Application number: 1-1226-82695 for First Registry Limited

First Registry Limited

6A Queensway
Gibraltar GX11 1AA
GI

+350 200 610 61

+350 200 510 71

Mr. Geir Rasmussen

Chief Executive Officer - Famous Four Media Limited

+34 647 025 505

+350 200 722 70

icanntas44@famousfourmedia.com

Mr. Iain Simon Roache

Chief Executive Officer – First Registry Limited

+350 575 660 00

+350 200 722 70

iroache@domainventurepartners.net

Limited Liability Company

Incorporated under the Gibraltar companies act of 1930

Not Available

Domain Venture Partners PCC Limited

Domain Management Limited
Director

Charles Ashley Richard Melvin
Chief Operating Officer
Iain Simon Roache
Chief Executive Officer
Timothy James Ireton
Chief Financial Officer

Domain Venture Partners PCC Limited
Not Applicable

win

Not Available

Q16
The Applicant has taken steps to ensure that there are no known operational or rendering problems concerning the applied-for gTLD string (the “String”). The following has been undertaken:
a)The TLD label is valid as specified in relevant technical standards, including: Domain Names: Implementation and Specification (RFC 1035), and Clarifications to the DNS Specification (RFC 2181) and any updates thereto;
b)The TLD label, which is 3 characters long, is well short of the 63 character maximum length;
c) The TLD label is a valid host name, as specified IN: DOD Internet Host Table Specification (RFC 952), Requirements for Internet Hosts — Application and Support (RFC1123), and Application Techniques for Checking and Transformation of Names (RFC 3696), Internationalized Domain Names in Applications (IDNA)(RFCs 5890-5894), and any updates thereto;
d)The TLD label consists entirely of letters (a-z)
The Applicant has evaluated the risks of the TLD experiencing TLD Acceptance issues similar to problems reported in the “Evaluation of the New gTLDs: Policy and Legal Issues” (31⁄08⁄2004) which discussed acceptance issues associated with the year 2000 round of new gTLDs with more than three characters (i.e.,.aero,.coop,.info, .museum, .name). At that time, only one gTLD, .arpa, which is not widely used outside of limited circles – had four letters. As a result, the new gTLDs had compatibility problems with the software used by Internet infrastructure operators and application providers. Some users have recently been reporting issues with the use of .xxx names in applications such as Twitter and Skype where domain names entered from that TLD are not instantly recognized with a hyperlink as more established gTLDs are.
The String has fewer characters than the current longest TLD which is (.museum).
The Applicant’s registry backend services provider, Neustar Inc tested the String for potential rendering or operational problems; none were found.
As the String is not an IDN it does not contain characters that require mixed right-to-left or left-to-right functions. The applicant has familiarized itself with the requirements and components of the IDNA protocol by reviewing the RFCs and background information found on the ICANN IDN Wiki.
The Applicant tested the String using the ICANN SWORD String Similarity Assessment Tool algorithm. The result of this test is 63. The Applicant considers this to be below the level where issues might occur. Should Registrants experience any acceptance issues the Applicant will have a dedicated Operational and Rendering Team (“ORT”) on an on-going basis to assist with operational, rendering issues or any other problems that might arise. The ORT will be in place to assist Registrants with any additional problems that may arise out of new TLD that other applicants may be awarded during this process which could lead to unforeseen string confusion now and in the future.
-end-

Q18A
Mission and Purpose of .win?
The Applicant’s mission and purpose is to create an environment where individuals and companies can interact and express themselves in ways never before seen on the Internet, in a more targeted, secure and stable environment. Its aim is to become the premier online destination for such creators and their wide range of users. The Applicant will create an Internet space whose central function is to provide a platform for creating, producing and disseminating informative, creative and innovative content that is easily recognizable as pertaining to its stakeholder group. The Applicant is acutely aware of the importance of ICANN’s mission in coordinating the global Internetʹs systems of unique identifiers and ensuring their secure and stable operation. The Applicant’s core focus is to create a secure, sustainable, and specialized gTLD, thus supporting ICANN’s primary goals for this program in promoting consumer trust, consumer choice, competition and innovation.

Why .win?
Be it full-competition gaming for high stakes, or playing games with family members for matchsticks, nobody can completely avoid the competitor inside them – we all like to win. Playing and winning a game is one of life’s simple pleasures, it excites passions and can bring people together in the best of ways, and the internet has allowed this to happen on a greater scale than could ever previously be imagined. 

Since its inception the internet has revolutionised the way people communicate, share, play, do business and learn. However, access to the countless benefits and opportunities which the internet offers can often be hindered when navigating the ever-expanding sea of irrelevant and sometimes malicious content which also exists, and this is as true of online gaming as anything else.

Thus, the aim of ‘.win’ is to create a blank canvas for online game resources set within a secure environment. The Applicant will achieve this by creating a consolidated, versatile and dedicated space to access gaming information and services. As the new space is dedicated to those within the gaming affinity group the Applicant will ensure that consumer trust is promoted. Consequently consumer choice will be augmented as there will be a ready marketplace specifically for online game-related enterprises to provide their goods and services. All stakeholders within the sector will be able to sample reactions to new ideas, or gather thoughts on the improvements of established ones. This will drive innovation and competition, as new channels will be available which are not yet fulfilled by current market offerings, compelling registrants to seek new and varied ways to separate themselves from the competition.

How will .win take shape?
The Applicant believes that the success of the gTLD will be determined largely by the sector’s key global stakeholders. These stakeholders will be interested in registering a domain and additionally be motivated to protect their sector from detrimental practices. The Applicant believes that stakeholders should have the opportunity to influence the gTLD and the way it is governed. Accordingly, the Applicant is establishing a Governance Council (“GC”), consisting of key stakeholders that will serve as an advisory body.

Why Applicant?
The Applicant has substantial combined experience amongst its team in managing global businesses from a financial, legal and operational perspective and an exceptionally strong financial position. The Applicant’s Team has previous experience with the entire gTLD life-cycle significantly lowering any launch and ongoing operational risks associated with this application. The Applicant has engaged a world-class Registry services provider to manage the technical infrastructure of the .win gTLD. The Applicant is further advised by the leading sector experts in all other areas required to ensure a responsible and successful launch and ongoing management of the gTLD to the benefit of all stakeholders in the ICANN community.

Information for future studies and reviews
The Applicant recognizes the connection of the new gTLD application to the Affirmation of Commitments (“AoC”). To gauge the success of the new gTLD program, the Applicant recognizes that an AoC Review Team will be formed one year after the first delegation. To prepare for this, the ICANN Board resolved the creation of a Working Group to formulate definitions of competition, consumer trust and consumer choice and possible metrics for the future AoC team to consider in its gTLD review. The Applicant understands this effort has not been adopted by the ICANN Board, but many of the proposed metrics may be used to gauge the Applicant’s gTLD effectiveness and the gTLD program. The Applicant intends to track costs and benefit metrics to inform future studies and reviews. Proposed definitions are:
- Consumer Trust is defined as the confidence registrants and users have in the consistency of name resolution and the degree of confidence among registrants and users that a TLD Registry operator is fulfilling its proposed purpose and is complying with ICANN policies and applicable national laws.
- Consumer Choice is defined as the range of options available to registrants and users for domain scripts and languages, and for TLDs that offer choices as to the proposed purpose and integrity of their domain name registrants.
- Competition is defined as the quantity, diversity, and the potential for market rivalry of TLDs, TLD Registry operators, and Registrars.

Promoting Competition
Given the proposed definition for competition, the Applicant will attain this by contributing to the quantity and diversity within the Registry Operator space. The Applicant is a new entrant enhancing competition among the providers. The Applicant will promote competition for Registrants by amongst other things:
- Building a healthy growth trend of domain registrations
- Measure migration of content from other TLDs
- Maintain competitive pricing of domains

Promoting consumer trust
.win will be developed with consumer trust and satisfaction in mind. After 2 years of operations, the Applicant will conduct a survey to measure consumer trust and consumer satisfaction. This will be used to improve the service. The Applicant will among other things measure the following:
- Service Availability of Critical Registry Systems
- Abuse and Takedown incidents
- Rights protection incidents
- WHOIS data accuracy

Promoting consumer choice
The Applicant intends to promote consumer choice by achieving the following:
- Display of registration requirements and restrictions in the gTLD
- Highly available and geographically diverse Registrar channel
- Effective sunrise and trademark services

Domain names will be available globally, although the Applicant’s initial marketing efforts will be predominately directed to potential Registrants represented by the six (6) official languages of the United Nations (“UN Languages”), Arabic, Chinese (Mandarin), English, French, Russian and Spanish.
After the initial 2 years it is the Applicant’s aim that:
- Registrants globally should have access to Registrar services for the gTLD in at least the six UN Languages
- The gTLD is offered by Registrars covering at least 40 Countries and territories globally

Information on the effectiveness of safeguards 
The Applicant takes rights protection and abuse prevention and mitigation very seriously and has developed policies accordingly. Amongst others, the Applicant will collect and evaluate data regarding: 
- Effectiveness of the Sunrise process in limiting abusive registration practices
- Effectiveness of the additional Abuse Prevention and Mitigation (ʺAPMʺ)and Rights Protection Mechanisms (ʺRPMʺ)in limiting abusive registration practices
- Effectiveness of the mandatory APMs and RPMs
-end-

Q18b
How do you expect that your proposed gTLD will benefit Registrants, Internet users, and others?

The Applicantʹs primary intention is to provide a favorable ecosystem for the growth and evolution of the sector. The key to achieving this aim are significant provisions for brand integrity and protection of intellectual property. The Applicant intends to push the boundaries of what can be done through innovative design of the new top level domain, including technologies that capitalize on the sectorʹs needs. A close relationship with the sectorʹs stakeholders is essential to this purpose, and will enable .win to grow in response to both Registrant and user needs. The gTLD also contains significant opportunities as a next generation organizational scheme for online content, including provisions for abuse prevention to defend users against malicious registrations. The gTLD has been meticulously designed by a team of industry leaders from an array of different fields. This has enabled the creation of an airtight financial strategy, an inspired technological development plan as well as a close and dynamic relationship with the sector community - all critical needs on the path to the enduring success of the gTLD. 

18(b)(i) What is the goal of your proposed gTLD in terms of areas of specialty, service levels, or reputation?

Specialty

The Applicant’s key specialty goal is to enable a secure and stable gTLD dedicated to providing global Internet users with a targeted space for subject matter of interest. This gTLD will serve as a home for both Registrants and end-users who feel an affinity with this sector and its associated content. Consequently they will prefer to register domain names, create and post content and seek information in a highly targeted manner.

Allowing users the ability to create a targeted, unique space within the new gTLD will enable them to customize their online offering and presence. The .win gTLD will by itself clearly signal the nature and purpose of such websites to Internet users.

The applicant intends to actively promote gTLD specific vertical searching in the gTLD for the benefit of Registrants, end-users and other stakeholders. This specialization through Vertical Search will also benefit Internet users seeking authentic online information and products or services as they will no longer have to wade through content completely unrelated to their desired results.

As the gTLD is sector specific it will provide a better context for second level strings allowing for a much higher number of relevant and more conscise domains. This more targeted environment will simplify the user experience across multiple platforms specifically with smartphones and tablets where minimal input is favoured.


Service Levels

The goal of the gTLD Registry is to offer domain name registration services of the highest level, exceeding both ICANN requirements and current sector norms. To achieve these goals, the Applicant has contracted with well established, proven service providers offering the highest possible level of quality in Registry and Registrar services. The expertise of the service providers will ensure that the security and quality of the gTLD will be uncompromised.

The Applicant will further provide the highest level of service to trademark, legal rights owners and second-level domain owners. To achieve this goal the Applicant will be implementing a range of Abuse Prevention and Mitigation policies and procedures. The Applicant is also firmly committed to the protection of Intellectual Property rights and will implement all the mandatory Rights Protection Mechanisms (RPMs) contained in the Applicant Guidebook. Aswell as these The Applicant will further protect the rights of others through the implementation of additional RPMs. The RSPʹs experience will ensure that the gTLD provides this high level of service to trademark and other legal rights owners to combat abusive and malicious activity within the gTLD.

The Registry will respond to abuse or malicious conduct complaints on a 24⁄7⁄365 basis, respond to requests from governmental and quasi-governmental agencies and law enforcement in a timely manner, and promptly abide by decisions and judgments of UDRP and URS panels, in accordance with ICANN consensus policies.

The Applicant will also provide fast and responsive (24⁄7⁄365) customer support to both Registrars and end-users in a number of languages to assist with general enquiries as well as complaints of abusive or malicious conduct.


Service Levels related to Registry Backend Services

The Applicant will work with Neustar Inc. (hereinafter “RSP”) whose extensive experience spans more than a decade. This will ensure delivery of the protected, trusted, and permanently-running Registry infrastructure necessary to reliably host and operate a gTLD. The Applicant will also work with its Registrars to ensure that consumers receive secure, fast, and reliable domain name registration services with a high-level of customer service.

The global DNS network that will be utilised for the resolution of domains in this gTLD has already been operating for over 10 years. It currently delivers DNS resolution for several TLD customers and provides low latency query responses with a 100% DNS uptime service level agreement. 

The Applicant will further leverage the RSP’s existing DNSSEC infrastructure, capabilities, and experience to provide a robust and standards compliant implementation that ensures DNSSEC services are always available as part of the DNS.

The Shared Registry System (“SRS”) to be used for the Applicantʹs gTLD is a production-proven, standards-based, highly reliable and high-performance domain name registration and management system that has been designed to operate at the highest performance levels. The Applicantʹs RSP has been able to meet or exceed their SLA requirements nearly every month since itʹs inception. Their Registry has achieved a 99.997% success rate in meeting SLAs since 2004.

The Applicantʹs RSP has extensive experience providing ICANN and RFC-compliant WHOIS services for each of the gTLDs that it operates as a Registry Operator for both gTLDs and ccTLDs. The RSPʹs thick WHOIS solution is production proven, highly flexible, and scalable with a track record of 100% availability over the past 10 years.

The Applicant will comply with all the data escrow requirements documented in the Registry Data Escrow (“RyDE”) Specification of the Registry Agreement and has a contract in place with Iron Mountain Intellectual Property Management, Inc. (“IM”) for RyDE Services. The Applicant and its RSP will in conjunction with Iron Mountain work to ensure that the escrow deposit process is compliant 100% of the time.


Reputation

The Applicant will ensure that the Registry enjoys an excellent reputation through its core focus on creating a secure, sustainable, and specialized gTLD, thus supporting ICANN’s primary goals for the new gTLD program in promoting consumer trust, consumer choice, competition and innovation.

The Applicant will strive to become a reputable and successful new gTLD by providing secure, fast and reliable customer service throughout the registration life cycle of all domains in the gTLD. 

The Applicant will endeavour to ensure that only non-fraudulent Registrants have domain names in the gTLD via a WHOIS that is searchable, thick and reliable and by being highly responsive to complaints from legal rights owners. The Applicant will further implement an industry leading range of Abuse Prevention and Mitigation policies and procedures as well as RPMs.

The Applicant will provide the financial and operational stability to protect Registrants and ensure the reputation of the Registry. The Applicant has estimated the maximum costs of the critical functions for a three year period by taking the largest single year cost estimate (year 5) and multiplying this by 3. If the calculation used a lower figure the costs estimate would not be at the potential highest amount during the 5 years and the COI instrument would be too small in order to fund the costs of the 5 critical functions for at least 3 years.

The Applicant has decided to commit to providing the highest level of protection to Registrants and Stakeholders by providing ICANN with a COI for the maximum amount as recommended by ICANN in its COI Guidance. This ensures the Registry is reputable, remains conservative and mirrors ICANN’s core objectives. In a worst case scenario where the Applicant will not receive any revenue Registrants will be protected not only by the COI, but also by the fact that the Applicant has enough capital to operate for over 3 years.

Question 18(b)(ii) What do you anticipate your proposed gTLD will add to the current space, in terms of competition, differentiation, or innovation?

It is expected that .win will provide significant competition for existing and forthcoming gTLDs. The .win gTLD will provide a blank canvas of second level domains that will inevitably lead to increased consumer choice and significant innovation from the sector. It will allow Registrants to seek new and varied ways to separate themselves from the competition.

Competition

The Applicant will enhance competition by allowing new Registrants to create new online products and services serving the global marketplace and connecting geographically diverse Registrants and users with a common affinity for the specialized subject matter exemplified by the new gTLD. The new gTLD process and its resulting gTLDs are likely to incentivize top-level domains to improve the security and quality of their online products and services as well as introducing new ones. Thus, this gTLD will benefit consumers by increasing the likelihood of new innovative online products and services.The addition of a new gTLD such as .win will also increase competition between existing registries.

The Applicant will promote competition to the benefit of the Registrants by amongst other things:

- Building a healthy growth trend of domain registrations to validate the specialty space
- Promote the migration of sector relevant content from other TLDs
- Maintaining competitive pricing of domains

Differentiation

Currently, there is no gTLD available on the Internet that signifies the specialized products, services, and subject matter encompassed by this gTLD. The gTLD string itself will give a clear indication to website visitors that the site has content relevant to the sector. This will result in the gTLD becoming globally recognizable and viewed as a trusted source of goods, services and information.

Innovation

The gTLD will demonstrate innovation through cutting edge RPMs.

Firstly the Applicant considers the Protection of Intergovernmental Organization (ʺIGOʺ) names to be very important. The Applicant will use strings registered as second level domains in the .int gTLD as the basis for this protection. To register in the .int domain, the Registrants must be an IGO that meets the requirements found in RFC 1591. The Applicant will reserve these strings and only allow for their future release if an IGO on the “reserve list” wishes to make use of the protected string in the gTLD and provides the Applicant with sufficient documentation.

Secondly, the Applicant will require that Registrants agree to the Registry’s “Abuse and Rights Protection” Terms and Conditions as part of the registration process for the second-level domain, which includes displaying the APM Seal on the homepage. The APM Seal will provide users and legal rights holders with a direct link to an Abuse Prevention and Mitigation Report Website which will provide instructions on how to report abusive conduct to the Registry and law enforcement.

Finally if a Registrant during sunrise and landrush applies to register a domain name identical to a capital city name of a country or territory listed in the ISO 3166-1 standard it will receive a Capital City Claims (“CCC”) notification stating this. Subsequently they will have to reply unconditionally agreeing to comply with requirements to protect the reputation of the capital city and any further terms.

These functions will enhance Internet stability, security and will demonstrate to Registrars, Registrants, and end-users of the Registry that abusive or malicious conduct will not be tolerated. They will further contribute significantly to the integrity of the gTLD enabling an environment where stakeholders can innovate with confidence.

Question 18(b)(iii) What goals does your proposed gTLD have in terms of user experience?

The Applicant’s goals for the new gTLD are to provide a trusted, secure, and user friendly environment whereby domain names and content relating to its specific affinity group can flourish. 

