PassWord – 22nd July 2015

Speaker A: This program is brought to you by Resonance 104.4 FM. If you like what you hear and want to support our work, please make a donation at fundraiser.resonance.fm.

Speaker B: Hello and welcome to Password on Resonance FM with me, Peter Warren, the show that looks behind the placid surface of the internet and examines the hidden currents moving behind Behind the scenes. Now, it’s once again a week when hacking is dominating the technology headlines. Coming fast on the heels of the rumblings from the US about the hacking of the Office of Personnel Management, the entire database of US civil service employees that also includes details about their families and other close relationships, comes news of an attack on the US extramarital affairs website Ashley Madison. The OPM story, which the US blames on the Chinese, will not go away. And this afternoon in Washington, immediately after this programme, A debate will be taking place at the very hawkish American Enterprise Institute, which will be discussing whether there is a need for a more robust response to what the US dub an advanced persistent threat. What they say is an ongoing attempt by the Chinese to steal US intellectual property, and that it has to stop. The Chinese say they aren’t doing it, and the US are doing it too, and everyone else in the world is accusing everyone else of doing it as well. The reason for stealing the details of US government employees, it is claimed, so that they can be targeted as the means of getting into other databases run by the US government. Watch this space. Now, added to all of this is the attack on Ashley Madison, a controversial website that has been described as a sex-cheating mechanism for people in relationships. In fairness, it’s not the only one, but it’s a very successful one. Rumors abound. Once again, some say it’s the Chinese trying to find out which federal employees are having affairs so they can be blackmailed. But a group of moral crusaders have announced that they did it, and they will expose the names of those people using the services of Ashley Madison unless the site is taken down. Murkier and murkier. Here is Gavin Millard, a computer hacking expert, to shed some light on the latest hack.

Speaker C: Now I’m talking to Gavin Millard, who is the European Technical Director of Tenable Network Security, which is a computer company that supplies penetration testers with the tools to test out companies’ computer security. Now Gavin’s going to tell us about the interesting developments that have been occurring with the Ashley Madison website in the United States, which is one of the most popular websites for people wanting to have extramarital affairs. Gavin, apparently they’ve been having some issues. What are those issues?

Speaker D: So Ashley Madison unfortunately has allegedly suffered a breach where the attackers, that they’re calling themselves Impact Team, have broken into their infrastructure and stolen 37.5 million user records for the people that have signed up to the Ashley Madison website.

Speaker C: And so of course, anybody who signed up to that website, obviously they’re going to sign up because they want to actually be involved in a liaison, so they’re almost sort of guilty just by being on it.

Speaker D: Yeah, I think it’s— I think there’s gonna be a lot of people panicking right now that their details are going to be disclosed. Disclosed, and if they have partners, that their partners will also find out about it.

Speaker C: And of course, you know, Ashley Madison— why is Ashley Madison itself notable? There have been a lot of these sort of illicit websites for people— or not illicit, but websites for people wanting to have affairs. So why is Ashley Madison significant?

Speaker D: —So rather interestingly, the Impact Team, the people that broke, allegedly broke into the infrastructure, the reason why Ashley Madison angered them is because they were actually— Madison were charging $20 to have your username removed from their database. But quite interestingly, by paying them $20, of course that means then they’ve got your details anyway. So the Impact Team are demanding that Ashley Madison actually take all of their systems offline and delete ashleymadison.com from the internet. Right, right.

Speaker C: And there does seem to have been a bit of a sustained attack on these sorts of sites, wasn’t there? Wasn’t there another liaison finding website that was hit a couple of months ago?

Speaker D: Yeah, it was Adult Friend Finder, a very, very popular one for quite some time. They got hit a couple of months ago and details again were leaked onto the internet. So you could go and download the Adult Friend Finder user database from the dark web or Tor network.

