ICANN clips cybersquatters' wings

The Internet Corporation for Assigned Names and Numbers (ICANN) is in the process of implementing an important change to the rules governing the Uniform Domain Name Dispute Resolution Policy (UDRP). 

This rule change will require all ICANN-accredited domain name registrars to lock any domain name that is subject to a UDRP complaint prior to the domain name registrant being informed of the complaint. This will prevent domain name registrants from engaging in what is known as "cyberflight", whereby upon receipt of a UDRP complaint, registrants transfer their domain names to another registrar or to a new registrant entity. Such behaviour is problematic for UDRP complainants as they then have to subsequently amend their complaints to account for the change in ownership details of a domain name.

When bringing a complaint under the UDRP, complainants must file the complaint with a body that provides UDRP services such as the World Intellectual Property Organisation Arbitration and Mediation Centre, the National Arbitration Forum or the Czech Arbitration Court, to name but three providers. The UDRP complaint must clearly identify the domain name (or names) that is the subject of the UDRP, the details of the registrant of the domain name as identified in the WHOIS and the registrar of the domain name.

Under the current version of the UDRP rules, the complainant must send a copy of the UDRP complaint to both the registrant and the registrar of the domain name at the same time as filing the complaint with the UDRP service provider. Upon receipt of the complaint, the UDRP service provider then conducts a compliance check of the complaint. As part of this compliance check, the UDRP service provider verifies with the registrar that the domain name is indeed registered with that registrar. Upon completion of the compliance check, the UDRP service provider then notifies all parties that the UDRP proceeding has started. It is at this point that registrars usually apply a lock to the domain name.

However, this process has sometimes proved troublesome for UDRP complainants and UDRP service providers. This is due to the fact that there can be a time gap between when a respondent is informed of the UDRP complaint and when the registrar takes action to lock the domain name as a result of the UDRP complaint. Thus, there is a small window of opportunity for the respondent to transfer the domain name to another registrar and/or update the ownership details of the domain name. This results in the complainant having to amend their UDRP complaint and in some circumstances having to substantially redraft their arguments. This problem is further exacerbated by the fact that there is a lack of consistency in the behaviour of registrars upon receipt of the notification from the UDRP service provider that the UDRP proceeding has started. For example, some registrars immediately lock a domain name to prevent it from being moved to another registrar or have any of the details updated. However, some registrars can take several days to do this. Furthermore, under the current rules, there is no definition of what a "lock" is on a domain name and what it would prevent a domain name registrant from doing.

However, this is now all set to change. The new rules governing the UDRP will now contain the definition of what the "lock" a registrar should put in place should be:

“‘Lock’ means a set of measures that a registrar applies to a domain name, which prevents at a minimum any modification to the registrant and registrar information by the respondent, but does not affect the resolution of the domain name or the renewal of the domain name.”

In addition to this, UDRP complainants will no longer have to provide a copy of the UDRP complaint to the registrant of the domain name at the same time as filing the complaint with the UDRP service provider. Instead the UDRP service provider will, upon receipt of the complaint, send a verification notice to the registrar of the domain name. When a registrar receives a verification notice, they will be obliged to lock the domain name within two working days and the lock must correspond to the definition outlined above.

Once this lock is in place and if the UDRP complaint is compliant, only then will the UDRP service provider notify all parties, including the respondent of the UDRP proceeding.

These changes to the UDRP rules will completely eliminate the possibility of a UDRP respondent engaging in cyberflight and provide a much greater degree of certainty for UDRP complainants when drafting and filing their UDRP complaints.

David Taylor and Daniel Madden, Hogan Lovells LLP, Paris