The Applicant believes that the success of the gTLD will be determined by the sector’s key stakeholders globally. The Applicant believes that stakeholders should have the opportunity to influence the gTLD and the way it is governed. Accordingly, the Applicant is establishing a Governance Council (“GC”), to serve as an advisory body.

.win will be developed with consumer trust, choice and satisfaction in mind and after the initial 2 years, the Applicant will conduct a survey to analyse the gTLDʹs success in these areas to help further improve the user experience.

To ensure a high level of service the Applicant will further measure:

- Service Availability Targets for the Critical Registry Functions
- The number of abuse incidents and takedowns
- ICANN Compliance
- Rights protection incidents (i.e. UDRP and URS)
- WHOIS data accuracy

The Applicant intends to promote consumer choice by providing the following:

- Highly available and geographically diverse Registrar distribution channel;
- Effective sunrise and trademark services.

Question 18(b)(iv) Provide a complete description of the applicantʹs intended registration policies in support of the goals listed above.

Registration Policies

The purpose and goal of the Applicant’s policies are to ensure competition, fairness, trust and reliability for Registrars, Registrants, the user community, and other stake holders, while maintaining security and stability for the gTLD.

General Policy

Aside from certain start-up mechanisms, all domain names will generally be registered on a first-come, first-served basis. A Trademark Claims service will be offered for the first 90 days of general registration, with the intent of providing clear notice to potential Registrants of the existing rights of trademark owners with registered trademarks in the Trademark Clearinghouse.

Registration Policies

As per ICANN’s requirements, the Applicant will be operating both a Sunrise and Landrush period ahead of general availability for the gTLD.

Governance Council

The Applicant is establishing a the GC, to be comprised of key sector stakeholders that will serve as an advisory body. Each GC will elect its own Board of Directors, which will be responsible for self-governance, the recommendation of sector-specific registration policies,the formulation of guidance on intellectual property and other best practices related to the gTLD.


The Applicant aims to develop an Abuse Prevention and Mitigation Working Group in conjunction with the GC. It will give the Applicant’s team advice on abuse preventions and mitigation and how this may effect registration policies. The group will meet to regularly discuss the latest trends in domain name abuse and the most effective way to prevent and remedy them.

Question 18(b)(v) Will your proposed gTLD impose any measures for protecting the privacy or confidential information of Registrants or users? If so, please describe any such measures.

Data and Privacy Policies

The Applicant shall comply with all the Data, WHOIS, and Privacy requirements in the Applicant Guidebook required by ICANN. The Applicant will take all possible steps to maintain the security and privacy of information or data that it may collect in connection with the planned function and usage of names domains, and will remain in compliance with all confidentiality and security regulations in relevant jurisdictions. This data will be held by the Applicant in accordance with the Registry Agreement that the Applicant will execute with ICANN. 

The Applicant has further ensured that its suppliers also understand that keeping information secure and private is of crucial importance and will take all available steps to maintain the security and privacy of information collected from the Applicants in the Sunrise, Landrush and General Availability Phases. 

Question 18(b) Describe whether and in what ways outreach and communications will help to achieve your projected benefits.

The Applicant plans on making the gTLD the premier gTLD where individuals and organizations can register, build and maintain websites relating to their specific interest area. Thus, communication with the public and development of an outreach campaign are important goals in connection with the gTLD.

During the gTLD evaluation process, the Applicant plans to conduct a two-to-three month communications campaign aimed at reaching sector stakeholders and informing them of the gTLD’s mission and the opportunity to participate in the GC. The communication outreach will include email communications to hundreds of leading sector organizations. It will also be accompanied by the launch of a website for communicating information about the gTLD and allowing interested members of the related sector to express interest in serving on the GC. Other communications efforts, including but not limited to, press releases and social media campaigns may all be initiated to raise further awareness regarding the gTLD. 

Shortly after completing the evaluation process and being awarded the gTLD, the Applicant will institute marketing and outreach efforts to inform the public about the new gTLD, its launch schedule, and its intended affinity group. The Applicant will use different outreach and communications methods and venues to get the new gTLD mission and message out to the public, including but not limited to the following: online and print press releases, communications with various media outlets, domain name sector groups, mobile apps and various social media platforms. The GC will be used as a further means of outreach and communication to the Internet community.
-end-

Q18C
What operating rules will you adopt to eliminate or minimize social costs (e.g., time or financial resource costs, as well as various types of consumer vulnerabilities)? What other steps will you take to minimize negative consequences⁄costs imposed upon consumers?

The Applicant fully appreciates the concerns of ICANN, the GAC and other consumer protection authorities about the need to operate new gTLDs in ways that minimize social costs, consumer vulnerabilities as well as other time and financial resource costs. To achieve these goals this gTLD will not only employ the ICANN mandated minimum protections, but will also deploy the following innovative protection measures that will put the gTLD at the forefront of addressing these critical issues:

1) Abuse Prevention and Mitigation Policies and Procedures 

The Applicant’s core mission and purpose is to create an environment where individuals and companies can interact and express themselves in ways never before seen on the Internet, in a more targeted, secure and stable environment. To achieve this goal the Applicant will be implementing a range of Abuse Prevention and Mitigation (ʺAPMʺ) policies and procedures. 

These Policies and Procedures will include: 1) gTLD APM Plan, 2) Policies and Procedures to Minimize Abusive Registrations ,3) Abuse Point of Contact, 4) Policies for Handling Complaints Regarding the Abuse Policies, 5) Acceptable Use Policy (“AUP”), 6) Proposed Measures for Removal of Orphan Glue Records, 7) Resourcing plans for the initial implementation of, and ongoing maintenance of, the APM initiatives, 8) Registry semi-annual WHOIS verification, 9) Regular monitoring of WHOIS registration data for accuracy and completeness, 10) Registrar WHOIS self-certification, 11) WHOIS data reminder process, 12) Establishing policies and procedures to ensure Registrar compliance, which may include audits, financial incentives, penalties, or other means, 13) Registrar verification of WHOIS, 14) Abuse Response Process, 15) Policies and procedures that define malicious or abusive behaviour, 16) Service Level Requirements for resolution regarding APM issues, 17) Service Level Requirements for Law enforcement requests regarding APM issues, 18) Coordination of APM efforts with sector Groups and Law Enforcement, 19) Rapid takedown and suspension, 20) Controls to Ensure Proper Access to Domain Functions, 21) Enabling two-factor authentication from Registrants to process update, transfers, and deletion requests, 22) Enabling multiple, unique points of contact to request and⁄or approve update, transfer, and deletion requests, 23) Enabling the notification of multiple, unique points of contact when a domain has been updated, transferred, or deleted, 24) Additional Mechanism for Protection of Capital City Names, 25) Additional Mechanisms to Protect and Reserve IGO Names, 26) Governance Council Structure, 27) Efforts to increase Registrant Security Awareness, 28) Registrant Disqualification, 29) Restrictions on Proxy Registration Services, 30) Registry Lock, 31) APM Seal. (Q28 for detail)

2) Rights Protection Mechanisms 

The Applicant is firmly committed to the protection of Intellectual Property rights and to implementing all the mandatory Rights Protection Mechanisms (“RPMs”) contained in the Applicant Guidebook and detailed in Specification 7 of the Registry Agreement. Use of domain names that infringe upon the legal rights of others in the gTLD will not be tolerated and preventing abusive registrations is a core objective of the Applicant. The nature of such uses creates security and stability issues for the Registry, Registrars, and Registrants, as well as for users of the Internet in general. The Applicant will minimize time or financial resources costs by preventing abusive registrations and reduce opportunities for behaviours such as phishing or pharming. This will be achieved by implementing comprehensive registration, anti-abuse, and rights protection guidelines as defined in its AUP, as well as innovative additional RPMs such as the Mechanism to Protect IGO Names by blocking second level labels currently present in the .int zone file and the Mechanism for Further Protection of Capital City Names, as described below. In order to identify and address the abusive use of registered names on an ongoing basis, the Applicant will also incorporate and abide by the following RPMs and all other RPMs as specified in Specification 7 of the Registry Agreement and as adopted by the ICANN Board of Directors as ICANN Consensus Policies.

These Rights Protection Mechanisms will among other things include: 1) Trademark Clearinghouse, 2) Applicant’s Sunrise Period, 3) Trademark Claims Service , 4) Uniform Domain Name Dispute Resolution Policy, 5) Uniform Rapid Suspension System, 6) Trademark Post-Delegation Dispute Resolution Procedure, 7) Mechanism to protect IGO Names, 8) Mechanism for Further Protection of Capital City Names, 9) Efforts to promote WHOIS Accuracy, 10) Thick Searchable WHOIS, 11) Semi Annual Audits to Ensure Accurate WHOIS, 12) Policies Handling Complaints Regarding Abuse and Rights Issues, 13) Registry Acceptable Use Policy (“AUP”), 14) Monitoring for Malicious Activity. (Q29 for detail)

3) Governance Council Structure

The Applicant believes that sector stakeholders should be afforded the opportunity to influence the manner in which the gTLD is governed. Accordingly, the Applicant will establish a Governance Council (the “GC”) comprised of key sector stakeholders that will serve as an advisory body tasked with defining best practice recommendations for the gTLD space. The Applicant believes that the success of the gTLD will be determined largely by the sector’s key stakeholders. Not only will these stakeholders have the primary interest in registering domains in the gTLD, but they will also be motivated to protect the sector from practices that would negatively impact the sector overall. The GC exists to provide guidance on matters related to best practices, intellectual property, authentication, certification, and other matters of importance to the sector and it will elect its own Board of Directors, which will be responsible for self-governance, the recommendation of sector-specific policies, and other best practices related to the gTLD.


4) BITS and Coalition for Online Accountability (“COA”) Recommendations

The Applicant will further structure its policies around the BITS and COA Recommendations where relevant to this gTLD. The Applicant’s goal is to provide a safe and secure experience for consumers. A domain within this gTLD that is owned, operated by or compromised by a malicious party could cause harm to consumers, to the gTLDʹs reputation and to the reputation of the Internet itself. As such, additional controls are in place relating to the validity of registrations, as well as measures to ensure the correct identity of both Registrants and Registrars relating to changes made within the SRS, and to protecting the integrity of the DNS service as a whole.

The Security Standards Working Group (SSWG) formed by BITS drafted a set of policy recommendations that should be applied to financial TLDs. The policy comprises of a set of 31 recommendations that should be adopted by ICANN in evaluating any applicant of a financial gTLD. The recommendations were posted by BITS in the form of a letter to ICANN at [http:⁄⁄www.icann.org⁄en⁄correspondence⁄aba-bits-to-beckstrom-crocker-20dec11-en.pdf].

The Coalition for Online Accountability have drafted a set of policy recommendations, also endorsed by many other international organizations representing the creative industries, that should be applied to entertainment gTLDs - especially those dependent on copyright protection. The policy comprises of a set of 7 recommendations that should be adopted by ICANN in evaluating any applicant for an entertainment-based gTLD. The recommendations were posted by COA in the form of a letter to ICANN at http:⁄⁄bit.ly⁄HuHtmq.

We welcome the recommendations from BITS and the COA and will strongly consider the recommendations relating to the implementation of this gTLD where considered relevant.

5) Registry Operators Startup Plan

The Applicant proposes to implement the following start-up plan so that the new gTLD is introduced in an orderly, transparent and stable manner. This will safeguard competition, fairness, trust and reliability for Registrants, the User Community, ICANN Accredited Registrars, and other Stakeholders. 
The Applicant’s startup plan is designed to minimize social costs (e.g., time or financial resources costs, as well as various types of consumer vulnerabilities) by instilling a number of RPMs as well as APMs.
The plan consists of the following multi-phase process that will be executed by the Registry Operator. The timeline for the gTLDs start-up process and associated RPMs in the Applicants gTLD is as follows:

Phase 1 – Sunrise Process:

- Day 1: Sunrise round opens
- Day 60: Sunrise round Closes
- Day 61: Sunrise Allocation Including contention resolution mechanisms opens
- Day 71: Sunrise Allocation contention resolution mechanisms closes

• The following Rights Protection Mechanisms apply: 
 a. Trademark Clearinghouse (“TMCH”)
 b. Sunrise Eligibility Requirements (“SER”)
 c. Sunrise Dispute Resolution Policy (“SDRP”)
 d. Uniform Domain Name Dispute Resolution Policy (“UDRP”)
 e. Uniform Rapid Suspension System (ʺURSʺ)
 f. Mechanism for the Protection of IGO Names (“PIN”)
 g. Trademark Claims Service (“TCS”) *

Phase 2 – Landrush process:

- Day 72: Landrush opens
- Day 102: Landrush closes
- Day 103: Landrush contention resolution mechanisms opens
- Day 113: Landrush contention resolution mechanisms closes

- The following Rights Protection Mechanisms apply:

 a. UDRP
 b. URS
 c. PIN
 d. Mechanism for Further Protection of Capital City Names (“CCC”)
 e. TCS *

Phase 3 – General Availability⁄Registrations:

- Day 114: General availability begins

- The following Rights Protection Mechanisms apply:

 a. UDRP
 b. URS
 c. PIN
 d. Trademark Post-Delegation Dispute Resolution Procedure (“PDDRP”)
 e. TCS for the 90 days after day 114 *

* To ease the concerns of trademark owners and mitigate the impact of infringing registrations, the Applicant will be implementing the TCS in all three phases of launch. It is important to note that during the General Availability Phase, the TCS will be used for 90 days, 30 days longer than the ICANN mandated minimum.

18(C)(i) How will multiple applications for a particular domain name be resolved, for example, by auction or on a first-come⁄first-serve basis? 

Sunrise and Landrush periods:

During the gTLDs launch period, multiple applications for a particular domain name will be resolved through a Contention Resolution Mechanism (“CRM”) involving auctions. These CRMs will apply to the Sunrise and Landrush application phases. The CRMs will be conducted by Sedo GMBH, an experienced provider of domain auction services. The mechanisms offered will involve closed auctions where only specific bidders can participate.

During the Applicants Sunrise process, if there are two or more eligible applicants for one domain name string, then the contention will be resolved by auction. Auctions held during the Sunrise phase (“Sunrise Auctions”) will be closed and the only bidders will be eligible applicants according to the gTLDs Sunrise eligibility requirements including the TMCH.

During the Applicants Landrush process, if there are two or more eligible applicants for one domain name string, then the contention will be resolved by auction. Auctions held during the Landrush phase (“Landrush Auctions”) will be closed and the only bidders will be eligible applicants according to the gTLDs Landrush eligibility requirements.

General Availability:

After the two initial startup phases of the Registry the allocation of domain names will occur on a first-come first-serve basis, taking into account the registries APM and RPM mechanisms.

18(c)(ii) Explain any cost benefits for registrants you intend to implement (e.g., advantageous pricing, introductory discounts, bulk registration discounts).

Incentive, Marketing and Outreach Programs

The Applicant will implement a number of incentive, marketing assistance, awareness and PR programs to assist the Registrar channel in providing a sector leading experience to end-users and to provide cost benefits for registrants. The Applicant will work with the global Registrar channel to ensure that the new gTLD offer is clearly visible on registrar sites resulting in an increase in the awareness and in the number of new gTLD registrations. Achieving this visibility requires (1) a clear business case and incentives for registrars to motivate them and (2) mechanisms and assets to make it easy for them to do so.

The Applicant will at the time of launch depending upon market conditions consider incentive programs that will deliver cost benefits to registrants through either the use of advantageous pricing, introductory discounts, bulk registration discounts or other similar methods. The Applicant is aware of Specification 9 – Registry Operator Code of Conduct, and will not directly or indirectly show any preference or provide any special consideration to any Registrar in its marketing efforts.

Example incentive mechanisms the Applicant will provide to the registrars may include:

Marketing Incentives

The Applicant intends to provide expertise, tools and creative assets to the registrars as part of general marketing and co-marketing programs. There is a significant cost saving if the expertise, tools and assets are developed centrally and the costs amortized across the registrar base. Significant cost savings can occur relating to Market Research, Social Customer Relationship Management (“SCRM”), Content Management Systems (“CMS”), Direct Marketing Tools, Marketing Collateral and Analytics Solutions. 

The Applicant will employ some or all of the following marketing techniques jointly with registrars globally: (1) Direct Response Print, (2) General Web Marketing, (3) Email campaigns without Incentive, (4) Email with Incentive, (5) Email Marketing - Prospect List, (6) Email Marketing - Sponsored Newsletter, (7) Direct Marketing with Incentive, (8) Web Marketing with Incentive, (9) Viral Marketing (Social, Video, Micro-sites), (10) Develop User Interface Improvement best practices, (11) Develop Search Engine Optimization best practices, (12) Email Marketing - Registrar List
As an example of a marketing initiative, the Applicant will forward leads to the Registrars “buy” pages as an incentive via the means of Pay-Per-Click (“PPC”) search marketing. The Applicant will run multiple PPC campaigns targeting gTLD Registrants and point these to landing pages on the Registrar’s websites. Conversions are directly trackable from all PPC campaigns and keywords with a high Click-Through-Rate (“CTR”) or conversions will also be leveraged for SEO best practice purposes. 

PR and Awareness Incentives:

In addition to the core outreach to the Registrar Channel, the Applicant will engage in a wider outreach to build awareness of the new gTLD with customers, end-users and other stakeholders. The Applicant will engage with a number of high profile individuals associated with the gTLD and will seek to reach end consumers through webcasts, podcasts, traditional broadcast TV as well as radio.

Provision of customer retention toolkits to Registrars:

The Applicant will use propensity modelling to build retention marketing programs to minimize churn whilst building renewal sustainability. The Applicant will develop econometric models designed to measure the likelihood of a customer segment to purchase a product or offer bundle, at a certain point in the relationship lifecycle. They are used to predict the best time, and the best combination of products, to offer to customers who match a certain profile. They are especially effective where there are large numbers of customers and reliable data can be gathered. The Applicant expects that registration volume in the gTLD will provide sufficient data for this modelling.

Measure, benchmark and improve the customer experience:

The Applicant will engage in a program to develop best practice policies related to the customer experience at differing levels of the channel. This will include the entire ecosystem from Registry through Registrar to Resellers and finally end-users. One key metric might be, for example, to reduce the number of clicks to make a purchase equivalent to the most customer friendly e-commerce sites in the world. 
The Applicant might, for example, provide website performance tracking tools to registrars, which would benchmark current performance and provide insights into customers’ needs and behaviour at the point of purchase.
The Applicant will engage in a Social Customer Relationship Management Program to monitor social media feedback to questions, concerns or other issues. The Applicant will further seek to measure marketing communication expenditure and activity.

Other initiatives that will be considered by the Applicant in its outreach efforts: 

(a) Customized Vertical Search App for major mobile platforms.
(b) Designated Twitter channel for the stakeholder community.
(c) Social Media outreach through Facebook and other social media solutions.

Translation into other languages:

At present, the Applicant plans to translate marketing collateral and other content that it considers to have geographically diverse appeal in to the 6 official UN languages, namely Arabic, Chinese (Mandarin), English, French, Russian and Spanish.

