rights owners would need to submit prima facie evidence of infringement every time they file a take-down notice.  Currently, some platform operators provide a streamlined enforcement mechanism for some well-known brand owners, and automatically process take-down notices from them without requiring submission of any evidence.  The Law could arguably increase the costs for well-known brand owners to protect their intellectual property rights if they are required to submit evidence every time a take-down notice is filed. Implementing regulations to the Law are expected to be published before the Law comes into effect.  Hopefully, the implementing regulations will shed some light on these issues.  Overall, stakeholders should welcome the promulgation of the Law, which should better streamline e-commerce activities in China.

TheTMCA.com blog has had a busy first half of 2018 with a total of 62 posts so far this year. Thank you to our loyal readership, which keeps growing. In case you missed them, here are our top 8 posts of 2018 so far, with topics including the new GDPR privacy law, the Trump brand loss in a trademark license battle, music copyright issues and the large number of works entering the public domain next year. What's up with WHOIS? The GDPR May Limit or Prevent Access to Domain Name Registration Info Trump Brand Loses Trademark Licensing Dispute – Rules of Contract Law Prevail "Sleevey Wonders" are "Arm Tight" in California Lawsuit Tune Up: Initial Lessons from Gibson's Most Recent Trade Dress Lawsuit Adnan Syed Won a New Trial (Again), But the Serial Podcast Lost its Own Appeal Large Number of Works Set to Enter the Public Domain in 2019 Extra Foam, Please: Common Sense Prevails and Court Finds that Starbucks Lattes Contain Foam Did The 9th Circuit "Blur the Lines" in its Latest Music Copyright Case?

The organization tasked with managing the Internet’s domain names is struggling to come to terms with Europe’s new data privacy law.  On June 18, 2018, the Internet Corporation for Assigned Names and Numbers (“ICANN”) published for discussion the draft Framework Elements for a Unified Access Model for Continued Access to Full WHOIS Data.  The Framework hopes to answer the question of how ICANN and its contracting parties can legally provide third parties with access to non-public data about the people and businesses behind registered domain names.  That access, provided via ICANN’s WHOIS platform, is vital for intellectual property rights holders and trademark lawyers, not to mention law enforcement cybercrime investigations and countless others.  The rub, however, is that the European Union’s General Data Protection Regulation imposes a number of limitations on data collection and access. ICANN’s Framework hopes to navigate those limitations.  The Framework proposes a tiered-access model, wherein prospective users must apply for accreditation from government bodies before gaining access to full WHOIS data, which includes personal, private data. The Framework leaves open for discussion whether accreditation should permit total access to WHOIS data, or whether the credentialed user should be given access to limited data fields pertaining to the user’s stated purpose.  The Framework makes additional proposals towards responsible data management, such as requiring credentialed users and registrants to agree to specific codes of conduct that would limit data use based on their role. Still, ICANN’s Framework faces an uphill battle.  The Framework includes several tough-to-swallow proposals, and seeks cooperation from entities who have already expressed reluctance to participate.  For example, ICANN wants registrars—those entities who manage the reservation of domain names for ICANN—to log every single WHOIS search and make those logs available to ICANN.  The Framework also contemplates fees for accreditation and, thereafter, additional fees for access to private data.  And ICANN wants members of the European Economic Area’s Governmental Advisory Committee to assist in the accreditation process.  That Committee however, already stated in March that it “does not envision an operational role in designing and implementing the proposed accreditation programs.” Questions about ICANN’s Framework proposal are not the only challenges facing the organization’s WHOIS platform.  On May 25, 2018, the day GDPR took effect, ICANN filed a legal action against one of its registrars in Germany.  ICANN insisted the registrar was required to collect full, or “thick,” WHOIS data and transfer that data to a specified registry database.  The registrar, however, argued that most of the data was unnecessarily duplicative and therefore the registrar would be violating GDPR’s requirement that it collect and process as little personal data as necessary.  The German court rejected ICANN’s request for an order requiring the registrar to collect and transfer that data, although ICANN has several opportunities to appeal that decision. ICANN faces pressure to manage the Internet’s domain names in a manner that allows businesses to defend their websites and law enforcement to investigate cybercrimes.   It also must comply with the GDPR and responsibly manage the personal, private data with which it is entrusted.  The proposed Framework works towards meeting those dual objectives, but must overcome several hurdles along the way.

As many of our readers know, in 2011, ICANN, the organization that operates the internet domain name system, authorized the launch of the New gTLD Program - the largest expansion of the generic top-level domain name (“gTLD”) system on the Internet in history.  Prior to the launch of this program only 22 gTLDs had been approved and added to the Internet (e.g. .com, .net, .org).  With over 1930 applications for new gTLDs submitted in the program, ICANN has already delegated (introduced into the Internet) 1230 gTLDs as of the writing of this article. The much anticipated .app gTLD extension will soon launch.  Google paid $25 million for the gTLD extension at auction.  The gTLD was delegated in July 2015, and many companies have been waiting for registrations to begin.  Google’s minimal requirements for .app domain names include the following: (1) .app domain name registrations are secure namespaces; (2) all content must be served over HTTPS so that browsers can load .app websites; and (3) any registrant of a letter/letter two-character ASCII label represents that it will take steps to ensure against misrepresenting or falsely implying that the registrant or its business is affiliated with a government or country-code manager if such affiliation, sponsorship or endorsement does not exist. Below are key dates for the launch of the gTLD extension to keep in mind.  If possible, brand owners with interest in the .app extension should take advantage of the Sunrise Period to the extent they have registered relevant brands in the Trademark Clearinghouse and if not, make early submission if possible. Sunrise Period -- Mar 29 – April 30, 2018:  Trademark owners can register .app domains, ahead of the general public, for any marks they have registered in the Trademark Clearinghouse (TMCH) on a first-come, first-served basis; Early Access Period -- May 1 - May 8, 2018:  Anyone can register available .app domains for an extra fee; and General Availability Period -- May 8, 2018 and thereafter:  Anyone can register available .app domains. More information on the ICANN New gTLD Program, including statistics and lists of delegated and to be delegated gTLDS, can be found here.