Speaker C: But the issue with this is, you know, on the face of it, it seems to be the Impact Team who seem to be taking some sort of moral stance, but this could quite easily be Chinese hackers who are wanting to get the details of people who are having affairs in the United States. United States and then cross-referencing that across the database that they’ve got at the Office of Personnel Management so that they could find people within the American administration to blackmail.

Speaker D: That is definitely a probable or a possible approach. I think one of the biggest issues with attacks of this type is that accurate attribution is incredibly difficult to do. If we take the TV5Monde attack that happened at the TV station that was that was brought down in France a couple of months ago. Initially it looked like ISIS or ISIL had done it. In fact, they had messages of extremism written on their website. But it turns out later that it wasn’t really ISIS or ISIL that had done this attack. It was someone totally different, maybe possibly the Russians. And so they could be taking this moral stance against Ashley Madison to actually as a way of hiding their other desired goals, which is profiteering from the data that they’ve stolen. I see.

Speaker C: So, but I mean, if we do take it at face value, what’s the upshot of this? I mean, is it that we’re going to get people who are going to go crusading around the internet taking down sites that they don’t want, in which case there’s probably not many sites that people couldn’t find a reason to disagree with? I mean, anybody can disagree with anything.

Speaker D: Yeah, yeah, the internet is, you know, is a lot of people disagreeing with many different points of view. And, you know, I think that we’re seeing this cyber vigilantism starting to creep on onto the internet, you know, people taking, you know, DDoSing sites or bringing down companies because they disagree with certain stances. I think what’s really important is your organizations need to take a step back and say, right, how do I actually address of this problem? What steps do I need to take in place, put in place? So as an example, you know, at my company we go and find all these vulnerabilities to get rid of them so attackers can’t use them. People need to take this stuff seriously because in the end everyone’s a target nowadays.

Speaker E: Gavin Millar.

Speaker B: Well, as you can see, the information age is all about names. Names and behavior and understanding who is doing what is what it is all about. Reconciling a person with a bit of information, which if you think about it was the genius of Sir Tim Berners-Lee and the basis of the web. Which is why in the early days of the web there was a mad scramble for domain names. The.com domain name extension became the must-have web address. Now you can get any web address you want, and the latest one is.fans, which is currently in its sunrise phase, which means that companies and people who feel they have a specific interest in a name like, for example, rihanna.fans, for example, can go first. We have a panel of exalted studio guests to discuss this latest offering. Here in the studio we have Sam Taylor, the MD of.fans, Garrett Dixon, a lawyer from Cooley, a law firm with a particular specialism in technology who is an expert in GTLD, and we’ll find out what that is. And dialling in from Washington is Kurt Prince from the industry group DNA. How cool is that name? They’re right at the beginning. If you want to ask any questions of the panel, then you can text us on 07588 878310.

Speaker F: Hello to all of you.

Speaker E: Good afternoon.

Speaker B: All right, now, Kurt, seeing as you seem to be the bedrock of all of this domain names, why is it such a big deal, and why is this only happening now? It all seems like something of an afterthought.

Speaker E: Right, well, the original thought came in 1998 when ICANN was formed for— and one of the express purposes of it was to expand competition in the domain space, creating more registrars and more top-level domain registries, so expand beyond the original.com and.net and the original country code TLDs such as.uk and.us, all meant to introduce competition. But there were so many issues regarding how to roll this thing out that it took all the way to 2012 to finally launch around, and all this pent-up demand for these new domain names that are now becoming available.

Speaker B: [Speaker:PIERRE] So when you say pent-up demand, what sort of numbers are we talking about here?

Speaker E: Well, in the current application round, which was open for 60 days, ICANN received 1,930 applications for about 1,290 different new domain names. So there’s going to be, in addition to about the few hundred that are out there now, there’s going to be 1,290 new domain names by the time this is over in the next year or so.

Speaker B: Surely this is just, you know, I mean, you can keep on shaving domain names forever. Surely there’s going to be.mud at some point.