18(c)(iii) Note that the Registry Agreement requires that registrars be offered the option to obtain initial domain name registrations for periods of one to ten years at the discretion of the registrar, but no greater than ten years. Additionally, the Registry Agreement requires advance written notice of price increases. Do you intend to make contractual commitments to registrants regarding the magnitude of price escalation? If so, please describe your plans.

The Applicant will follow the lifecycle and business rules found in the majority of gTLDs today. Our back-end operator has in excess of ten years of experience managing numerous gTLDs that utilize standard and unique business rules and lifecycles.

Initial registrations of registered names may be made in the registry in one (1) year increments for up to a maximum of ten (10) years. For the avoidance of doubt, the registration term for registered names may not exceed ten (10) years. Further the renewal of registered names may be made in one (1) year increments for up to a maximum of ten (10) years. For the avoidance of doubt, renewal of registered names may not extend their registration period beyond ten (10) years from the time of the renewal.

The Applicant plans to review domain name registration rates on an annual basis and will make a determination at that time regarding adjustments, depending upon market factors. Thus, at this time, the Applicant does not plan to make specific guarantees regarding pricing increases.

The Applicant will provide ICANN and each ICANN accredited registrar that has executed the registry-registrar agreement for the gTLD advance written notice of any price increase (including as a result of the elimination of any refunds, rebates, discounts, product tying or other programs which had the effect of reducing the price charged to registrars, unless such refunds, rebates, discounts, product tying or other programs are of a limited duration that is clearly and conspicuously disclosed to the registrar when offered) that complies with the requirements as outlined in the New gTLD Registry Agreement.
-end-

No

Not Available

No

Q22
Introduction

The Applicant is aware of the substantial amount of work and effort that has gone into developing policy to address the issue of the reservation and release of geographic names under new gTLDs, including the valuable input from ICANNʹs Governmental Advisory Committee (ʺGACʺ), the Generic Names Supporting Organisation Reserved Names Working Group, Registry Operators and from elsewhere within the ICANN community.

The Applicant is aware of and understands the requirements set forth in the 11 January 2012 version of the New gTLD Applicant Guidebook (New gTLD Applicant Guidebook) and the GAC advice for protection of geographic names and will implement appropriate measures to ensure that it complies in all respects with ICANN policies and rules regarding both the reservation and release of geographic names at the second level (or other levels).

In addition to this, the Applicant proposes to implement an additional mechanism for the protection of capital city names at the second level that exceeds the requirements in the New gTLD Applicant Guidebook. See description of Capital City Claim service described below.

Reservation of Geographic Names

The initial GAC advice on the protection of geographic names is contained in the GAC document “Principles Regarding New gTLDs” which was presented by the GAC on 28 March 2007. Section 2.7(a) of this document states that new gTLD applicants should “adopt, before the new gTLD is introduced, appropriate procedures for blocking, at no cost and upon demand of governments, public authorities or IGOs, names with national or geographic significance at the second level of any new gTLD”.

Specification 5 of the New gTLD Registry Agreement provides further clarity and details the Schedule of Reserved Names at the Second Level (or other levels) in gTLD Registries, whereby the Registry Operator undertakes to reserve certain domain names and prevent them from being registered, delegated or used.

Section 2 of Specification 5 of the New gTLD Registry Agreement requires that all two character labels are initially reserved. This is to avoid conflicts and confusion with existing ccTLD extensions.

Section 5 of Specification 5 of the New gTLD Registry Agreement is more comprehensive and states that:

“5. Country and territory names contained in the following internationally recognized lists shall be initially reserved at the second level and at all other levels within the TLD at which the Registry Operator provides for registrations:

5.1. the short form (in English) of all country and territory names contained on the ISO 3166-1 list, as updated from time to time, including the European Union, which is exceptionally reserved on the ISO 3166-1 list, and its scope extended in August 1999 to any application needing to represent the name European Union 〈http:⁄⁄www.iso.org⁄iso⁄support⁄country_codes⁄iso_3166_code_lists⁄iso-3166-1_decoding_table.htm#EU〉;

5.2. the United Nations Group of Experts on Geographical Names, Technical Reference Manual for the Standardization of Geographical Names, Part III Names of Countries of the World; and

5.3. the list of United Nations member states in 6 official United Nations languages prepared by the Working Group on Country Names of the United Nations Conference on the Standardization of Geographical Names”.

In order to meet these requirements regarding country and territory names, the applicant will maintain and regularly update copies of the aforementioned internationally recognized lists. All labels appearing on those lists, and on any list promulgated or recognized by ICANN for reservation in the future, assuming the corresponding string is unregistered, The Applicant will afford the same protections to new states or cities as they are formed.

The Applicant will reserve all labels appearing on the above referenced lists from time to time, and prevent registration, delegation or use of such names in accordance with ICANN requirements and as described above. In order to ensure that this is implemented correctly, all such labels will be reserved in the name of the applicant in order to prevent their delegation and use.

Release of Reserved Geographic Names

Specification 5 of the New gTLD Registry Agreement also contains provisions for the release of country and territory names on the basis that agreement is reached with “the applicable government(s), provided, further, that Registry Operator may also propose release of these reservations, subject to review by ICANN’s Governmental Advisory Committee and approval by ICANN”.

As such the applicantʹs proposed policy for the release of such reserved terms is cognisant of the review and approval process from the GAC and ICANN.

Based upon a review of the available literature, documentation and guidance, the applicant proposes the following policy to ICANN and the GAC for the potential release of reserved terms under the TLD:

i) Further to the successful evaluation and delegation of the TLD all of the aforementioned labels, as specified under Section 5 of Specification 5 of the New gTLD Registry Agreement will be reserved and thus unavailable for registration during each stage of the launch process including, but not limited to the Sunrise period, the Landrush period through to General registrations.

ii) At any stage during the launch process through to General registrations and beyond, the aforementioned reserved names may only be assigned to the relevant Government or public authority. In such situation they would be assigned using the following process:

a) The corresponding Government or public authority submits a request to the GAC seeking the assignment of the reserved name to themselves and provides the details of the proposed registrant entity for the domain name registration.

b) The GAC will validate it and authenticate the request to establish that is a genuine bona fide request.

c) Once this has been established by the GAC, the request for delegation will be forwarded to the applicant to request the assignment of the domain name. Simultaneously the GAC will also notify ICANN of the GAC approval of the request for the assignment of the domain name.

d) The applicant will issue a unique authorisation code to the proposed registrant entity.

e) The proposed registrant entity will then be able to request the assignment of the domain name to themselves using the authorisation code with an ICANN accredited registrar for the applicant TLD.

In addition to the above, the applicant will also adhere to and implement ICANN policy with regards to the reservation and release of such terms as and when required.

Additional Mechanism for Further Protection of Capital City Names
In parallel with the Landrush Period defined in the answer to question 18, the applicant will implement a Capital City Claim (“CCC”) service whereby additional protection will be granted to the capital city names of a country or territory listed in the ISO 3166-1 standard. The CCC process is described below:

a) Any prospective domain name registrant applying to register a domain name identical to the capital city name of a country or territory listed in the ISO 3166-1 standard will automatically receive from the Applicant a CCC notification highlighting the fact that the applied-for domain name corresponds to a capital city name of a country or territory listed in the ISO 3166-1 standard.

b) A potential domain name registrant receiving a CCC notification will have to send a response to the Applicant whereby it will unconditionally comply with the requirements as to representations and warranties required by the Applicant.

c) Unconditional acceptance of the representations and warranties set out in the CCC notification will be a material requirement for a prospective registrant to be eligible to register the domain name in question should said prospective registrant be successful in the Landrush period.

d) Upon registration during the Landrush period of a domain name identical to a capital city name of a country or territory listed in the ISO 3166-1 standard, the Applicant will send a notification listing the names in writing to the GAC Chair.
(see Q28 for more detail)
-end-

Q23
23.1 Introduction 

The Applicant has elected to partner with Neustar, Inc to provide back-end services for the TLD registry. In making this decision, the Applicant recognized that Neustar already possesses a production-proven registry system that can be quickly deployed and smoothly operated over its robust, flexible, and scalable world-class infrastructure. The existing registry services will be leveraged for the TLD registry. The following section describes the registry services to be provided.

23.2 Standard Technical and Business Components

Neustar will provide the highest level of service while delivering a secure, stable and comprehensive registry platform. The Applicant will use Neustar’s Registry Services platform to deploy the TLD registry, by providing the following Registry Services (none of these services are offered in a manner that is unique to this TLD: 
- Registry-Registrar Shared Registration Service (SRS)
- Extensible Provisioning Protocol (EPP)
- Domain Name System (DNS)
- WHOIS
- DNSSEC
- Data Escrow
- Dissemination of Zone Files using Dynamic Updates
- Access to Bulk Zone Files
- Dynamic WHOIS Updates
- IPv6 Support
- Rights Protection Mechanisms
- Internationalized Domain Names (IDN). 

The following is a description of each of the services. 

SRS 
Neustar’s secure and stable SRS is a production-proven, standards-based, highly reliable, and high-performance domain name registration and management system. The SRS includes an EPP interface for receiving data from registrars for the purpose of provisioning and managing domain names and name servers. The response to Question 24 provides specific SRS information. 

EPP
The TLD registry will use the Extensible Provisioning Protocol (EPP) for the provisioning of domain names. The EPP implementation will be fully compliant with all RFCs. Registrars are provided with access via an EPP API and an EPP based Web GUI. With more than 10 gTLD, ccTLD, and private TLDs implementations, Neustar has extensive experience building EPP-based registries. Additional discussion on the EPP approach is presented in the response to Question 25.

DNS
The Applicant will leverage Neustar’s world-class DNS network of geographically distributed nameserver sites to provide the highest level of DNS service. The service utilizes “Anycast” routing technology, and supports both IPv4 and IPv6. The DNS network is highly proven, and currently provides service to over 20 TLDs and thousands of enterprise companies. Additional information on the DNS solution is presented in the response to Questions 35.

WHOIS
Neustar’s existing standard WHOIS solution will be used for the TLD. The service provides supports for near real-time dynamic updates. The design and construction is agnostic with regard to data display policy and is flexible enough to accommodate any data model. In addition, a searchable WHOIS service that complies with all ICANN requirements will be provided. The following WHOIS options will be provided:
Standard WHOIS (Port 43)
Standard WHOIS (Web)
Searchable WHOIS (Web)
DNSSEC

An RFC compliant DNSSEC implementation will be provided using existing DNSSEC capabilities. Neustar is an experienced provider of DNSSEC services, and currently manages signed zones for three large top level domains: .biz, .us, and .co. Registrars are provided with the ability to submit and manage DS records using EPP, or through a web GUI. Additional information on DNSSEC, including the management of security extensions is found in the response to Question 43.

Data Escrow
Data escrow will be performed in compliance with all ICANN requirements in conjunction with an approved data escrow provider. The data escrow service will:
- Protect against data loss
- Follow industry best practices
- Ensure easy, accurate, and timely retrieval and restore capability in the event of a hardware failure
- Minimizes the impact of software or business failure.

Additional information on the Data Escrow service is provided in the response to Question 38.
Dissemination of Zone Files using Dynamic Updates
Dissemination of zone files will be provided through a dynamic, near real-time process. Updates will be performed within the specified performance levels. The proven technology ensures that updates pushed to all nodes within a few minutes of the changes being received by the SRS. Additional information on the DNS updates may be found in the response to Question 35.

Access to Bulk Zone Files
The Applicant will provide third party access to the bulk zone file in accordance with specification 4, Section 2 of the Registry Agreement. Credentialing and dissemination of the zone files will be facilitated through the Central Zone Data Access Provider.

Dynamic WHOIS Updates
Updates to records in the WHOIS database will be provided via dynamic, near real-time updates. Guaranteed delivery message oriented middleware is used to ensure each individual WHOIS server is refreshed with dynamic updates. This component ensures that all WHOIS servers are kept current as changes occur in the SRS, while also decoupling WHOIS from the SRS. Additional information on WHOIS updates is presented in response to Question 26.

IPv6 Support
The TLD registry will provide IPv6 support in the following registry services: SRS, WHOIS, and DNS⁄DNSSEC. In addition, the registry supports the provisioning of IPv6 AAAA records. A detailed description on IPv6 is presented in the response to Question 36.

Required Rights Protection Mechanisms
The Applicant, will provide all ICANN required Rights Mechanisms, including: 
- Trademark Claims Service
- Trademark Post-Delegation Dispute Resolution Procedure (PDDRP)
- Registration Restriction Dispute Resolution Procedure (RRDRP)
- UDRP
- URS
- Sunrise service.

More information is presented in the response to Question 29.
Internationalized Domain Names (IDN)

IDN registrations are provided in full compliance with the IDNA protocol. Neustar possesses extensive experience offering IDN registrations in numerous TLDs, and its IDN implementation uses advanced technology to accommodate the unique bundling needs of certain languages. Character mappings are easily constructed to block out characters that may be deemed as confusing to users. A detailed description of the IDN implementation is presented in response to Question 44.

23.3 Unique Services 
The Applicant will not be offering services that are unique to this TLD.

23.4 Security or Stability Concerns 
All services offered are standard registry services that have no known security or stability concerns. Neustar has demonstrated a strong track record of security and stability within the industry. 
-end-

Q24
24.1 Introduction
The Applicant has partnered with Neustar, Inc, an experienced TLD registry operator, for the operation of the TLD Registry. The Applicant is confident that the plan in place for the operation of a robust and reliable Shared Registration System (SRS) as currently provided by Neustar will satisfy the criterion established by ICANN.

Neustar built its SRS from the ground up as an EPP based platform and has been operating it reliably and at scale since 2001. The software currently provides registry services to five TLDs (.BIZ, .US, TEL, .CO and .TRAVEL) and is used to provide gateway services to the .CN and .TW registries. Neustar’s state of the art registry has a proven track record of being secure, stable, and robust. It manages more than 6 million domains, and has over 300 registrars connected today. 
The following describes a detailed plan for a robust and reliable SRS that meets all ICANN requirements including compliance with Specifications 6 and 10.

24.2 The Plan for Operation of a Robust and Reliable SRS

High-level SRS System Description

The SRS to be used for TLD will leverage a production-proven, standards-based, highly reliable and high-performance domain name registration and management system that fully meets or exceeds the requirements as identified in the new gTLD Application Guidebook. 

The SRS is the central component of any registry implementation and its quality, reliability and capabilities are essential to the overall stability of the TLD. Neustar has a documented history of deploying SRS implementations with proven and verifiable performance, reliability and availability. The SRS adheres to all industry standards and protocols. By leveraging an existing SRS platform, The Applicant is mitigating the significant risks and costs associated with the development of a new system. Highlights of the SRS include:
- State-of-the-art, production proven multi-layer design-
- Ability to rapidly and easily scale from low to high volume as a TLD grows
- Fully redundant architecture at two sites
- Support for IDN registrations in compliance with all standards 
- Use by over 300 Registrars
- EPP connectivity over IPv6
- Performance being measured using 100% of all production transactions (not sampling).
 
SRS Systems, Software, Hardware, and Interoperability 
The systems and software that the registry operates on are a critical element to providing a high quality of service. If the systems are of poor quality, if they are difficult to maintain and operate, or if the registry personnel are unfamiliar with them, the registry will be prone to outages. Neustar has a decade of experience operating registry infrastructure to extremely high service level requirements. The infrastructure is designed using best of breed systems and software. Much of the application software that performs registry-specific operations was developed by the current engineering team and as a result the team is intimately familiar with its operations.

The architecture is highly scalable and provides the same high level of availability and performance as volumes increase. It combines load balancing technology with scalable server technology to provide a cost effective and efficient method for scaling.

The Registry is able to limit the ability of any one registrar from adversely impacting other registrars by consuming too many resources due to excessive EPP transactions. The system uses network layer 2 level packet shaping to limit the number of simultaneous connections registrars can open to the protocol layer.

All interaction with the Registry is recorded in log files. Log files are generated at each layer of the system. These log files record at a minimum:
- The IP address of the client
- Timestamp
- Transaction Details
- Processing Time.
In addition to logging of each and every transaction with the SRS Neustar maintains audit records, in the database, of all transformational transactions. These audit records allow the Registry, in support of the applicant, to produce a complete history of changes for any domain name.

SRS Design
The SRS incorporates a multi-layer architecture that is designed to mitigate risks and easily scale as volumes increase. The three layers of the SRS are:
- Protocol Layer
- Business Policy Layer
- Database. 
Each of the layers is described below. 

Protocol Layer
The first layer is the protocol layer, which includes the EPP interface to registrars. It consists of a high availability farm of load-balanced EPP servers. The servers are designed to be fast processors of transactions. The servers perform basic validations and then feed information to the business policy engines as described below. The protocol layer is horizontally scalable as dictated by volume.
The EPP servers authenticate against a series of security controls before granting service, as follows:
- The registrar’s host exchanges keys to initiate a TLS handshake session with the EPP server.
- The registrar’s host must provide credentials to determine proper access levels.
- The registrar’s IP address must be preregistered in the network firewalls and traffic-shapers.

Business Policy Layer 
The Business Policy Layer is the “brain” of the registry system. Within this layer, the policy engine servers perform rules-based processing as defined through configurable attributes. This process takes individual transactions, applies various validation and policy rules, persists data and dispatches notification through the central database in order to publish to various external systems. External systems fed by the Business Policy Layer include backend processes such as dynamic update of DNS, WHOIS and Billing. 

Similar to the EPP protocol farm, the SRS consists of a farm of application servers within this layer. This design ensures that there is sufficient capacity to process every transaction in a manner that meets or exceeds all service level requirements. Some registries couple the business logic layer directly in the protocol layer or within the database. This architecture limits the ability to scale the registry. Using a decoupled architecture enables the load to be distributed among farms of inexpensive servers that can be scaled up or down as demand changes.
The SRS today processes over 30 million EPP transactions daily. 

Database
The database is the third core component of the SRS. The primary function of the SRS database is to provide highly reliable, persistent storage for all registry information required for domain registration services. The database is highly secure, with access limited to transactions from authenticated registrars, trusted application-server processes, and highly restricted access by the registry database administrators. A full description of the database can be found in response to Question 33.

Figure 24-1 depicts the overall SRS architecture including network components.

Number of Servers
As depicted in the SRS architecture diagram above Neustar operates a high availability architecture where at each level of the stack there are no single points of failures. Each of the network level devices run with dual pairs as do the databases. For the TLD registry, the SRS will operate with 8 protocol servers and 6 policy engine servers. These expand horizontally as volume increases due to additional TLDs, increased load, and through organic growth. In addition to the SRS servers described above, there are multiple backend servers for services such as DNS and WHOIS. These are discussed in detail within those respective response sections. 
Description of Interconnectivity with Other Registry Systems

The core SRS service interfaces with other external systems via Neustar’s external systems layer. The services that the SRS interfaces with include:
- WHOIS 
- DNS 
- Billing
- Data Warehouse (Reporting and Data Escrow). 