Domain name registrars and registries might soon be changing their mantra from, “I think ICANN,” to, “Maybe ICANN’T,” when it comes to providing publicly available WHOIS information for domain name registrants.  New potential models for WHOIS will be posted January 15, 2018, and attempts to salvage at least most of the existing WHOIS system are underway. ICANN, the Internet Corporation for Assigned Names and Numbers, is an international nonprofit organization responsible for creating and maintaining rules related to domain names.  Among other things, ICANN contractually requires accredited domain name registrars (companies selling domain names to the public) and certain domain name registries (companies that manage domain name extensions) to maintain a free, publicly available WHOIS database from which anyone may obtain basic contact and technical information about domain name registrants.  This data includes information like the domain name registrants’ names, addresses, email addresses, and phone numbers.  Registrars that fail to comply with these requirements are in breach of their agreement and risk losing ICANN accreditation. But registrars and registries now find themselves between a rock and hard place when it comes to providing required WHOIS data in light of changes to EU privacy law under the General Data Protection Regulation (“GDPR”), which become effective on May 25, 2018.  We have written previously about the GDPR in other contexts here and here. In a nutshell, the GDPR imposes duties on companies based in the EU or offering goods and services to EU residents requiring these companies to protect all data that relates to a living individual, even where that data is publicly available or voluntarily submitted by the individual.  EU residents also have various rights, including the right to object (opt-out) and the right to be forgotten (erasure/data cleansing).  Consent to use data cannot be folded into online terms and conditions (like those agreed to during the registration of most domain names) and it may be withdrawn.  Companies that fail to comply with the GDPR may face enormous fines of up to €20 million or 4% of global annual revenue, whichever is greater.  Because much of the information available in WHOIS databases is governed by the GDPR (when it relates to EU registrants), these organizations are concerned about their ability to comply both with ICANN’s contractual requirements for public disclosure of personal WHOIS data and the GDPR’s data protection requirements.  Given the massive fines at stake under the GDPR, it is not surprising that many are opting to shirk ICANN’s WHOIS requirements as they prepare for the GDPR’s implementation. For its part, ICANN has acknowledged the conflict and has created a Protection/Privacy Issues webpage with updates on its consideration of the issue.  ICANN received a letter from the EU’s Article 29 Working Party in December saying that the current WHOIS system does not comply with the GDPR and the goals of WHOIS may be met by developing a system of layered access in which different users receive access to different sets of data. For the time being, ICANN is investigating options and has stated and that it will defer taking action for noncompliance with its WHOIS requirements if registries and registrars share their models for complying with the GDPR, their analysis of how each model complies with the GDPR and ICANN obligations, and a description of how the disclosed model does not simply abandon all WHOIS obligations.  It has asked for models to be submitted by January 10, 2018, and plans to post the models on January 15, 2018.  These submitted models are being evaluated by an outside law firm, which will present a number of options to ICANN, presumably so that it may either adjust its WHOIS policies or provide guidance to registrars and registries on how to comply with both the GDPR and WHOIS obligations. In its latest memo to ICANN (December 21, 2017), the outside law firm describes how layered access to WHOIS would significantly increase the cost and burden on registrars who are not in a good position to assess legally who should receive which type of access to WHOIS.  It recommends that layered access be considered as a temporary solution only.  It suggests that ICANN negotiate with EU regulators to allow the current WHOIS system to continue to exist long-term, with the same information publicly available (except for email addresses, which it deems unnecessary for enforcement activities).  It notes that similar information is currently publicly available in trademark registers. In the meantime, this conflict is likely to have a negative impact on the ability of brand owners to enforce their rights against domain name squatters and infringers.  If registries and registrars are unwilling to provide WHOIS data, it will be more difficult to ascertain the identities and contact information for infringers, either for purposes of sending demand letters or establishing patterns of abuse.  It could also make it difficult to file complaints under the Uniform Dispute Resolution Policy (“UDRP”), which requires that a complainant list the contact information for a domain registrant as it appears in the WHOIS database.  If the WHOIS information is not available, it is unclear what information, if any, a complainant would be required to include in the complaint to ensure it is complete and whether an arbitrator or registrar reviewing the complaint could refuse to act based on a lack of information.  Even if WHOIS information is available under a new, layered access system, the increased effort required to obtain ownership information will likely increase enforcement costs for brand owners. For now, it appears that ICANN is serious about trying to resolve the issue.  We will keep our readers updated on changes to this developing situation.