Speaker E: Well, there’s.sucks, which is pretty close. Oh, there’s a wide variety of domain names. There’s geographic domain names,.london of course that you’re familiar with, and.melbourne and.nyc, and there’s, you know, fanciful domain names like.ninja and.guru and everything in between.

Speaker B: Let’s see,.crime, is that coming?

Speaker E: Well, to a certain extent,.crime is not here, but not explicitly as a domain name. Okay.

Speaker B: Now, Sam, you’ve got DotFans. You’re one of these new entrepreneurs looking to make money out of names. How are you going to do that? What’s in a name?

Speaker F: What’s in a name? That’s kind of at the root of all of this. I think with what we’re doing with DotFans, obviously we’re a commercial company. We’re doing this to make money, but we went after a very specific domain extension here. We went after DotFans because we saw a solution by offering.fans domain names to people in the worlds of sport, music, entertainment, broadly speaking. It’s quite difficult to be a fan these days. There’s an awful lot of stuff to keep up with. Whether you’re a sports team, whether you’re a musician, something else, you’re pushing out content across all sorts of platforms on a daily basis. Facebook, Twitter, Instagram, Vine, YouTube, all of these different things. And as a fan, it’s kind of tough. To keep up with all of those different platforms. So we see.fans domain names as offering something to fans. They can go to one destination. They can find the great content about the things that they’re passionate about in one place. And for the, the celebrities, the sports clubs, the actors, the musicians, they’re offering that destination to their fans. They’re making it easier to engage with the content that they, they want to engage with.

Speaker B: But I mean, got fans, who owns what? You know, does Rihanna own her fans or do the fans own her? Manchester United fell out with their fans recently over the ownership of the club. A lot of them deserted to a local football club called Newton Heath. I mean, who owns what in a fan relationship?

Speaker F: Who owns what in a fan relationship?

Speaker B: I don’t know.

Speaker F: I mean, fans are fickle creatures at the best of times. You know, the relationship there is something that if you’re someone with fans, you need to be very careful. Your fans are your lifeblood. And if you don’t offer your fans what they want, then yeah, maybe they do fall out with you. Maybe they do go somewhere else. And so I’m not saying who should be owning that relationship, but I’m definitely saying if you are a brand, a team, a celebrity who has fans, the way to make sure that you keep those fans and grow those fans and fundamentally grow your business because your business is your fans is to engage with them properly and offer them what they want. And we see.fans domain names as being one of many ways that those people can help direct their fans to the content that matters to them.

Speaker B: But isn’t this what Facebook was about? I thought Facebook was the place that you did all of this stuff.

Speaker F: Facebook is great. Facebook is an amazing platform, and Facebook is possibly a victim of its own success, I think. You know, fans now— Facebook primarily was a personal platform originally. It was somewhere you interacted with your friends, and then Facebook brought in brands, musicians, sports teams. And now it’s very easy to, without even thinking about it, have ended up following 200 of your friends and another 200 brands, all of whom want to get their message out in front of you. Facebook timelines are now incredibly cluttered with all sorts of content, and it means that Facebook have had to begin filtering that content to make visible what matters to you most. So you may well follow your favorite artist, your favorite sports club on Facebook, but the way the Facebook algorithm works means that you won’t necessarily see all of the content that they’re pumping out on a daily basis, on an hourly basis even. And so we’re saying adopt fans to main name. I mean, there are many, many ways you can use this, but one is to take content that you’re already creating and present it in one unified place so that fans can go to that destination, see the things that matter, jump off into those platforms and explore the other content that’s there.

Speaker B: Now, Gareth, in your time at Cooley, is this something that people are picking up? I mean, are people now getting very, very exercised about brands? Are people getting hot under the collar about this?