Other external interfaces may be deployed to meet the unique needs of a TLD. At this time there are no additional interfaces planned for TLD.
The SRS includes an “external notifier” concept in its business policy engine as a message dispatcher. This design allows time-consuming backend processing to be decoupled from critical online registrar transactions. Using an external notifier solution, the registry can utilize “control levers” that allow it to tune or to disable processes to ensure optimal performance at all times. For example, during the early minutes of a TLD launch, when unusually high volumes of transactions are expected, the registry can elect to suspend processing of one or more back end systems in order to ensure that greater processing power is available to handle the increased load requirements. This proven architecture has been used with numerous TLD launches, some of which have involved the processing of over tens of millions of transactions in the opening hours. The following are the standard three external notifiers used the SRS: 

WHOIS External Notifier
The WHOIS external notifier dispatches a work item for any EPP transaction that may potentially have an impact on WHOIS. It is important to note that, while the WHOIS external notifier feeds the WHOIS system, it intentionally does not have visibility into the actual contents of the WHOIS system. The WHOIS external notifier serves just as a tool to send a signal to the WHOIS system that a change is ready to occur. The WHOIS system possesses the intelligence and data visibility to know exactly what needs to change in WHOIS. See response to Question 26 for greater detail.
DNS External Notifier

The DNS external notifier dispatches a work item for any EPP transaction that may potentially have an impact on DNS. Like the WHOIS external notifier, the DNS external notifier does not have visibility into the actual contents of the DNS zones. The work items that are generated by the notifier indicate to the dynamic DNS update sub-system that a change occurred that may impact DNS. That DNS system has the ability to decide what actual changes must be propagated out to the DNS constellation. See response to Question 35 for greater detail.
Billing External Notifier

The billing external notifier is responsible for sending all billable transactions to the downstream financial systems for billing and collection. This external notifier contains the necessary logic to determine what types of transactions are billable. The financial systems use this information to apply appropriate debits and credits based on registrar.

Data Warehouse
The data warehouse is responsible for managing reporting services, including registrar reports, business intelligence dashboards, and the processing of data escrow files. The Reporting Database is used to create both internal and external reports, primarily to support registrar billing and contractual reporting requirement. The data warehouse databases are updated on a daily basis with full copies of the production SRS data. 
Frequency of Synchronization between Servers

The external notifiers discussed above perform updates in near real-time, well within the prescribed service level requirements. As transactions from registrars update the core SRS, update notifications are pushed to the external systems such as DNS and WHOIS. These updates are typically live in the external system within 2-3 minutes.
Synchronization Scheme (e.g., hot standby, cold standby) 
Neustar operates two hot databases within the data center that is operating in primary mode. These two databases are kept in sync via synchronous replication. Additionally, there are two databases in the secondary data center. These databases are updated real time through asynchronous replication. This model allows for high performance while also ensuring protection of data. See response to Question 33 for greater detail. 

Compliance with Specification 6 Section 1.2
The SRS implementation for TLD is fully compliant with Specification 6, including section 1.2. EPP Standards are described and embodied in a number of IETF RFCs, ICANN contracts and practices, and registry-registrar agreements. Extensible Provisioning Protocol or EPP is defined by a core set of RFCs that standardize the interface that make up the registry-registrar model. The SRS interface supports EPP 1.0 as defined in the following RFCs shown in Table 24-1. 

Additional information on the EPP implementation and compliance with RFCs can be found in the response to Question 25.
Compliance with Specification 10
Specification 10 of the New TLD Agreement defines the performance specifications of the TLD, including service level requirements related to DNS, RDDS (WHOIS), and EPP. The requirements include both availability and transaction response time measurements. As an experienced registry operator, Neustar has a long and verifiable track record of providing registry services that consistently exceed the performance specifications stipulated in ICANN agreements. This same high level of service will be provided for the TLD Registry.The following section describes Neustar’s experience and its capabilities to meet the requirements in the new agreement.

To properly measure the technical performance and progress of TLDs, Neustar collects data on key essential operating metrics.These measurements are key indicators of the performance and health of the registry. Neustar’s current .biz SLA commitments are among the most stringent in the industry today, and exceed the requirements for new TLDs. Table 24-2 compares the current SRS performance levels compared to the requirements for new TLDs, and clearly demonstrates the ability of the SRS to exceed those requirements.

Their ability to commit and meet such high performance standards is a direct result of their philosophy towards operational excellence. See response to Question 31 for a full description of their philosophy for building and managing for performance.

24.3 Resourcing Plans 
The development, customization, and on-going support of the SRS are the responsibility of a combination of technical and operational teams, including:
- Development⁄Engineering
- Database Administration
- Systems Administration
- Network Engineering.

Additionally, if customization or modifications are required, the Product Management and Quality Assurance teams will be involved in the design and testing. Finally, the Network Operations and Information Security play an important role in ensuring the systems involved are operating securely and reliably.

The necessary resources will be pulled from the pool of operational resources described in detail in the response to Question 31.Neustar’s SRS implementation is very mature, and has been in production for over 10 years. As such, very little new development related to the SRS will be required for the implementation of the TLD registry. The following resources are available from those teams:
Development⁄Engineering – 19 employees
Database Administration- 10 employees
Systems Administration – 24 employees
Network Engineering – 5 employees

The resources are more than adequate to support the SRS needs of all the TLDs operated by Neustar, including the TLD registry. 
-end-

Q25
25.1 Introduction
The Applicant’s back-end registry operator, Neustar, has over 10 years of experience operating EPP based registries. 
They deployed one of the first EPP registries in 2001 with the launch of .biz. In 2004, they were the first gTLD to implement EPP 1.0. Over the last ten years Neustar has implemented numerous extensions to meet various unique TLD requirements. Neustar will leverage its extensive experience to ensure that the Applicant is provided with an unparalleled EPP based registry. The following discussion explains the EPP interface which will be used for the TLD registry. 
This interface exists within the protocol farm layer as described in Question 24 and is depicted in Figure 25-1.
 
25.2 EPP Interface
Registrars are provided with two different interfaces for interacting with the registry. Both are EPP based, and both contain all the functionality necessary to provision and manage domain names. The primary mechanism is an EPP interface to connect directly with the registry. This is the interface registrars will use for most of their interactions with the registry. 
However, an alternative web GUI (Registry Administration Tool) that can also be used to perform EPP transactions will be provided. The primary use of the Registry Administration Tool is for performing administrative or customer support tasks. 
The main features of the EPP implementation are: 
- Standards Compliance: The EPP XML interface is compliant to the EPP RFCs. As future EPP RFCs are published or existing RFCs are updated, Neustar makes changes to the implementation keeping in mind of any backward compatibility issues.
- Scalability: The system is deployed keeping in mind that it may be required to grow and shrink the footprint of the Registry system for a particular TLD. 
- Fault-tolerance: The EPP servers are deployed in two geographically separate data centers to provide for quick failover capability in case of a major outage in a particular data center. The EPP servers adhere to strict availability requirements defined in the SLAs.
- Configurability: The EPP extensions are built in a way that they can be easily configured to turn on or off for a particular TLD.
- Extensibility: The software is built ground up using object oriented design. This allows for easy extensibility of the software without risking the possibility of the change rippling through the whole application. 
- Auditable: The system stores detailed information about EPP transactions from provisioning to DNS and WHOIS publishing. In case of a dispute regarding a name registration, the Registry can provide comprehensive audit information on EPP transactions.
- Security: The system provides IP address based access control, client credential-based authorization test, digital certificate exchange, and connection limiting to the protocol layer. 

25.3 Compliance with RFCs and Specifications
The registry-registrar model is described and embodied in a number of IETF RFCs, ICANN contracts and practices, and registry-registrar agreements. As shown in Table 25-1, EPP is defined by the core set of RFCs that standardize the interface that registrars use to provision domains with the SRS. As a core component of the SRS architecture, the implementation is fully compliant with all EPP RFCs. 
 

Neustar ensures compliance with all RFCs through a variety of processes and procedures. Members from the engineering and standards teams actively monitor and participate in the development of RFCs that impact the registry services, including those related to EPP. When new RFCs are introduced or existing ones are updated, the team performs a full compliance review of each system impacted by the change. Furthermore, all code releases include a full regression test that includes specific test cases to verify RFC compliance.

Neustar has a long history of providing exceptional service that exceeds all performance specifications. The SRS and EPP interface have been designed to exceed the EPP specifications defined in Specification 10 of the Registry Agreement and profiled in Table 25-2. Evidence of Neustar’s ability to perform at these levels can be found in the .biz monthly progress reports found on the ICANN website.

 
EPP Toolkits
Toolkits, under open source licensing, are freely provided to registrars for interfacing with the SRS. Both Java and C++ toolkits will be provided, along with the accompanying documentation. The Registrar Tool Kit (RTK) is a software development kit (SDK) that supports the development of a registrar software system for registering domain names in the registry using EPP. The SDK consists of software and documentation as described below.

The software consists of working Java and C++ EPP common APIs and samples that implement the EPP core functions and EPP extensions used to communicate between the registry and registrar. The RTK illustrates how XML requests (registration events) can be assembled and forwarded to the registry for processing. The software provides the registrar with the basis for a reference implementation that conforms to the EPP registry-registrar protocol.The software component of the SDK also includes XML schema definition files for all Registry EPP objects and EPP object extensions. The RTK also includes a “dummy” server to aid in the testing of EPP clients.
The accompanying documentation describes the EPP software package hierarchy, the object data model, and the defined objects and methods (including calling parameter lists and expected response behavior). New versions of the RTK are made available from time to time to provide support for additional features as they become available and support for other platforms and languages.

25.3 Proprietary EPP Extensions
The TLD registry will not include proprietary EPP extensions. Neustar has implemented various EPP extensions for both internal and external use in other TLD registries. These extensions use the standard EPP extension framework described in RFC 5730. Table 25-3 provides a list of extensions developed for other TLDs. Should the TLD registry require an EPP extension at some point in the future, the extension will be implemented in compliance with all RFC specifications including RFC 3735.
 
The full EPP schema to be used in the TLD registry is attached in the document titled “EPP Schema.”

25.4 Resourcing Plans
The development and support of EPP is largely the responsibility of the Development⁄Engineering and Quality Assurance teams. As an experience registry operator with a fully developed EPP solution, on-going support is largely limited to periodic updates to the standard and the implementation of TLD specific extensions.
The necessary resources will be pulled from the pool of available resources described in detail in the response to Question 31. The following resources are available from those teams:
Development⁄Engineering – 19 employees
Quality Assurance - 7 employees.

These resources are more than adequate to support any EPP modification needs of the TLD registry.
-end-

Q26
26.1 Introduction
The Applicant recognizes the importance of an accurate, reliable, and up-to-date WHOIS database to governments, law enforcement, intellectual property holders and the public as a whole and is firmly committed to complying with all of the applicable WHOIS specifications for data objects, bulk access, and lookups as defined in Specifications 4 and 10 to the Registry Agreement. The Applicant’s back-end registry services provider, Neustar, has extensive experience providing ICANN and RFC-compliant WHOIS services for each of the TLDs that it operates both as a Registry Operator for gTLDs, ccTLDs and back-end registry services provider. As one of the first “thick” registry operators in the gTLD space, Neustar’s WHOIS service has been designed from the ground up to display as much information as required by a TLD and respond to a very stringent availability and performance requirement.

Some of the key features of the solution include: 

• Fully compliant with all relevant RFCs including 3912
• Production proven, highly flexible, and scalable with a track record of 100% availability over the past 10 years
• Exceeds current and proposed performance specifications 
• Supports dynamic updates with the capability of doing bulk updates 
• Geographically distributed sites to provide greater stability and performance
• In addition, the thick-WHOIS solution also provides for additional search capabilities and mechanisms to mitigate potential forms of abuse as discussed below.(e.g., IDN, registrant data).

26.2 Software Components
The WHOIS architecture comprises the following components:
• An in-memory database local to each WHOIS node: To provide for the performance needs, the WHOIS data is served from an in-memory database indexed by searchable keys.
• Redundant servers: To provide for redundancy, the WHOIS updates are propagated to a cluster of WHOIS servers that maintain an independent copy of the database.
• Attack resistant: To ensure that the WHOIS system cannot be abused using malicious queries or DOS attacks, the WHOIS server is only allowed to query the local database and rate limits on queries based on IPs and IP ranges can be readily applied.
• Accuracy auditor: To ensure the accuracy of the information served by the WHOIS servers, a daily audit is done between the SRS information and the WHOIS responses for the domain names which are updated during the last 24-hour period. Any discrepancies are resolved proactively.
• Modular design: The WHOIS system allows for filtering and translation of data elements between the SRS and the WHOIS database to allow for customizations.
• Scalable architecture: The WHOIS system is scalable and has a very small footprint. Depending on the query volume, the deployment size can grow and shrink quickly.
• Flexible: It is flexible enough to accommodate thin, thick, or modified thick models and can accommodate any future ICANN policy, such as different information display levels based on user categorization
• SRS master database: The SRS database is the main persistent store of the Registry information. The Update Agent computes what WHOIS updates need to be pushed out. A publish-subscribe mechanism then takes these incremental updates and pushes to all the WHOIS slaves that answer queries.

26.3 Compliance with RFC and Specifications 4 and 10
Neustar has been running thick-WHOIS Services for over 10+ years in full compliance with RFC 3912 and with Specifications 4 and 10 of the Registry Agreement. RFC 3912 is a simple text based protocol over TCP that describes the interaction between the server and client on port 43. Neustar built a home-grown solution for this service. It processes millions of WHOIS queries per day.
Table 26-1 describes Neustar’s compliance with Specifications 4 and 10.
Neustar ensures compliance with all RFCs through a variety of processes and procedures. Members from the engineering and standards teams actively monitor and participate in the development of RFCs that impact the registry services, including those related to WHOIS. When new RFCs are introduced or existing ones are updated, the team performs a full compliance review of each system impacted by the change. Furthermore, all code releases include a full regression test that includes specific test cases to verify RFC compliance.

26.4 High-level WHOIS System Description
26.4.1 WHOIS Service (port 43)
The WHOIS service is responsible for handling port 43 queries. Our WHOIS is optimized for speed using an in-memory database and master-slave architecture between the SRS and WHOIS slaves. The WHOIS service also has built-in support for IDN. If the domain name being queried is an IDN, the returned results include the language of the domain name, the domain name’s UTF-8 encoded representation along with the Unicode code page.

26.4.2 Web Page for WHOIS queries
In addition to the WHOIS Service on port 43, Neustar provides a web based WHOIS application. It is an intuitive and easy to use application for the general public to use. WHOIS web application provides all of the features available in the port 43 WHOIS. This includes full and partial search on:
• Domain names
• Nameservers
• Registrant, Technical and Administrative Contacts
• Registrars
It also provides features not available on the port 43 service.These include:
1. Redemption Grace Period calculation: Based on the registry’s policy, domains in pendingDelete can be restorable or scheduled for release depending on the date⁄time the domain went into pendingDelete. For these domains, the web based WHOIS displays “Restorable” or “Scheduled for Release” to clearly show this additional status to the user.
2. Extensive support for international domain names (IDN)
3. Ability to perform WHOIS lookups on the actual Unicode IDN
4. Display of the actual Unicode IDN in addition to the ACE-encoded name
5. A Unicode to Punycode and Punycode to Unicode translator
6. An extensive FAQ
7. A list of upcoming domain deletions

26.5 IT and Infrastructure Resources
As described above the WHOIS architecture uses a workflow that decouples the update process from the SRS.This ensures SRS performance is not adversely affected by the load requirements of dynamic updates. It is also decoupled from the WHOIS lookup agent to ensure the WHOIS service is always available and performing well for users. Each of Neustar’s geographically diverse WHOIS sites use:
• Firewalls, to protect this sensitive data
• Dedicated servers for MQ Series, to ensure guaranteed delivery of WHOIS updates
• Packetshaper for source IP address-based bandwidth limiting
• Load balancers to distribute query load
• Multiple WHOIS servers for maximizing the performance of WHOIS service.
The WHOIS service uses HP BL 460C servers, each with 2 X Quad Core CPU and a 64GB of RAM. The existing infrastructure has 6 servers, but is designed to be easily scaled with additional servers should it be needed.
Figure 26-1 depicts the different components of the WHOIS architecture.

26.6 Interconnectivity with Other Registry System
As described in Question 24 about the SRS and further in response to Question 31, “Technical Overview”, when an update is made by a registrar that impacts WHOIS data, a trigger is sent to the WHOIS system by the external notifier layer.The update agent processes these updates, transforms the data if necessary and then uses messaging oriented middleware to publish all updates to each WHOIS slave.The local update agent accepts the update and applies it to the local in-memory database. A separate auditor compares the data in WHOIS and the SRS daily and monthly to ensure accuracy of the published data.

26.7 Frequency of Synchronization between Servers Updates from the SRS, through the external notifiers, to the constellation of independent WHOIS slaves happens in real-time via an asynchronous publish⁄subscribe messaging architecture. The updates are guaranteed to be updated in each slave within the required SLA of 95% = 60 minutes. Please note that Neustar’s current architecture is built towards the stricter SLAs (95% = 15 minutes) of .BIZ. The vast majority of updates tend to happen within 2-3 minutes.

26.8 Provision for Searchable WHOIS Capabilities
Neustar will create a new web-based service to address the new search features based on requirements specified in Specification 4 Section 1.8. The application will include precautions to avoid abuse and will enable users to search the WHOIS directory using any one or more of the following fields:

• Domain name
• Registrar ID
• Contacts and registrant’s name
• Contact and registrant’s postal address, including all the sub-fields described in EPP (e.g., street, city, state or province, etc.)
• Name server name and name server IP address
• The system will also allow search using non-Latin character sets which are compliant with IDNA specification.

The user will choose one or more search criteria, combine them by Boolean operators (AND, OR, NOT) and provide partial or exact match regular expressions for each of the criterion name-value pairs. The domain names matching the search criteria will be returned to the user.
Figure 26-2 shows an architectural depiction of the new service.

To mitigate the risk of this powerful search service being abused by unscrupulous data miners, a layer of security will be built around the query engine which will allow the registry to identify rogue activities and then take appropriate measures. Potential abuses include, but are not limited to:
• Data Mining
• Unauthorized Access
• Excessive Querying
• Denial of Service Attacks
To mitigate the abuses noted above, Neustar will implement any or all of these mechanisms as appropriate:
• Username-password based authentication 
• Certificate based authentication
• Data encryption
• CAPTCHA mechanism to prevent robo invocation of Web query
• Fee-based advanced query capabilities for premium customers.

The searchable WHOIS application will adhere to all privacy laws and policies of the Applicant’s registry.

26.9 Resourcing Plans 
As with the SRS, the development, customization, and on-going support of the WHOIS service is the responsibility of a combination of technical and operational teams. The primary groups responsible for managing the service include:
• Development⁄Engineering – 19 employees
• Database Administration – 10 employees
• Systems Administration – 24 employees
• Network Engineering – 5 employees
Additionally, if customization or modifications are required, the Product Management and Quality Assurance teams will also be involved. Finally, the Network Operations and Information Security play an important role in ensuring the systems involved are operating securely and reliably. The necessary resources will be pulled from the pool of available resources described in detail in the response to Question 31. Neustar’s WHOIS implementation is very mature, and has been in production for over 10 years. As such, very little new development will be required to support the implementation of the Applicant’s registry. The resources are more than adequate to support the WHOIS needs of all the TLDs operated by Neustar, including the Applicant’s registry. 
-end-

Q27
27.1 Registration Life Cycle
Introduction
The Applicant will follow the lifecycle and business rules found in the majority of gTLDs today. Our back-end operator, Neustar, has over ten years of experience managing numerous TLDs that utilize standard and unique business rules and lifecycles. This section describes the business rules, registration states, and the overall domain lifecycle that will be used for the TLD.
Domain Lifecycle - Description
The registry will use the EPP 1.0 standard for provisioning domain names, contacts and hosts. Each domain record is comprised of three registry object types: domain, contacts, and hosts 
Domains, contacts and hosts may be assigned various EPP defined statuses indicating either a particular state or restriction placed on the object. Some statuses may be applied by the Registrar; other statuses may only be applied by the Registry. Statuses are an integral part of the domain lifecycle and serve the dual purpose of indicating the particular state of the domain and indicating any restrictions placed on the domain. The EPP standard defines 17 statuses, however only 14 of these statuses will be used in the Applicant’s registry per the defined TLD business rules.
The following is a brief description of each of the statuses. Server statuses may only be applied by the Registry, and client statuses may be applied by the Registrar.
- OK – Default status applied by the Registry.
- Inactive – Default status applied by the Registry if the domain has less than 2 nameservers.
- PendingCreate – Status applied by the Registry upon processing a successful Create command, and indicates further action is pending. This status will not be used in the TLD registry.
- PendingTransfer – Status applied by the Registry upon processing a successful Transfer request command, and indicates further action is pending.
- PendingDelete – Status applied by the Registry upon processing a successful Delete command that does not result in the immediate deletion of the domain, and indicates further action is pending.
- PendingRenew – Status applied by the Registry upon processing a successful Renew command that does not result in the immediate renewal of the domain, and indicates further action is pending. This status will not be used in the Applicant’s registry.
- PendingUpdate – Status applied by the Registry if an additional action is expected to complete the update, and indicates further action is pending. This status will not be used in the TLD registry.
- Hold – Removes the domain from the DNS zone.
- UpdateProhibited – Prevents the object from being modified by an Update command.
- TransferProhibited – Prevents the object from being transferred to another Registrar by the Transfer command.
- RenewProhibited – Prevents a domain from being renewed by a Renew command.
- DeleteProhibited – Prevents the object from being deleted by a Delete command. 
The lifecycle of a domain begins with the registration of the domain. All registrations must follow the EPP standard, as well as the specific business rules described in the response to Question 18 above.Upon registration a domain will either be in an active or inactive state. Domains in an active state are delegated and have their delegation information published to the zone. Inactive domains either have no delegation information or their delegation information in not published in the zone. Following the initial registration of a domain, one of five actions may occur during its lifecycle:
- Domain may be updated
- Domain may be deleted, either within or after the add-grace period
- Domain may be renewed at anytime during the term
- Domain may be auto-renewed by the Registry
- Domain may be transferred to another registrar. 
Each of these actions may result in a change in domain state. This is described in more detail in the following section. Every domain must eventually be renewed, auto-renewed, transferred, or deleted. A registrar may apply EPP statuses described above to prevent specific actions such as updates, renewals, transfers, or deletions.

27.1.1 Registration States
Domain Lifecycle – Registration States
- As described above the Applicant’s registry will implement a standard domain lifecycle found in most gTLD registries today. There are five possible domain states:
- Active 
- Inactive
- Locked
- Pending Transfer
- Pending Delete.

All domains are always in either an Active or Inactive state, and throughout the course of the lifecycle may also be in a Locked, Pending Transfer, and Pending Delete state.Specific conditions such as applied EPP policies and registry business rules will determine whether a domain can be transitioned between states. Additionally, within each state, domains may be subject to various timed events such as grace periods, and notification periods. 

Active State
The active state is the normal state of a domain and indicates that delegation data has been provided and the delegation information is published in the zone. A domain in an Active state may also be in the Locked or Pending Transfer states.

Inactive State
The Inactive state indicates that a domain has not been delegated or that the delegation data has not been published to the zone. A domain in an Inactive state may also be in the Locked or Pending Transfer states. By default all domain in the Pending Delete state are also in the Inactive state.

Locked State
The Locked state indicates that certain specified EPP transactions may not be performed to the domain. A domain is considered to be in a Locked state if at least one restriction has been placed on the domain; however up to eight restrictions may be applied simultaneously. Domains in the Locked state will also be in the Active or Inactive, and under certain conditions may also be in the Pending Transfer or Pending Delete states.

Pending Transfer State
The Pending Transfer state indicates a condition in which there has been a request to transfer the domain from one registrar to another. The domain is placed in the Pending Transfer state for a period of time to allow the current (losing) registrar to approve (ack) or reject (nack) the transfer request. Registrars may only nack requests for reasons specified in the Inter-Registrar Transfer Policy.

Pending Delete State
The Pending Delete State occurs when a Delete command has been sent to the Registry after the first 5 days (120 hours) of registration. The Pending Delete period is 35-days during which the first 30-days the name enters the Redemption Grace Period (RGP) and the last 5-days guarantee that the domain will be purged from the Registry Database and available to public pool for registration on a first come, first serve basis.

27.1.2 Typical Registration Lifecycle Activities
Domain Creation Process
The creation (registration) of domain names is the fundamental registry operation. All other operations are designed to support or compliment a domain creation. The following steps occur when a domain is created. 
1. Contact objects are created in the SRS database. The same contact object may be used for each contact type, or they may all be different. If the contacts already exist in the database this step may be skipped.
2. Nameservers are created in the SRS database. Nameservers are not required to complete the registration process; however any domain with less than 2 name servers will not be resolvable.
3. The domain is created using the each of the objects created in the previous steps.In addition, the term and any client statuses may be assigned at the time of creation.
The actual number of EPP transactions needed to complete the registration of a domain name can be as few as one and as many as 40. The latter assumes seven distinct contacts and 13 nameservers, with Check and Create commands submitted for each object. 

Update Process
Registry objects may be updated (modified) using the EPP Modify operation.The Update transaction updates the attributes of the object. 
For example, the Update operation on a domain name will only allow the following attributes to be updated:
- Domain statuses
- Registrant ID
- Administrative Contact ID
- Billing Contact ID
- Technical Contact ID
- Nameservers
- AuthInfo
- Additional Registrar provided fields.

The Update operation will not modify the details of the contacts. Rather it may be used to associate a different contact object (using the Contact ID) to the domain name. To update the details of the contact object the Update transaction must be applied to the contact itself. For example, if an existing registrant wished to update the postal address, the Registrar would use the Update command to modify the contact object, and not the domain object. 
Renew Process 
The term of a domain may be extended using the EPP Renew operation. ICANN policy in general establishes the maximum term of a domain name to be 10 years, and the Applicant will not deviating from this policy. A domain may be renewed ⁄ extended at any point time, even immediately following the initial registration.The only stipulation is that the overall term of the domain name may not exceed 10 years. If a Renew operation is performed with a term value will extend the domain beyond the 10 year limit, the Registry will reject the transaction entirely.
Transfer Process
The EPP Transfer command is used for several domain transfer related operations: 
- Initiate a domain transfer
- Cancel a domain transfer
- Approve a domain transfer
- Reject a domain transfer.
To transfer a domain from one Registrar to another the following process is followed:
1. The gaining (new) Registrar submits a Transfer command, which includes the AuthInfo code of the domain name.
2. If the AuthInfo code is valid and the domain is not in a status that does not allow transfers the domain is placed into pendingTransfer status
3. A poll message notifying the losing Registrar of the pending transfer is sent to the Registrar’s message queue
4. The domain remains in pendingTransfer status for up to 120 hours, or until the losing (current) Registrar Acks (approves) or Nack (rejects) the transfer request
5. If the losing Registrar has not Acked or Nacked the transfer request within the 120 hour timeframe, the Registry auto-approves the transfer
6. The requesting Registrar may cancel the original request up until the transfer has been completed.

A transfer adds an additional year to the term of the domain. In the event that a transfer will cause the domain to exceed the 10 year maximum term, the Registry will add a partial term up to the 10 year limit. Unlike with the Renew operation, the Registry will not reject a transfer operation.
Deletion Process
A domain may be deleted from the SRS using the EPP Delete operation. The Delete operation will result in either the domain being immediately removed from the database or the domain being placed in pendingDelete status. The outcome is dependent on when the domain is deleted. If the domain is deleted within the first five days (120 hours) of registration, the domain is immediately removed from the database. A deletion at any other time will result in the domain being placed in pendingDelete status and entering the Redemption Grace Period (RGP). Additionally, domains that are deleted within five days (120) hours of any billable (add, renew, transfer) transaction may be deleted for credit.

27.1.3 Applicable Time Elements
The following section explains the time elements that are involved. 
Grace Periods
There are six grace periods:
- Add-Delete Grace Period (AGP)
- Renew-Delete Grace Period
- Transfer-Delete Grace Period
- Auto-Renew-Delete Grace Period
- Auto-Renew Grace Period
- Redemption Grace Period (RGP). 
The first four grace periods listed above are designed to provide the Registrar with the ability to cancel a revenue transaction (add, renew, or transfer) within a certain period of time and receive a credit for the original transaction.
The following describes each of these grace periods in detail.

Add-Delete Grace Period 
The APG is associated with the date the Domain was registered.Domains may be deleted for credit during the initial 120 hours of a registration, and the Registrar will receive a billing credit for the original registration.If the domain is deleted during the Add Grace Period, the domain is dropped from the database immediately and a credit is applied to the 
Registrar’s billing account. 
Renew
Delete Grace Period 
The Renew-Delete Grace Period is associated with the date the Domain was renewed. Domains may be deleted for credit during the 120 hours after a renewal.The grace period is intended to allow Registrars to correct domains that were mistakenly renewed. It should be noted that domains that are deleted during the renew grace period will be placed into pendingDelete and will enter the RGP (see below). 

Transfer-Delete Grace Period 
The Transfer-Delete Grace Period is associated with the date the Domain was transferred to another Registrar. Domains may be deleted for credit during the 120 hours after a transfer. It should be noted that domains that are deleted during the renew grace period will be placed into pendingDelete and will enter the RGP. A deletion of domain after a transfer is not the method used to correct a transfer mistake. Domains that have been erroneously transferred or hijacked by another party can be transferred back to the original registrar through various means including contacting the Registry.

Auto-Renew-Delete Grace Period 
The Auto-Renew-Delete Grace Period is associated with the date the Domain was auto-renewed. Domains may be deleted for credit during the 120 hours after an auto-renewal.The grace period is intended to allow Registrars to correct domains that were mistakenly auto-renewed. It should be noted that domains that are deleted during the auto-renew delete grace period will be placed into pendingDelete and will enter the RGP. 

Auto-Renew Grace Period 
The Auto-Renew Grace Period is a special grace period intended to provide registrants with an extra amount of time, beyond the expiration date, to renew their domain name.The grace period lasts for 45 days from the expiration date of the domain name. Registrars are not required to provide registrants with the full 45 days of the period.

Redemption Grace Period 
The RGP is a special grace period that enables Registrars to restore domains that have been inadvertently deleted but are still in pendingDelete status within the Redemption Grace Period. All domains enter the RGP except those deleted during the AGP. 
The RGP period is 30 days, during which time the domain may be restored using the EPP RenewDomain command as described below. Following the 30day RGP period the domain will remain in pendingDelete status for an additional five days, during which time the domain may NOT be restored.The domain is released from the SRS, at the end of the 5 day non-restore period. A restore fee applies and is detailed in the Billing Section. A renewal fee will be automatically applied for any domain past expiration.
Neustar has created a unique restoration process that uses the EPP Renew transaction to restore the domain and fulfill all the reporting obligations required under ICANN policy. The following describes the restoration process.

27.2 State Diagram
Figure 27-1 provides a description of the registration lifecycle. 
The different states of the lifecycle are active, inactive, locked, pending transfer, and pending delete. Please refer to section 27.1.1 for detail description of each of these states. The lines between the states represent triggers that transition a domain from one state to another. 

The details of each trigger are described below:
- Create: Registry receives a create domain EPP command.
- WithNS: The domain has met the minimum number of nameservers required by registry policy in order to be published in the DNS zone.
- WithOutNS: The domain has not met the minimum number of nameservers required by registry policy. The domain will not be in the DNS zone.
- Remove Nameservers: Domainʹs nameserver(s) is removed as part of an update domain EPP command. The total nameserver is below the minimum number of nameservers required by registry policy in order to be published in the DNS zone.
- Add Nameservers: Nameserver(s) has been added to domain as part of an update domain EPP command. The total number of nameservers has met the minimum number of nameservers required by registry policy in order to be published in the DNS zone.
- Delete: Registry receives a delete domain EPP command.
- DeleteAfterGrace: Domain deletion does not fall within the add grace period.
- DeleteWithinAddGrace: Domain deletion falls within add grace period.
- Restore: Domain is restored. Domain goes back to its original state prior to the delete command.
- Transfer: Transfer request EPP command is received.
- Transfer Approve⁄Cancel⁄Reject: Transfer requested is approved or cancel or rejected.
- TransferProhibited: The domain is in clientTransferProhibited and⁄or serverTranferProhibited status. This will cause the transfer request to fail. The domain goes back to its original state.

DeleteProhibited: The domain is in clientDeleteProhibited and⁄or serverDeleteProhibited status.This will cause the delete command to fail. The domain goes back to its original state.
Note: the locked state is not represented as a distinct state on the diagram as a domain may be in a locked state in combination with any of the other states: inactive, active, pending transfer, or pending delete.

27.2.1 EPP RFC Consistency
As described above, the domain lifecycle is determined by ICANN policy and the EPP RFCs. Neustar has been operating ICANN TLDs for the past 10 years consistent and compliant with all the ICANN policies and related EPP RFCs. 
27.3 Resources
The registration lifecycle and associated business rules are largely determined by policy and business requirements; as such the Product Management and Policy teams will play a critical role in working Applicant to determine the precise rules that meet the requirements of the TLD. Implementation of the lifecycle rules will be the responsibility of Development⁄Engineering team, with testing performed by the Quality Assurance team. Neustar’s SRS implementation is very flexible and configurable, and in many case development is not required to support business rule changes. 
The Applicantʹs registry will be using standard lifecycle rules, and as such no customization is anticipated. However should modifications be required in the future, the necessary resources will be pulled from the pool of available resources described in detail in the response to Question 31. The following resources are available from those teams:
Development⁄Engineering – 19 employees
Registry Product Management – 4 employees
These resources are more than adequate to support the development needs of all the TLDs operated by Neustar, including the Applicantʹs registry. 
-end-

Q28
The Applicant’s core mission and purpose is to create an environment where individuals and companies can interact and express themselves in ways never before seen on the Internet, in a more targeted, secure and stable environment. To achieve this goal the Applicant will be implementing a range of Abuse Prevention and Mitigation policies and procedures. The following is an overview of initiatives undertaken by the Applicant:

1. gTLD Abuse Prevention and Mitigation Implementation Plan
2. Policies and Procedures to Minimize Abusive Registrations 
2.1. Implementation plan for Abuse Point of Contact
2.2. Policies for Handling Complaints Regarding the Abuse Policies
2.3. Proposed Measures for Removal of Orphan Glue Records
2.4. Resourcing plans for the initial implementation of, and ongoing maintenance of, the Abuse Prevention and Mitigation initiatives
3. Measures to promote WHOIS accuracy both directly by the Registry and by Registrars via requirements in the Registry-Registrar Agreement (“RRA”)):
3.1. Regular monitoring of registration data for accuracy and completeness
3.2. Registrar WHOIS policy self-certification and authentication
3.3. WHOIS data reminder process
3.4. Establishing policies and procedures to ensure Registrar compliance with WHOIS policies, which may include audits, financial incentives, penalties, or other means
3.5. Registry semi-annual WHOIS verification 
3.6. Registrar semi-annual verification of WHOIS
4. Policies and procedures that define malicious or abusive behaviour
4.1. Service Level Requirements for resolution
4.2. Service Level Requirements for Law enforcement requests
4.3. Coordination with sector Groups and Law Enforcement
4.4. Rapid takedown and suspension
5. Controls to Ensure Proper Access to Domain Functions:
5.1. Enabling two-factor authentication from Registrants to process update, transfer, and deletion requests;
5.2. Enabling multiple, unique points of contact to request and⁄or approve update, transfer, and deletion requests;
5.3. Enabling the notification of multiple, unique points of contact when a domain has been updated, transferred, or deleted 
6. Additional Abuse Prevention and Mitigation initiatives
6.1. Additional Mechanism for Protection of Capital City Names
6.2. Additional Mechanisms to Protect and Reserve IGO Names
6.3. Abuse Prevention and Mitigation Seal
6.4. Governance Council
7. Resource Planning 
7.1. Resource Planning Specific to Backend Registry Activities
7.2. Administrative Services Provider – Famous Four Media Limited
8. ICANN Prescribed Measures
9. Increasing Registrant Security Awareness
10. Registrant Disqualification
11. Restrictions on Proxy Registration Services
12. Registry Lock
13. Scope⁄Scale Consistency
13.1 Scope⁄Scale Consistency Specific to Backend Registry Activities
14. Acceptable Use Policy (“AUP”)
15. Abuse Response Process


1 gTLD Abuse Prevention and Mitigation Implementation Plan 
The Applicant will be implementing a thorough and extensive Abuse Prevention and Mitigation plan, designed to minimise abusive registrations and other detrimental activities that may negatively impact internet users. This plan includes the establishment of a single abuse point of contact, responsible for addressing matters requiring expedited attention and providing a timely response to abuse complaints concerning all names registered in the gTLD through all Registrars of record, including those involving a reseller. Details of this point of contact will be clearly published on the Applicant’s website. 
Strong abuse prevention for a new gTLD is an important benefit to the internet community. The Applicant and its backend services provider agree that a Registry must not only aim for the highest standards of technical and operational competence, but also needs to act as a steward of the space on behalf of the Internet community and ICANN in promoting the Registry’s stakeholders’ interest. The Applicant’s Backend Services Provider brings extensive experience establishing and implementing registration policies. This experience will be leveraged to help the Applicant combat abusive and malicious domain activity within the new gTLD space.
One of the key functions of a responsible domain name Registry includes working towards the eradication of domain name abuse including, but not limited to, those resulting from:

- Illegal or fraudulent actions 
- Spam
- Phishing
- Pharming 
- Distribution of malware 
- Fast flux hosting 
- Botnets
- Illegal distribution of copyrighted material 
- Distribution of child pornography 
- Online sale or distribution of illegal pharmaceuticals.