Speaker G: No more probably than they always do when people are talking about their intellectual property. This is another forum where somebody can potentially exploit their own intellectual property, their brands. It’s also an opportunity for other people to exploit it for nefarious purposes. So cybersquatting is a good example. I mean, Kurt raised a very good point at the outset that this program has been in the making for, well, for a very long time. It was given formal approval within ICANN in 2007, I think it was, when the resolution was passed. But the window only closed in August 2012. So there is a feeling that having put so much work into it, The names should be correct. The strategy should be defined. People have known this is going to come. I think originally that we were expecting about 500 applications for new gTLDs, gTLDs being generic top-level domains as opposed to country code top-level domains. So the 1,930 that were applied for was a bit of a surprise to everybody. It was more successful, it was more popular than most people had anticipated. But it is taking a little bit of time for that to flow down to consumers and to registrants. There’s still some people who are perhaps not as aware of it as one might expect, but at the registry level, there’s certainly a very good amount of knowledge about it.

Speaker B: Kurt, some of these things are going for huge amounts of money, aren’t they? What’s, what’s the biggest so far?

Speaker E: Well, there, the application fee for all of them was the same, $185,000, but when two or more parties are contending for the same name,— that name might go to auction. And the largest one so far is that Google paid $25 million for.app, which far outstripped the second closest competitor. Typically they go for an auction of a few million dollars each at most.

Speaker B: Right. And it looks as though we’ve got a very contentious one coming up, don’t we? There’s a bit of a battle going on for.music.

Speaker E: That’s right. There’s a wide gamut. There’s about 8 contenders for that. And it runs the gamut from those who will run it as a completely open TLD to.music LLC, which actually gained the approval of, you know, 20 of the largest music organizations globally to support their particular application as representative of the community. So we’ll see how that shakes out. It’s going to be really interesting.

Speaker B: The Gareth, I mean, how does that work? Surely musicians own.music. Surely they could say, we make music, we should have.music. And if they’re going to go into a fight with these large global corporations, that’s going to be a bit unfair.

Speaker G: Well, I think what you’re talking about really is ownership of a generic term, and the rules that ICANN has allowed applications for generic terms to proceed upon has changed over the years. Initially, there were a number of applications to Kurt mentioned have a single registrant string, so only one applicant would run it. They would register all the domains at the second level. But because this was a generic name and not a branded domain name, all of those have changed and they’ve got to be opened up now so that there can be domain names owned by more than just one entity for generic terms. But it’s, it’s a bit of a balancing act. Do you have one entity owning.music, or do you have another entity owning.music? Because that’s, that’s the question. It’s not so much does nobody own it or does somebody own it. Somebody is going to own it. So how do you weigh the priorities of who it’s going to be? Well, that’s why you have these public interest commitments for generic terms, which are supposed to serve a public interest to make sure that they’re not being taken away from other people. And it’s not just.music.

Speaker B: There are a number of generics. So if someone’s got my name, what can I do about it?

Speaker G: Well, after— if somebody has registered PeteWaller.com, for example, I checked today and they have, and let’s say they were using it to spread vicious lies about you, there are a number of things that you might consider doing. If it’s a new gTLD, you have the Uniform Rapid Suspension service, which is a short and cheap way of getting a domain name suspended. There’s the UDRP, the Uniform Domain Name Dispute Resolution process, which is slightly longer, slightly more expensive. But a bit more flexible, lower burden of proof. But each of those require you to have rights or legitimate interests in your name and to make sure that the person who has registered the domain name has registered it in bad faith. That can be quite difficult to show. I’m sure there are lots of people who are called P. Waller. The alternative might be to go to court, but again, you’re going to have to show some sort of reputation. It’s not a new thing. It’s not a domain name thing that people have the same name. That they have different interests. So for personal names, it can be quite difficult unless you have a trademark, which is why a lot of celebrities register their names as trademarks. And they go through the UDRP. I had a look at the World Intellectual Property Organization website this morning, and there are about 350 separate complaints filed by celebrities to recover their domain names, most of them successful. I counted only 50, 53 that were not successful, but some, some interesting ones, some involving Donald Trump. Perhaps he should look out for a.fan website himself, but people like Edward van Heelen, for example, did not recover the domain name edwardvanheelen.com. Politicians tend to have a bit of difficulty in recovering their names, particularly in the US, because freedom of speech. You don’t want to hamper what people can say, and very often using somebody’s name is a great way to get the attention of your target audience. If you prevent people from doing that, you have to have very good reasons. To do it. Slightly different over here, but the Uniform Domain Name Dispute Resolution Policy, it’s global. So to some extent, there’s a bit of a conflict between panelists who come with different mores or expectations to a dispute. But the rules are quite clear, and it’s been going on for a long time, so they should be more predictable.