Further explanation of behaviour considered to be abusive can be found in the Acceptable Use Policy (“AUP”) below. Any second-level domain found to be facilitating such behaviours, either upon registration or subsequently, will be subject to rapid compliance action as per the policies outlined below.
The Applicant believes that the success of the gTLD will be determined largely by the sectorʹs broad-spectrum of key stakeholders, who operate globally. The Applicant believes that these stakeholders will be motivated to protect the sector from detrimental practices. The Applicant further believes that sector stakeholders should be afforded the opportunity to influence the manner in which the gTLD is governed, including its abuse prevention policies where appropriate. Accordingly, the Applicant is establishing a Governance Council, to be comprised of key sector stakeholders that will serve as an advisory body. The Governance Council will elect its own Board of Directors, which will be responsible for self-governance, the recommendation of sector-specific policies, and the formulation of guidance on other best practices related to the gTLD. The Applicant aims to develop an Abuse Prevention and Mitigation Working Group in conjunction with the GC. It will give the Applicant’s team advice on abuse preventions and mitigation and how this may effect registration policies. The group will meet to regularly discuss the latest trends in domain name abuse and the most effective way to prevent and remedy them. Registrants, Registrars and the Registry will all be involved in this working group.This will likely prove important as the battle with abusive behaviour online must continuously evolve given that abusive behaviour itself mutates and changes. The Governance Council will offer significantly greater opportunities to identify emerging threats and rapidly establish procedures to deal with them than might have been possible simply with a Registry perspective.


2 Policies and Procedures to Minimize Abusive Registrations

Regardless of how well intentioned its user-base is, a Registry must have the policies, resources, personnel, and expertise in place to combat abusive DNS practices. The Applicantʹs Registry Backend Services Provider is at the forefront of the prevention of such abusive practices. We also believe that a strong program is essential given that Registrants have a reasonable expectation that they are in control of the data associated with their domains, especially its presence in the DNS zone. Because domain names are sometimes used as a mechanism to enable various illegitimate activities on the Internet, often the best preventative measure to thwart these attacks is to remove the names completely from the DNS before they can impart harm, not only to the domain name Registrant, but also to millions of unsuspecting Internet users.
Removing the domain name from the zone has the effect of shutting down all activity associated with the domain name, including the use of all websites and e-mail. The use of this technique should not be entered into lightly. The Applicant has an extensive, defined, and documented process for taking the necessary action of removing a domain from the zone when its presence in the zone poses a threat to the security and stability of the infrastructure of the Internet or the Registry.

Coalition for Online Accountability (“COA”) Recommendations
The Applicant will further structure its policies around the COA Recommendations where relevant to this gTLD. The Applicant’s goal is to provide a safe and secure browsing experience for consumers of this gTLD. A domain within this gTLD that is owned, operated by or compromised by a malicious party could cause harm to consumers, to the gTLDʹs reputation and to the reputation of the Internet itself. As such, additional controls are in place relating to the validity of registrations, as well as additional measures to ensure the correct identity of both Registrants and Registrars relating to changes made within the SRS, and to protecting the integrity of the DNS service as a whole.
The Coalition for Online Accountability have drafted a set of policy recommendations, also endorsed by many other international organizations representing the creative industries, that should be applied to entertainment gTLDs - especially those dependent on copyright protection. The policy is comprised of a set of 7 recommendations that should be adopted by ICANN in evaluating any applicant for an entertainment-based gTLD. The recommendations were posted by COA in the form of a letter to ICANN at http:⁄⁄bit.ly⁄HuHtmq. We welcome the recommendations from the COA and will strongly consider the recommendations relating to the implementation of this gTLD where considered relevant.

BITS Recommendations
The Applicant will further structure its policies around the BITS Recommendations where relevant to this gTLD. The Applicantʹs goal is to provide a safe and secure browsing experience for consumers of this gTLD. A domain within this gTLD that is owned, operated by or compromised by a malicious party could cause harm to consumers, to the gTLD’s reputation and to the reputation of the Internet itself. As such, additional controls are in place relating to the validity of registrations, as well as additional measures to ensure the correct identity of both Registrants and Registrars relating to changes made within the SRS, and to protecting the integrity of the DNS service as a whole.
The Security Standards Working Group (SSWG) formed by BITS drafted a set of policy recommendations that should be applied to financial gTLDs. The policy is comprised of a set of 31 recommendations that should be adopted by ICANN in evaluating any applicant of a financial gTLD. The recommendations were posted by BITS in the form of a letter to ICANN at [http:⁄⁄www.icann.org⁄en⁄correspondence⁄aba-bits-to-beckstrom-crocker-20dec11-en.pdf]. We welcome the recommendations from SSWG and will strongly consider the recommendations relating to the implementation of this gTLD where considered relevant.


2.1 Implementation plan for Abuse Point of Contact
 
As required by the Registry Agreement, The Applicant will establish and publish on its website a single abuse point of contact responsible for addressing inquiries from law enforcement and the public related to malicious and abusive matters requiring expedited attention. The Applicant will provide a timely response to abuse complaints concerning all names registered in the gTLD by registrars and their resellers. The Applicant will also provide such information to ICANN prior to the delegation of any domain names in the gTLD. This information shall consist of, at a minimum, a valid name, e-mail address dedicated solely to the handling of malicious conduct complaints and a telephone number and mailing address for the primary contact. The Applicant will ensure that this information will be kept accurate and up to date and will be provided to ICANN if and when changes are made. In addition, with respect to inquiries from ICANN-Accredited Registrars, the Applicant’s Registry Backend Services Provider shall have an additional point of contact, as it does today, handling requests by Registrars related to abusive domain name practices.
 
2.2 Policies for Handling Complaints Regarding the Abuse Policies

In order to operate under the new gTLD, Registrants must accept the Acceptable Use Policy. The new gTLD Registry’s Acceptable Use Policy clearly delineates the types of activities that constitute “abuse” and the repercussions associated with an abusive domain name registration. In addition, the policy will be incorporated into the applicable Registry-Registrar Agreement (“RRA”) and reserve the right for the Registry to take the appropriate actions based on the type of abuse. This will include locking down the domain name preventing any changes to the contact and name server information associated with the domain name, placing the domain name “on hold” rendering the domain name non-resolvable, transferring the domain name to another Registrar, and⁄or in cases in which the domain name is associated with an existing law enforcement investigation, substituting name servers to collect information about the DNS queries to assist the investigation. When appropriate, the Applicant will also share information with law enforcement. Each ICANN and gTLD accredited Registrar must agree to pass the Acceptable Use Policy on to its Resellers (if applicable) and ultimately to the gTLD Registrants. The Registry’s initial Acceptable Use Policy that the Applicant will use in connection with the gTLD is outlined in a section below.

2.3 Proposed Measures for Removal of Orphan Glue Records

As the Security and Stability Advisory Committee of ICANN (“SSAC”) rightly acknowledges, although orphaned glue records may be used for abusive or malicious purposes, the “dominant use of orphaned glue supports the correct and ordinary operation of the DNS.” See http:⁄⁄www.icann.org⁄en⁄committees⁄security⁄sac048.pdf. 
While orphan glue records often support the correct and ordinary operation of the DNS, we understand that such glue records can be used maliciously to point to name servers that host domains used in illegal phishing, botnets, malware, and other abusive behaviours. Problems occur when the parent domain of the glue record is deleted but its children glue records still remain in DNS.
Thus, the Registry Operator will remove orphan glue records (as defined at the above link) when provided with evidence in written form that such records are present in connection with malicious conduct. Registrars are required to delete⁄move all dependent DNS records before they are allowed to delete the parent domain.
To prevent orphan glue records, the Registry Backend Services Provider performs the following checks before removing a domain or name server:

Checks during domain delete: 
- Parent domain delete is not allowed if any other domain in the zone refers to the child name server. 
- If the parent domain is the only domain using the child name server, then both the domain and the glue record are removed from the zone.
Check during explicit name server delete: 
- The Registry Backend Services Provider confirms that the current name server is not referenced by any domain name (in-zone) before deleting the name server. 
Zone-file impact:
- If the parent domain references the child name server AND if other domains in the zone also reference it AND if the parent domain name is assigned a serverHold status, then the parent domain goes out of the zone but the name server glue record does not. 
- If no domains reference a name server, then the glue record is removed from the zone file.

2.4 Resourcing plans for the initial implementation of, and ongoing maintenance of, the Abuse Prevention and Mitigation initiatives

Details related to resourcing plans for the initial implementation and ongoing maintenance of the Applicant’s abuse plan are provided in Section 7 of this response.


3 Measures to promote WHOIS accuracy both directly by the Registry and by Registrars via requirements in the Registry-Registrar Agreement (“RRA”):


The Applicant acknowledges that ICANN has developed a number of mechanisms over the past decades that are intended to address the issue of inaccurate WHOIS information. Such measures alone have not proven to be sufficient and the Applicant will offer a mechanism whereby third parties can submit complaints directly to the Applicant about inaccurate or incomplete WHOIS data. Such information shall be forwarded to the sponsoring Registrar, who shall be required to address those complaints with their Registrants. Thirty days after forwarding the complaint to the Registrar, the Applicant will examine the current WHOIS data for names that were alleged to be inaccurate to determine if the information was corrected, the domain name was deleted, or any other action was taken. If the Registrar has failed to take any action, or it is clear that the Registrant was either unwilling or unable to correct the inaccuracies, the Applicant reserves the right to suspend the applicable domain name(s) until such time as the Registrant is able to cure the deficiencies. Further efforts to pre-empt inaccurate WHOIS data made by the Applicant will include:

1) The Applicant will in general discourage the use of proxy registration services. The Applicant understands that there are instances when proxy registrations may be required and will develop best practices for when these instances occur. 
2) The Applicant will maintain a web-based form for third parties to submit claims regarding false and⁄or inaccurate WHOIS data and the Applicant will forward credible claims to the Registrar for investigation⁄resolution. The Applicant will follow up to verify that the claim has been satisfactorily resolved. Failure of the Registrar or the Registrant to resolve the problem may result in the Applicant placing the domain name on hold, except in extraordinary circumstances.
3) The Applicantʹs Registry Backend Services Provider will regularly remind Registrars of their obligation to comply with ICANN’s WHOIS Data Reminder Policy. This policy requires Registrars to validate the WHOIS information provided during the registration process, to investigate claims of fraudulent WHOIS information, and to cancel domain name registrations for which WHOIS information is determined to be invalid.
4) WHOIS Verification by Registrars. As part of their Registry-Registrar Agreement all accredited Registrars will be required to revalidate WHOIS data for each record they have registered in the gTLD. The Applicant will leave the ultimate determination of how this procedure takes place to the Registrar, but it must include one of the following approved methods. (1) Email notification (2) Outbound telemarketing effort to the individual listed as the administrative contact for the domain.
 
3.1 Regular monitoring of registration data for accuracy and completeness

As part of their Registry-Registrar Agreement, all of the Applicant’s Registrars will be required to revalidate WHOIS data for each record they have registered on a bi-annual basis. This revalidation will require the Registrar to notify its Registrants in the gTLD about this requirement. While the Applicant reserves the right to suspend domain names that are not verified in a timely manner, the Applicant will engage in other outreach to the Registrant prior to suspending any domain name. As part of the gTLD Abuse reporting system, users can report missing or incomplete WHOIS data via the Registry website. The Applicant will also perform randomized audits of verified WHOIS information to ensure compliance and accuracy.
The Applicant’s selected Registry Backend Services Provider has established policies and procedures to encourage Registrar compliance with ICANN’s WHOIS accuracy requirements..


3.2 Registrar WHOIS policy self-certification and authentication
 
The self-certification program consists, in part, of evaluations applied equally to all operational ICANN accredited Registrars for the gTLD and is conducted from time to time throughout the year. Process steps are as follows:
The Registry Backend Services Provider sends an email notification to the ICANN primary Registrar contact, requesting that the contact go to a designated URL, log in with his⁄her Web ID and password, and complete and submit the online form. The contact must submit the form within 15 business days of receipt of the notification. 
When the form is submitted, the Registry Backend Services Provider sends the Registrar an automated email confirming that the form was successfully submitted.
The Registry Backend Services Provider reviews the submitted form to ensure the certifications are compliant.
The Registry Backend Services Provider sends the Registrar an email notification if the Registrar is found to be compliant in all areas. 
If a review of the response indicates that the Registrar is out of compliance or if the Registry Backend Services Provider has follow-up questions, the Registrar has 10 days to respond to the inquiry.
If the Registrar does not respond within 15 business days of receiving the original notification, or if it does not respond to the request for additional information, the Registry Backend Services Provider sends the Registrar a Breach Notice and gives the Registrar 30 days to cure the breach.
If the Registrar does not cure the breach, the Registry Backend Services Provider may terminate the Registry-Registrar Agreement (RRA).

3.3 WHOIS data reminder process.
 
The Registry Backend Services Provider regularly reminds Registrars of their obligation to comply with ICANN’s WHOIS Data Reminder Policy, which was adopted by ICANN as a consensus policy on 27 March 2003 (http:⁄⁄www.icann.org⁄en⁄Registrars⁄wdrp.htm). The Registry Backend Services Provider sends a notice to all Registrars once a year reminding them of their obligation to be diligent in validating the WHOIS information provided during the registration process, to investigate claims of fraudulent WHOIS information, and to cancel domain name registrations for which WHOIS information is determined to be invalid.

 
3.4 Establishing policies and procedures to ensure Registrar compliance with policies, which may include audits, financial incentives, penalties, or other means.

The Applicant will require as part of the RRA obligations that all accredited Registrars for the gTLD participate in the abuse prevention and mitigation procedures and policies, as well as efforts to improve the accuracy and completeness of WHOIS data. In addition, the Applicant will work to develop an economic incentive program, such as Market Development Funds for Registrars who meet certain SLAs for performance in this area.
 
3.5 Registry bi-annual WHOIS verification

Additionally, the Applicant will, of its own volition and no less than twice per year, perform a manual review of a random sampling of gTLD domain names in its Registry to test the accuracy of the WHOIS information. Although this will not include verifying the actual information in the WHOIS record, the Applicant will be examining the WHOIS data for prima facie evidence of inaccuracies. In the event that such evidence exists, it shall be forwarded to the sponsoring Registrar, who shall be required to address those complaints with their Registrants. Thirty days (30) after forwarding the complaint to the Registrar, the Applicant will reexamine the current WHOIS data for names that were alleged to be inaccurate to determine if the information was corrected, the domain name was deleted, or some other action was taken. If the Registrar has failed to take any action, or it is clear that the Registrant was either unwilling or unable to correct the inaccuracies, The Applicant reserves the right to suspend the applicable domain name(s) until such time as the Registrant is able to cure the deficiencies.

3.6 Registrar bi-annual verification of WHOIS

The Applicant will require in the Registry-Registrar Agreement that all accredited Registrars in this gTLD will be obliged to verify WHOIS data for each record they have registered in the gTLD twice a year. Verification can take place via email, phone or any other method to confirm the accuracy of the WHOIS data associated with the domain name. The Applicant will randomly audit WHOIS records to ensure compliance and accuracy. As part of the gTLD Abuse reporting system, users can report missing or incomplete WHOIS data via the Registry website.

4 Policies and procedures that define malicious or abusive behaviour

The applicant has developed policies and procedures that define malicious and abusive behaviour. More information on these policies and procedures can be found in section 14 - Acceptable Use Policy.

4.1 Service Level Requirements for resolution of APM related activities

As pertains to the Applicant’s service level requirements for resolution, we aim to address and potentially rectify the issue as it pertains to all forms of abuse and fraud within 24 hours. Once abusive behaviour is detected or reported, the Applicant’s Customer Service center immediately creates a support ticket in order to monitor and track the issue through resolution. This support team is operational 24⁄7⁄365. A preliminary assessment will be performed in order to determine whether the abuse claim is legitimate. We will classify each incidence of legitimately reported abuse into one of two categories based on the probable severity and immediacy of harm to Registrants and Internet users.

Category 1:
- Probable Severity or Immediacy of Harm: Low
- Examples of types of abusive behaviour: Spam, Malware
- Mitigation steps:
 - Investigate
 - Notify Registrant
- Response times – up to 3 days depending on severity.

Category 2:

- Probable Severity or Immediacy of Harm: Medium to High
- Examples of types of abusive behaviour: Fast Flux Hosting, Phishing, Illegal Access to other Computers or Networks, Pharming, Botnet command and control
- Mitigation steps:
 - Suspend domain name 
 - Investigate
 - Restore or terminate domain name
- Response times - up to 1 day.

4.2 Service Level Requirements and Coordination regarding Law enforcement APM requests

With the assistance of its Registry Backend Services Provider, the Applicant will meet its obligations under Section 2.8 of the Registry Agreement where required to take reasonable steps to investigate and respond to reports from law enforcement, governmental and quasi-governmental agencies of illegal conduct in connection with the use of the gTLD. The Registry will respond to legitimate law enforcement inquiries within one business day from receiving the request. Such a response shall include, at a minimum, an acknowledgement of receipt of the request, questions or comments concerning the request, and an outline of the next steps to be taken by the Applicant for rapid resolution of the request. 
In the event such request involves any of the activities which can be validated by the Registry and involves the type of activity set forth in the Acceptable Use Policy, the sponsoring Registrar is then given 24 hours to investigate the activity further and either take down the domain name by placing the domain name on hold or by deleting the domain name in its entirety or providing a compelling argument to the Registry to keep the name in the zone. If the Registrar has not taken the requested action after the 24-hour period (i.e., is unresponsive to the request or refuses to take action), the Registry may place the domain on “ServerHold”.

4.3 Coordination with sector Groups and Law Enforcement

One of the reasons for which the Registry Backend Services Provider was selected to serve as the Registry Backend Services Provider by the Applicant is the Registry Backend Services Provider’s extensive experience and its close working relationship with a number of law enforcement agencies. 
The Registry Backend Services Provider is also a participant in a number of sector groups aimed at sharing information amongst key sector players about the abusive registration and use of domain names. Through these organizations the Registry Backend Services Provider shares information with other registries, Registrars, ccTLDs, law enforcement, security professionals, etc. Not only on abusive domain name registrations within its own gTLDs, but also provides information uncovered with respect to domain names in other registries. The Registry Backend Services Provider has often found that rarely are abuses found only in the gTLDs which it manages, but also within other gTLDs. The Registry Backend Services Provider routinely provides this information to the other registries so that it can take the appropriate action. 
When executed in accordance with the Registry Agreement, plans will result in compliance with contractual requirements.
The Applicant believes that the proposed collection of protections that involve both proactive and reactive mechanisms outlined above will provide an unmatched level of security and anti-abuse activity within the gTLD. These mechanisms will be part of both the Registry-Registrar Agreement as well as the Registrant Registration Agreement.

4.4 Rapid takedown and suspension system

The Applicant is committed to ensuring that the use of the internet within its Registry is compliant with all relevant laws and legal directions.
The Applicant notes that its role as the Registry operator is not one of judge and jury in all jurisdictions and as such shall direct all complainants to the legal process in the relevant jurisdiction. Upon receiving a valid and enforceable legal judgment or direction it shall comply forthright with the appropriate action which shall include rapid takedown and⁄or suspension.

5 Controls to Ensure Proper Access to Domain Functions

5.1 Enabling two-factor authentication from Registrants to process update, transfers, and deletion requests;

To ensure proper and secure access to domain functions, the Applicant will develop best practices for its Registrars relating to enabling its Registrants to utilize two factor authentication in its interaction with their Registrar and ultimately the Registry. 
The goal of these best practices is to improve domain name security and assist Registrars in protecting the accounts they manage by providing another level of assurance that only authorized registrants can communicate through the registrar with the Registry.

5.2 Enabling multiple, unique points of contact to request and⁄or approve update, transfer, and deletion requests;

The Applicant will investigate the costs and benefits for introducing a service whereby a Registrant can elect to designate multiple points of contact for each domain registered to approve changes to a domain before they are effectuated. The Applicant is of the opinion that these additional checks could improve the security of each domain and will look for ways to deploy them in the most cost-effective and user-friendly manner possible.

5.3 Enabling the notification of multiple, unique points of contact when a domain has been updated, transferred, or deleted

The Applicant will investigate the costs and benefits for introducing a service where by a Registrant can elect to designate multiple points of contact for each domain registered to receive notification of changes to a domain when they are effectuated. The Applicant is of the opinion that these additional checks could improve the security of each domain and will look for ways to deploy them in the most cost-effective and user-friendly manner possible.


6. Additional Abuse Prevention and Mitigation initiatives
 
6.1 Additional Mechanism for Protection of Capital City Names

In parallel with the Landrush Period defined in the answer to question 18, the Applicant will implement a Capital City Claim (“CCC”) service whereby additional protection will be granted to the capital city names of a country or territory listed in the ISO 3166-1 standard. The CCC process is as follows:

1. Any prospective domain name Registrant applying to register a domain name identical to the capital city name of a country or territory listed in the ISO 3166-1 standard will receive from the Applicant a CCC notification highlighting the fact that the applied-for domain name corresponds to a capital city name of a country or territory listed in the ISO 3166-1 standard. 
2. A potential domain name Registrant receiving a CCC notification will have to send a response to the Applicant whereby it will unconditionally comply with the requirements as to representations and warranties required by the Applicant. This will protect the reputation of the capital city as well as any further relevant terms and conditions provided.
3. Unconditional acceptance of the warranties set out in the CCC notification will be a material requirement for a prospective Registrant to be eligible to register the domain name in question should said prospective Registrant be successful in the Landrush period.
4. Upon registration during the Landrush period of a domain name identical to a capital city name of a country or territory listed in the ISO 3166-1 standard, the Applicant will send a notification in writing to the ICANN Government Advisory Committee (ʺGACʺ) Chair.

6.2 Additional Mechanisms to Protect and Reserve IGO Names
The Applicant considers the Protection of Intergovernmental Organization (ʺIGOʺ) names to be very important. The Applicant will use strings registered as second level domains in the .int gTLD as the basis for this protection. To register in the .int domain, the Registrants must be an IGO that meets the requirements found in RFC 1591. The .int domain is used for registering organizations established by international treaties between or among national governments and which are widely considered to have independent international legal personality. Thus, the names of these organizations, as with geographic names, can lend an official imprimatur, and if misused, be a source of public confusion or deception.
 
Reservation of IGO names:

In addition to the mandated and additional reservation of geographic names as provided for in response to Question 22, the Applicant will reserve, and thereby prevent registration of, all names that are registered as second level domains in the most recent .int zone as of 1st November 2012. By doing so, the Applicant will extend additional protection to IGOs that comply with the current eligibility requirements for the .int gTLD as defined at http:⁄⁄www.iana.org⁄domains⁄int⁄policy⁄, and that have obtained a second-level registration in the .int zone.

Release of IGO names:

In the future, should any of the IGOs wish to make use of the protected strings, the Registry will release and assign the domain to the respective IGOs using the following process:

a) The IGO submits a request to the Applicant in the hope of the reserved name being assigned to themselves and provides the necessary documentation and details of the proposed registrant entity for the domain name registration.
b) The Applicant will validate and authenticate the request to establish that it is a genuine bona fide request.
c) Once the request has been approved the Applicant will notify the requesting IGO as well as ICANN and the GAC of the approval for the assignment of the domain name.
d) The Applicant will issue a unique authorization code to the proposed IGO registrant.
e) The proposed IGO registrant will then be able to request that the assignment of the domain name is given to them using the authorization code with an ICANN and gTLD accredited Registrar of their choice.

6.3 Abuse Prevention and Mitigation Seal

The Applicant intends to further augment the security and stability of its gTLD by implementing the Abuse Prevention and Mitigation Seal (the “APM Seal”). The APM Seal will provide users and stakeholders in the sector with a one-click mechanism for how to access relevant Abuse Prevention and Mitigation processes. Registrants on the gTLD will be required to implement an APM Seal on their web pages that users can click-on and be taken to a web resource detailing the relevant mechanisms for how to report and address abuse on the gTLD. The Applicant will in cooperation with the Governance Council for the sector establish relevant procedures and processes that will be presented to stakeholders with potential grievances.
The APM Seal will operate as follows:

1. Registrant will be required to agree to the Registry’s “Abuse and Rights Protection” Terms and Conditions as part of the Registration process for the second-level domain including clauses relating to the APM Seal.
2. The Terms and Conditions will require the Registrant to include the APM Seal in a prominent place on its website.
3. Following the registration, the Registry will automatically email the Registrant’s Administrative, Technical, and Billing contacts with an additional notification that the APM Seal needs to be included on the Registrant’s homepage. The Registrant has 120 days from the date of registration (the “Grace Period”) to effectuate the fixing of the APM seal.
4. During the Grace Period, the domain registration will be flagged in WHOIS or a linked system as being in the APM Seal Grace Period.
5. When the APM Seal has been activated, the second-level domain will have the APM Seal marked as active in WHOIS or a linked system.
6. If the Registrant does not activate the APM Seal before the Grace Period expires, the site will be flagged as being out of the Grace Period for the APM Seal activation and the Registry will notify the Registrant’s Administrative, Technical, and Billing contacts with an additional notification that this APM Seal activation is out of its Grace Period. The contacts will further be notified that the APM Seal must be included on the page and that the Registrant is granted a further 30 days before the site is flagged as being in breach of the Registration terms.
7. Should the Registrant fail to comply and activate the APM Seal within the period specified in the Acceptable Use Policy, the Registry will conduct an investigation on that domain. If after the investigation it is determined that the domain is in breach of the Acceptable Use Policy the Registry reserves the right to suspend and cancel the domain.
8. Exceptions: if a Registrant has a second-level domain that is:
(a) Used for forwarding to another domain 
(b) The domain is not used for a website 
(c) The domain is currently not in use, or 
(d) There is another reason why the seal cannot technically be included

Should the domain be in any of the aforementioned states then the Registrant can activate the APM Seal stating that the domain is one of the exceptions (as listed above) and therefore does not need to include the APM Seal. If a site is listed to be in any of these exception states and then the use of the domain changes to a state that would require the APM Seal, the Registrant must then change the domains status to comply with Acceptable Use Policy. The Registry will conduct an investigation on that domain. If after the investigation it is determined that the domain is in breach of the Acceptable Use Policy the Registry reserves the right to suspend and cancel the domain.

6.4 Governance Council

The Applicant believes that the success of the gTLD will be determined in large by the gTLD’s stakeholders. Not only will these stakeholders have the primary interest of registering domains on the gTLD, but they will also be motivated to protect the sector from practices that would negatively impact the sector overall. The Applicant further believes that sector stakeholders should be afforded the opportunity to influence the manner in which the gTLD is governed. Accordingly, the Applicant is establishing a Governance Council (the “GC”), to be comprised of key sector stakeholders that will serve as an advisory body.

The GC will elect its own Board of Directors, which will be responsible for self-governance, the recommendation of sector-specific policies, and the formulation of guidance on intellectual property and other best practices related to the gTLD. This will lead the policy development process of defining how the APM Reporting Website should best reflect the options users, rights holders, etc., have for addressing infringing content or other issues.


7. Resource Planning

7.1 Resource Planning Specific to Backend Registry Activities

Responsibility for abuse mitigation rests with a variety of functional groups. The Abuse Monitoring team is primarily responsible for providing analysis and conducting investigations of reports of abuse. The customer service team also plays an important role in assisting with the investigations, responding to customers, and notifying Registrars of abusive domains. Finally, the Policy⁄Legal team is responsible for developing the relevant policies and procedures. 
The necessary resources will be pulled from the pool of available resources described in detail in the response to Question 31. The following resources are available from those teams globally distributed:

Customer Support – 12 people
Policy⁄Legal – 2 people
The resources are more than adequate to support the abuse mitigation procedures of the Registry. 

7.2 Administrative Services Provider – Famous Four Media Limited

In addition to those resources set out above provided by the Registry’s backend services provider the Applicant‘s Administration Services Provider shall provide the following extra resources:

- Sunrise Validation Team - This shall comprise of 11 employees of which at least one shall be a qualified lawyer specializing in intellectual property law.
- Ongoing Rights Protection Team - This shall comprise of 11 employees of which at least one shall be a qualified lawyer specializing in intellectual property law.

The two key objectives of the Sunrise Validation Team and the Ongoing rights Protection Team (together the “Rights Team”) is to:

a. Prevent abusive registrations; and
b. Identify and address the abusive use of registered names on an ongoing basis
Because rights protection is a fundamental core objective of the Applicant it has contracted with its Registry Administration Services Provider that the number of full time personnel made available to the Applicant will be 125% of the estimated requirement to ensure that at all times the Applicant is over resourced in this area. In addition the Applicant shall instruct outside Counsel in any relevant jurisdiction on all matters that are unable to be adequately dealt with by the Sunrise Validation Team or the Ongoing Rights Protection Team.

8. ICANN Prescribed Measures

In accordance with its obligations as a Registry operator, the Applicant will comply with all requirements in the ‘gTLD Applicant Guidebook’. In particular, we will comply with the following measures prescribed by ICANN which serve to mitigate the potential for abuse in the gTLD:

- DNSSEC deployment, which reduces the opportunity for pharming and other man-in-the-middle attacks. We will encourage Registrars and Internet Service Providers to deploy DNSSEC capable resolvers in addition to encouraging DNS hosting providers to deploy DNSSEC in an easy-to-use manner in order to facilitate deployment by Registrants. Prohibition on Wild Carding as required by section 2.2 of Specification 6 of the Registry Agreement.
- Removal of Orphan Glue records (discussed above in section 4).


9. Increasing Registrant Security Awareness

In order to operate a secure and reliable gTLD, the Applicant will attempt to improve Registrant awareness of the threats of domain name hijacking, Registrant impersonation and fraud, and emphasise the need for and responsibility of Registrants to keep registration (including WHOIS) information accurate. Awareness will be raised by:
- Publishing the necessary information on the Abuse page of our Registry website in the form of presentations and FAQ’s.
- Developing and providing to Registrants and resellers Best Common Practices that describe appropriate use and assignment of domain auth Info codes and risks of misuse when the uniqueness property of this domain name password is not preserved.
The increase in awareness renders Registrants less susceptible to attacks on their domain names owing to the adoption of the recommended best practices thus serving to mitigate the potential for abuse in the gTLD. The clear responsibility on Registrants to provide and maintain accurate registration information (including WHOIS) further serves to minimise the potential for abusive registrations in the gTLD.


10. Registrant Disqualification

Registrants, their agents or affiliates found through the application of the AUP to have repeatedly engaged in abusive registration may be disqualified from maintaining any registrations or making future registrations. This will be triggered when the Registry Backend Services Provider’s records indicate that a Registrant has had action taken against it an unusual number of times through the application of our Anti-Abuse Policy. Registrant disqualification provides an additional disincentive for qualified Registrants to maintain abusive registrations in that it puts at risk even otherwise non-abusive registrations, through the possible loss of all registrations.
In addition, name servers that are found to be associated only with fraudulent registrations will be added to a local blacklist and any existing or new registration that uses such fraudulent NS record will be investigated.
The disqualification of ‘bad actors’ and the creation of blacklists mitigates the potential for abuse by preventing individuals known to partake in such behaviour from registering domain names.
For a Registrant to be placed on a list of bad actors, the Applicant will examine the factors noted above, and such determination shall be made by the Applicant at its sole discretion. Once the Applicant determines that a Registrant should be placed onto the list of bad actors, the Applicant will notify its Registry Backend Services Provider, who will be instructed to cause all of the Registrant’s second-level domains in the gTLD to resolve to a page which notes that the domain has been disabled for abuse-related reasons. The second-level domains at issue will remain in this state until the expiration of the Registrant’s registration term or a decision from a UDRP panel or court of competent jurisdiction requires the transfer or cancellation of such domains.

 
11. Restrictions on Proxy Registration Services

The Applicant will in general discourage the use of proxy registration services. The Applicant further understands that there are instances when proxy registrations may be required and will develop best practices when these instances occur. Whilst it is understood that implementing measures to promote WHOIS accuracy is necessary to ensure that the Registrant may be tracked down, it is recognised that some Registrants may wish to utilise a proxy registration service to protect their privacy. In the event that Registrars elect to offer such services, the following conditions apply:

- Registrars should take the best practice guidance developed by the Applicant and the Governance Council for the gTLD into account when making Proxy registration services available to its Registrants. 
- Registrars must ensure that the actual WHOIS data is obtained from the Registrant and must maintain accurate records of such data.
- Registrars must provide Law Enforcement Agencies (“LEA”) with the actual WHOIS data upon receipt of a verified request.

These conditions will be implemented contractually by inclusion of corresponding clauses in the RRA as well as being published on the Abuse page of the Registry website. Individuals and organisations will be encouraged through the Abuse page to report any domain names they believe violate the above restrictions, following which appropriate action may be taken by the Registry Backend Services Provider. Publication of these conditions on the Abuse page of the Registry website ensures that Registrants are aware that despite utilisation of a proxy registration service, actual WHOIS information will be provided to LEA upon request in order to hold Registrants liable for all actions in relation to their domain name. 
The certainty that WHOIS information relating to domain names which draw the attention of LEA will be disclosed results in the gTLD being less attractive to those seeking to register domain names for abusive purposes, thus mitigating the potential for abuse in the gTLD.


12. Registry Lock

Certain mission-critical domain names such as transactional sites, email systems and site supporting applications may warrant a higher level of security. Whilst the Applicant will take efforts to promote the awareness of security amongst Registrants, it is recognised that an added level of security may be provided to Registrants by ‘Registry locking’ the domain name and thereby prohibiting any updates at the Registry operator level. The Registry lock facility will be offered to all Registrars who may request this service on behalf of their Registrants in order to prevent unintentional transfer, modification or deletion of the domain name. This facility mitigates the potential for abuse by prohibiting any unauthorised updates that may be associated with fraudulent behaviour. For example, an attacker may update nameservers of a mission-critical domain name, thereby redirecting customers to an illegitimate website without actually transferring control of the domain name.
Upon receipt of a list of domain names to be placed on Registry lock by an authorised representative from a Registrar, the Registry Backend Services Provider will:

1. Validate that the Registrar is the Registrar of record for the domain names.
2. Set or modify the status codes for the names submitted to serverUpdateProhibited, serverDeleteProhibited and⁄or serverTransferProhibited depending on the request.
3. Record the status of the domain name in the Shared Registration System (SRS).
4. Provide a monthly report to Registrars indicating the names for which the Registry lock service was provided in the previous month.


13. Scope⁄Scale Consistency

The Applicant believes that the proposed collection of protections that involve both proactive and reactive mechanisms outlined above will provide an unmatched level of security and anti-abuse activity within the gTLD and is appropriate for the size and scale of the gTLD. 

13.1 Scope⁄Scale Consistency Specific to Backend Registry Activities

The Registry Backend Services Provider is an experienced backend Registry provider that has developed and uses proprietary system scaling models to guide the growth of its gTLD supporting infrastructure. These models direct the Registry Backend Services Provider’s infrastructure scaling to include, but not be limited to, server capacity, data storage volume, and network throughput that are aligned to projected demand and usage patterns. The Registry Backend Services Provider periodically updates these models to account for the adoption of more capable and cost-effective technologies. 
The Registry Backend Services Provider’s scaling models are proven predictors of needed capacity and related cost. As such, they provide the means to link the projected infrastructure needs of the gTLD with necessary implementation and sustainment cost. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its scaling models, The Registry Backend Services Provider derived the necessary infrastructure required to implement and sustain this gTLD and its APM policies.