Speaker B: So, Sam, you’re going to be the one arbitrating on all of this, are you? You’re going to be the one deciding whether Donald Trump has fans or not?

Speaker F: To an extent, but not really. So with DotFans, we’re doing something quite different. We realized very early on that in fact a lot of people who are in our target end user groups—musicians, celebrities, actors, actresses—they don’t necessarily have a trademark. A lot of musicians who are globally recognized names don’t actually have a trademark relating to their name. And so the process laid down by ICANN, this period where you give trademark holders priority registration, doesn’t necessarily work for our target audience. So we’ve put in place a different measure, which is fairly unique to what we’re doing, which is we have aggregated all sorts of different data from multiple sources. We have come up with a big list of the most influential sports clubs, musicians, actors, actresses, computer game studios, fictional characters, things like that, where there is a very well-established fan base, and we’ve put those entities on a list, and we’ve said we’re not going to release them immediately for public registration. We’re going to make sure that the people who control the established rights there, so your example of Rihanna.fans, that Rihanna’s management team have the best shot they can at getting that name, because what we want to do is have those domain names go to those kinds of people so that they can provide more clarity for their existing fans. Sure, it would be nice if anybody could come along and register these domain names, but we all know what would happen on the internet. There would be people move in, speculators, squatters. We talked about cybersquatting earlier on. And it wouldn’t add any value. With.fans, we are a commercial company, But also I feel we have a responsibility as someone who controls a big chunk of the internet to add clarity to people’s experience online. So by making sure that.fans domain names go into the hands of the right people, the entities in question, we can help provide that clarity, help provide value to those fan bases and those entities.

Speaker B: So Kurt, I mean, Does this make any difference? Surely if I Google Wayne Rooney, which I obviously do every day, if I do, my Google search will turn him up, whether he’s a.com, a.fan, or a.mud.

Speaker E: But Wayne has the opportunity to establish a memorable presence on the internet that people will recall with waynerooney.fans, and all his fans will remember that. And that’s one of the great opportunities of all these different names is to establish these memorable combinations to establish a permanent internet presence that is short. So, you know, for somebody old like me, you know, eltonjohnfans.co.uk is okay, but eltonjohn.fans is memorable. And, and as, as people get used to knowing that’s a safe place to go and that’s the Elton John place, people will remember that. And the same thing with these different names across the board. They establish, you know, a new opportunity to establish a permanent economic internet presence. That becomes a part of your strategy, whether you’re a business or an organization or religious organization or just a fan club.

Speaker B: So do the search engines work better with these domain names?

Speaker E: Is it better for the technology to have them? Yeah, that’s sort of a black art to determine that, right? But some preliminary studies that we’ve been involved in show that that real estate, you know, well, let’s come up with a better example like that, but contracts.law or contracts.abogado does better in search than contractlaw.com or contractlaw.net because the word combinations have relationships and the algorithm in the search engines like that a little bit better.

Speaker B: Okay. Now, Gareth, dead people. You know, I mean, dead people can’t sue. Do dead people have a reputation?

Speaker G: Is Elvis.fans going to be out there? Well, one thing they almost certainly will have is a trademark registration that is owned by the estate, who then has the right to control the exploitation of that mark. And certainly there are UDRP decisions involving Jimi Hendrix, for example. I mean, the UDRP didn’t start until long after he was dead, so that being dead is not necessarily a problem. You can still—

Speaker B: it is if you are.

Speaker G: It is if you are, if you know about it. But, um, No, it, uh, it shouldn’t be a problem for, um, exploitation of postmortem, uh, rights.

Speaker B: So is, is, is, um, Elvis.fans gone? Is it, Sam?

Speaker F: Is, is the estate moved in on that one? Not yet, no. Um, but Elvis.fans, you know, Elvis is— Elvis himself, well, may or may not be dead. Some people say he’s, he’s on the moon looking down at us, but you know, I’m not one to judge there. But the Elvis estate is still very much a living, breathing commercial entity doing great things every day. So elvis.fans is obviously a domain name that I would have thought would be of great interest to the Elvis Presley estate, and I, I’d love to see them come on board and use it for something great to engage with their fan base.

Speaker B: Are there particular ones that you’ve earmarked? Are there particular things that you’re waiting for someone to come in?

Speaker F: I think that there are sort of two classes of names we deal with. We have the protected names which relate to specific brands, people, sports clubs, whatever. But then we also have generic terms. So football.fans, music.fans, rugby.fans, cricket.fans, all of these sorts of things. And I would love to talk to people who have a really exciting idea for how domain names like that might be used, because I think If you’re operating a site about football and your web address is www.football.fans, that, that gives you a great edge over a lot of other content producers online. And so we’ve definitely marked out generic names like that where we’re just waiting, we’re hoping that someone comes to us, we’re reaching out to people saying, look, we think you could do something really exciting here.

Speaker B: So Kurt, I mean, you, you, do you think this is an opportunity for just the big names, or is it something that you think is going to engage lots of small businesses?

Speaker E: I think there’s a great opportunity for small businesses. You know, we established this site called Domains in the Wild. Well, actually it’s inthewild.domains, where there’s many examples of small businesses that are using new domains. So one was spotted in Leeds— just the other day, FiveTowns.properties, and obviously they’re a real estate firm and you can relate immediately to that. But there’s West.Berlin and Goodwill.jobs. So small and large entities are taking advantage of this. And I think, you know, as more and more celebrities adopt them and large corporations, and especially as they get embedded more in the pop culture, those are going to be tipping points for increased use of.fans and other similarly situated new domain names.

Speaker B: So Gareth, I mean, you’ve presumably been representing a lot of people who have, you know, contentions about the domain name.

Speaker G: Presumably they are celebrities, aren’t they, or they’re big brands? There are mainly big brands who are involved at the moment. They’re the ones who are getting into disputes because they’re the ones who are fighting for the right to own a GTLD that has been applied for by a number of different entities. There are UDRPs that are being filed, URSs are being filed against domain name registrants at the second level. That’s just humanity. Wherever there is two people, there will be competition. So it’s no different to anywhere else. And actually on that note, I think one of the in-the-wild.domains that Kurt posted on Twitter a couple of days ago I think was in Boston. A big sign above one of the baseball stadiums saying “New York dot sucks.” So a good use of new utilities.

Speaker B: I think they’re now hitting pop culture. I see. So we’re going to see a rush though of footballers and pop stars now going for trademarks. Possibly.

Speaker G: I mean, it would be a bit late to start applying for trademarks now for the current round, but there will be future rounds.

Speaker B: Right. Okay. Well, thank you everybody. Thank you. Reputation management in the information age, that’s what it’s all going to be about. The name is the message, and the message is nearly over. This is Password on Resonance FM, and if you’ve just joined us, you’ve missed it, but we’ll be back next week. And you can find out more about technology and society at our website, futureintelligence.co.uk. Password is made by Angel Media Productions CIC. Thanks for listening.

Speaker A: Goodbye. This program has been brought to you by Resonance 104.4 FM. If you liked what you heard and want to support our work, please make a donation at fundraiser.resonance.fm.