14. Acceptable Use Policy

This Acceptable Use Policy gives the Registry the ability to quickly lock, cancel, transfer or take ownership of any domain name, either temporarily or permanently, if the domain name is being used in a manner that appears to threaten the stability, integrity or security of the Registry, or any of its Registrar partners and⁄or that may put the safety and security of any Registrant or user at risk. The process also allows the Registry to take preventive measures to avoid any such criminal or security threats.
The Acceptable Use Policy may be triggered through a variety of channels, including, among other things, private complaint, public alert, government or enforcement agency outreach, and the on-going monitoring by the Registry or its partners. In all cases, the Registry or its designees will alert the Registry’s Registrar partners about any identified threats, and will work closely with them to bring offending sites into compliance.
The following are some (but not all) activities that may be subject to rapid domain compliance:

- Phishing; a criminal activity employing tactics to defraud and defame Internet users via sensitive information with the intent to steal or expose credentials, money or identities. A phishing attack often begins with a spoofed email posing as a trustworthy electronic correspondence that contains hijacked brand names e.g.(financial institutions, credit card companies, e-commerce sites). The language of a phishing email is misleading and persuasive by generating either fear and⁄or excitement to ultimately lure the recipient to a fraudulent Web site. It is paramount for both the phishing email and Web site to appear credible in order for the attack to influence the recipient. As with the spoofed email, phishers aim to make the associated phishing Web site appear credible. The legitimate target Web site is mirrored to make the fraudulent site look professionally designed. Fake third-party security endorsements, spoofed address bars, and spoofed padlock icons falsely lend credibility to fraudulent sites as well. The persuasive inflammatory language of the email combined with a legitimate looking Web site is used to convince recipients to disclose sensitive information such as passwords, usernames, credit card numbers, social security numbers, account numbers, and mother’s maiden name.
- Malware; malicious software that was intentionally developed to infiltrate or damage a computer, mobile device, software and⁄or operating infrastructure or website without the consent of the owner or authorized party. This includes, amongst others, Viruses, Trojan horses, and worms. 
- Domain Name or Domain Theft; the act of changing the registration of a domain name without the permission of its original Registrant.
- Botnet Command and Control; Services run on a domain name that is used to control a collection of compromised computers or “zombies,” or to direct Distributed Denial of Service attacks (“DDoS attacks”)
- Distribution of Malware; The intentional creation and intentional or unintentional distribution of “malicious” software designed to infiltrate a computer system without the owner’s consent, including, without limitation, computer viruses, worms, keyloggers, and Trojans. 
- Fast Flux Attacks⁄Hosting; A technique used to shelter Phishing, Pharming, and Malware sites and networks from detection and to frustrate methods employed to defend against such practices, whereby the IP addresses associated with fraudulent sites are changed rapidly so as to make the true location of the sites difficult to find.
- Hacking; the attempt to gain unauthorized access (or exceed the level of authorized access) to a computer, information system, user account or profile, database, or security system.
- Pharming; The redirecting of unknown users to fraudulent sites or services, typically through, but not limited to, DNS hijacking or poisoning;
- Spam; The use of electronic messaging systems to send unsolicited bulk messages. The term applies to email spam and similar abuses such as instant messaging spam, mobile messaging spam, and spamming of websites and Internet forums.
- Child Pornography: the storage, publication, display and⁄or dissemination of pornographic materials depicting individuals under the legal age in the relevant jurisdiction.
- Further abusive behaviours include, but are not limited to; Cybersquatting,Front-Running,Gripe Sites, Deceptive and⁄or Offensive Domain Names, Fake Renewal Notices,Cross-gTLD Registration Scam, Name Spinning, Pay-per-Click, Traffic Diversion, False Affiliation, Domain Kiting ⁄ Tasting, fast-flux and 419 scams.

The Registry reserves the right, at its sole discretion, to take any administrative and operational actions necessary, including the use of computer forensics and information security technological services, among other things, in order to implement the Acceptable Use Policy. In addition, the Registry reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on Registry lock, hold or similar status, that it deems necessary, to its discretion; (1) to protect the integrity and stability of the Registry; (2) to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process; (3) to avoid any liability, civil or criminal, on the part of the Registry as well as its affiliates, subsidiaries, officers, directors, and employees; (4) per the terms of the registration agreement or (5) to correct mistakes made by the Registry or any Registrar in connection with a domain name registration. The Registry also reserves the right to place upon Registry lock, hold or similar status a domain name during resolution of a dispute. 
Registrants must also agree that they will not use their domain for any purposes which are prohibited by the laws of the jurisdiction(s) in which they do business or any other applicable law. You may not use your domain for any purposes or in any manner which violate a statute, rule or law governing use of the Internet and⁄or electronic commerce, including those statutes related to gaming and⁄or online gambling.
In addition, The Applicant reserves the right to deny attempted registrations from repeat violators of the Registry’s Acceptable Use Policy. The Registry’s Acceptable Use Policy will incorporate a certification by the Registrant that the domain will be used only for licensed, legitimate activities, and not to facilitate piracy or infringements. The Registrant will be required to accept these terms as part of its registration agreement. The Applicant reserves the right to suspend or cancel a domain for violation of the Registry’s Acceptable Use Policy.

15. Abuse Response Process

The Registry is committed to ensuring that those domain names associated with abuse or malicious conduct in violation of the Acceptable Use Policy are dealt with in a timely and decisive manner. These include taking action against those domain names that are being used to threaten the stability and security of the gTLD, or are part of a real-time investigation by law enforcement. 
Once a complaint is received from a trusted source, third-party, or detected by the Registry, the Registry will use commercially reasonable efforts to verify the information in the complaint. If that information can be verified to the best of the ability of the Registry, the sponsoring Registrar will be notified and be given 48 hours to investigate the activity. This will result in either the take down of the domain name by placing the domain name on hold or the deletion of the domain name in its entirety or providing a compelling argument to the Registry to keep the name in the zone. If the Registrar has not taken the requested action after the 48-hour period (i.e., is unresponsive to the request or refuses to take action), the Registry may place the domain on “ServerHold”. Although this action removes the domain name from the gTLD zone, the domain name record still appears in the gTLD WHOIS database so that the name and entities can be investigated by law enforcement should they desire to get involved.
 
Additionally, the Applicant will require Registrars to adhere to the following abuse-prevention procedures:

- Each new gTLD accredited Registrar must provide and maintain a valid primary point of contact for abuse complaints. The Applicant will require this as part of the new gTLD RRA.
- The Applicant will explicitly define for Registrars what constitutes abusive behaviour including but not limited to, malicious, negligent, and reckless behaviour. The definition of abusive behaviour will be contained in the AUP and the Applicant will require this as part of the new gTLD RRA.
- Registrars must notify the Registry Operator immediately regarding any investigation or compliance action including the nature of the investigation or compliance action by ICANN or any outside party (e.g., law enforcement, etc.), along with the gTLD impacted. This will be required as part of the new gTLD RRA.
- The Applicant will initiate an Abuse Prevention and Mitigation Working Group. This group will be developed in conjunction with the gTLD Governance Council mentioned above. Its aim will be to give the Applicant’s team alternate perspectives about handling incidents of abuse and ways to mitigate them. The group will meet regularly to discuss the latest trends in domain name abuse and the most effective way to prevent and remedy them for the gTLD.
-end-

Q29
The Applicant will be implementing an extensive range of Rights Protection Mechanisms (“RPMs”) designed to minimize abusive registrations and other activities that may affect the legal rights of others. The Applicant will implement and comply with all ICANN required RPMs and will in addition implement further measures to better protect the rights of others and minimize abusive registrations.

The following is an overview of Applicantʹs response to Q29:

1. Rights Protection as a core objective
2. Plans for Rights Protection Mechanisms as part of Start-Up
3. ICANN Mandated Rights Protection Mechanisms
3.1. Trademark Clearinghouse (“TMCH”)
3.2. Applicant’s Sunrise Period (“ASP”)
3.3. Trademark Claims Service (“TCS”)
3.4. Uniform Domain Name Dispute Resolution Policy (“UDRP”)
3.5. Uniform Rapid Suspension System (ʺURSʺ)
3.6. Trademark Post-Delegation Dispute Resolution Procedure (“PDDRP”)
4. Additional Rights Protection Mechanisms to be implemented by the Applicant on a Voluntary Basis
4.1. Mechanism to protect IGO Names (“PIN”)
4.2. Mechanism for Further Protection of Capital City Names (“CCC”)
4.3. Abuse Prevention and Mitigation Seal (“APM Seal”)
5. Efforts to promote WHOIS Accuracy
5.1. Thick WHOIS
5.2. Semi Annual Audits to Ensure Accurate WHOIS
6. Policies Handling Complaints Regarding Abuse and Rights Issues
7. Registry Acceptable Use Policy(“AUP”)
8. Monitoring for Malicious Activity
9. Resourcing Plans Specific to Backend Registry Activities
10. Registry Backend Services Provider Experience with Rights Protection Measures


1 Rights Protection as a core objective
The Applicant is firmly committed to the protection of Intellectual Property rights and to implementing the mandatory RPMs contained in the Applicant Guidebook and detailed in Specification 7 of the Registry Agreement. Use of domain names that infringe upon the legal rights of others in the gTLD will not be tolerated and preventing abusive registrations is a core objective of the Applicant. The nature of such uses creates security and stability issues for the Registry, Registrars, and Registrants, as well as for users of the Internet in general. The Applicant will prevent abusive registrations and reduce opportunities for behaviours such as phishing or pharming by implementing comprehensive registration, anti-abuse, and rights protection guidelines as defined in its AUP, as well as innovative additional RPMs such as PIN and the CCC, as described below. In order to identify and address the abusive use of registered names on an ongoing basis, the Applicant will also incorporate and abide by all mandated RPMs as specified in Specification 7 of the Registry Agreement and as adopted by the ICANN Board of Directors as ICANN Consensus Policies.

2 Plans for Rights Protection Mechanisms as part of Start-Up

The timeline for start-up RPMs in the Applicantʹs gTLD is as follows:

Phase 1 – Sunrise Process:

- Day 1: Sunrise round opens
- Day 60: Sunrise round Closes
- Day 61: Sunrise Allocation including Contention Resolution Mechanisms (ʺCRMʺ) opens
- Day 71: Sunrise Allocation CRM closes

- The following Rights Protection Mechanisms apply: 
 a. TMCH
 b. Sunrise Eligibility Requirements (“SER”)
 c. Sunrise Dispute Resolution Policy (“SDRP”)
 d. UDRP
 e. URS
 f. PIN
 g. TCS*

Phase 2 – Landrush process:

- Day 72: Landrush opens
- Day 102: Landrush closes
- Day 103: Landrush CRM opens
- Day 113: Landrush CRM closes

- The following Rights Protection Mechanisms apply:
 a. UDRP
 b. URS
 c. PIN
 d. CCC
 e. TCS*

Phase 3 – General Availability⁄Registrations:

- Day 114: General availability begins

- The following Rights Protection Mechanisms apply:
 a. UDRP
 b. URS
 c. PIN
 d. PDDRP 
 e. TCS* (90 days)

* To ease the concerns of trademark owners and mitigate the impact of infringing registrations, the Applicant will be implementing the Trademark Claims service in all three phases of launch. It is important to note that during the General Availability Phase, the Trademark Claims service will be used for 90 days, 30 days longer than the ICANN mandated minimum.

3 ICANN Mandated Rights Protection Mechanisms

3.1 Trademark Clearinghouse (“TMCH”)
The first mandatory RPM required of each new gTLD Registry is support for, and interaction with, the TMCH. The TMCH is intended to serve as a central repository for information pertaining to the rights of trademark holders to be authenticated, stored, and disseminated. The data maintained in the clearinghouse will support and facilitate other RPMs, including the mandatory Sunrise Period and Trademark Claims service. Although the operational details of how the TMCH will interact with Registry operators and Registrars are still being developed by ICANN, the Applicant is actively monitoring the developments of the Implementation Assistance Group (“IAG”). The IAG is working with ICANN staff to refine and finalize the rules, procedures and technical requirements for the TMCH. In addition, the gTLD’s Registry Backend Services Provider is actively participating in the IAG to ensure that the protections afforded by the clearinghouse and associated RPMs are feasible, implementable, and well understood.

Utilizing the TMCH, the Applicant will offer: (i) a Sunrise registration service for 60 days during the pre-launch phase giving eligible trademark owners an early opportunity to register second-level domains in new gTLDs; and (ii) a TCS in all 3 phases of launch including 90 days after phase 3 general availability.

3.2 Applicant’s Sunrise Period (“ASP”)
All domain names registered during the Sunrise Period will be subject to the Applicant’s domain name registration policy. The Applicant will surpass ICANNʹs mandated minimum by offering a Sunrise Period for sixty (60) days. Owners of trademarks listed in the TMCH that also meet the Applicant’s domain name registration requirements will be able to register domain names that are an identical match of their listed trademarks. The Applicant has engaged Famous Four Media Limited (“FFM”) as well as other suppliers to assist with this process. The FFM Sunrise Validation Team will consist of a minimum of 11 employees who will work with the Applicant’s Trademark Validation Team (“TVT”) and outside counsel, to receive and authenticate all Sunrise registrations.

Registrars who are accredited to sell names in the gTLD will ensure that all Sunrise Registrants meet SERs, which will be verified by Clearinghouse data. The proposed SERs include: (i) ownership of a mark that is (a) nationally or regionally registered and for which proof of use, such as a declaration and a single specimen of current use – was submitted to, and validated by, the TMCH; or (b) that have been court-validated; or (c) that are specifically protected by a statute or treaty currently in effect and that was in effect on or before 26 June 2008, (ii) optional Registry-elected requirements regarding the international class of goods or services covered by registration; (iii) representation that all provided information is true and correct; and (iv) provision of data sufficient to document rights in the trademark. 

Upon submission of all of the required information and documentation, the Registrar will forward the information to the Applicant’s TVT for authentication. The Applicant’s TVT will review the information and documentation and verify the trademark information and registration eligibility, and notify the potential registrant of any deficiencies. 

The Applicant will also incorporate a SDRP. The SRDP will allow challenges to Sunrise Registrations by third parties after acceptance of the registration based on the following four grounds: (i) at the time the challenged domain name was registered, the registrant did not hold a trademark registration of national or regional effect or the trademark had not been court-validated or protected by statute or treaty; (ii) the domain name is not identical to the mark on which the registrant based its Sunrise registration; (iii) the trademark registration on which the registrant based its Sunrise registration is not of national or regional effect or the trademark had not been court-validated or protected by statute or treaty; or (iv) the trademark registration on which the domain name registrant based its Sunrise registration did not have the necessary protections on or before the effective date of the Registry Agreement.

After receiving a Sunrise Complaint, the TVT will review the Complaint to see if the Complainant reasonably asserts a legitimate challenge as defined by the SDRP. If not, the TVT will send a notice to the Complainant that the complaint does not fall within one of the delineated grounds as defined by the SDRP and that the Applicant considers the matter closed.

If the domain name is found to not meet the SERs, the TVT will immediately suspend the domain name. Thereafter, the TVT will immediately notify the Sunrise Registrant of the suspension of the domain name, the nature of the complaint, and provide the registrant with the option to correct the SER deficiencies in a timely manner or the domain name will be cancelled. 

If the registrant responds in a timely manner, the response will be reviewed by the TVT to determine if the SERs are met. If the TVT is satisfied by the registrant’s response, the TVT will submit a request to lift the suspension of the domain name and notify the Complainant that their dispute was denied. If the registrant does not respond in a timely manner, the TVT will then notify the Complainant that the complaint was upheld and the registration will be cancelled.

3.3 Trademark Claims Service
The Applicant will offer a TCS in Sunrise and Landrush as well as 90 days of general registration (30 days longer than the ICANN mandated minimum period.) The TCS will be monitored by the TVT. Registrars who are accredited to sell names in the gTLD will be required to review all domain names requested to be registered during the Trademark Claims period to determine if they are an identical match of a trademark that has been filed with the TMCH. A domain name will be considered an identical match when the domain name consists of the complete and identical textual elements of the mark, and includes domain names where (a) spaces contained within a mark are either replaced by hyphens or omitted; (b) certain special characters contained within a trademark are spelled out with appropriate words describing it (e.g., @ and &); and (c) punctuation or special characters contained within a mark that are unable to be used in a second-level domain name are either (i) omitted or (ii) replaced by hyphens or underscores. Domain names that are plural forms of a mark or that merely contain a mark as a sub string will not qualify as an identical match.

If the Registrar determines that a prospective domain name registration is identical to a mark registered in the TMCH, the Registrar will be required to ensure that a “Trademark Claims Notice” (“Notice”) in English is sent to the prospective registrant of the domain name and a blind copy is sent to the Applicant’s TVT. The Notice will provide the prospective registrant with information regarding the trademark referenced in the notice to enhance understanding of the Trademark rights being claimed by the trademark holder. The Notice will be provided in real time without cost to the prospective registrant. 

After sending the Notice, the Registrar will require the prospective registrant to specifically warrant within five (5) days that: (i) the prospective registrant has received notification that the mark(s) is included in the Clearinghouse; (ii) the prospective registrant has received and understood the notice; and (iii) to the best of the prospective registrant’s knowledge that the registration and use of the requested domain name will not infringe on the rights that are the subject of the notice. If the warranty satisfies these requirements, the Registrar will effectuate the registration and notify the Applicant’s TVT. 

After the effectuation of a registration that is identical to a mark listed in the TMCH, the Registrar will be required to notify the trademark owner that a domain name representing the listed mark has been registered. A copy of this communication will also be sent to the TVT. The trademark owner then has the option of filing a Complaint under the UDRP and the URS against the domain name registrant. The Applicant will require in its relevant agreements that the Registry, Registrar, and registrant all submit to and abide by the determinations of the UDRP and the URS providers.

3.4 Uniform Domain Name Dispute Resolution Policy
The Applicant will abide by all decisions rendered by UdrpP providers and will specify in its Registry Registrar Agreement (ʺRRAʺ) and Registration Agreements (ʺRAʺ) that all parties must also abide by all decisions made by panels in accordance with the UDRP. On the Applicant’s Registry website, the Applicant will designate a Rights Protection Contact (“Rights Contact”) which will receive all UDRP Complaints and decisions. Upon receipt of a determination, the Rights Contact will work with technical staff at the Registry Backend Services Provider to temporarily lock any domain names as required, and will notify the appropriate Registrar to cancel or transfer all registrations determined by a UDRP panel to be infringing. 

3.5 Uniform Rapid Suspension System
The Applicant will implement the URS as provided in the Applicant Guidebook. The Applicant will also specify in its RRA that all parties abide by all decisions made by panels in accordance with the URS. In response to complaints made by trademark owners that the UDRP was too cost prohibitive and slow, and that more than 70 percent of UDRP cases were “clear cut” cases of cybersquatting, ICANN adopted the Implementation Review Team’s (ʺIRTʺ) recommendation that all new gTLD registries be required, pursuant to their contracts with ICANN, to take part in a URS. The purpose of the URS is to provide a more cost effective and timely mechanism for brand owners than the UDRP to protect their trademarks and to promote consumer protection on the Internet. 
The URS is not meant to address questionable cases of alleged infringement (e.g., use of terms in a generic sense) or for anti-competitive purposes or denial of free speech, but rather for those cases in which there is no genuine contestable issue as to the infringement and abuse that is taking place. 
Unlike the UDRP which requires little involvement of gTLD registries, the URS envisages much more of an active role at the Registry-level. For example, rather than requiring the Registrar to lock down a domain name subject to a UDRP dispute, under the URS it is the Registry that must lock the domain within 24 hours of receipt of the complaint from the URS Provider to restrict all changes to the registration data, including transfer and deletion of the domain names. 
The Rights Contact will receive all URS Complaints verified by the URS Provider and provide its contact information. In the event of a decision in favour of the complainant, the Registry is required to suspend the domain name. This suspension remains in effect for the remainder of the registration period and would not resolve the original website. The nameservers would be redirected to an informational web page describing the URS Process. The WHOIS for that domain will state that the domain name will not be able to be transferred, deleted, or modified for the life of the registration. Finally, there is an option for a successful complainant to extend the registration period for one additional year at commercial rates. Upon receipt of a decision in the registrant’s favour, Rights Contact will notify the Registry operator to unlock the domain name.

3.6 Trademark Post-Delegation Dispute Resolution Procedure (“PDDRP”)
The Applicant will participate in all post-delegation procedures required by the Registry agreement, including the PDDRP, and will abide by any decisions of any PDDRP Provider as required in Specification 7 of the Registry Agreement.


4 Additional Rights Protection Mechanisms to be implemented by the Applicant

4.1 Mechanism to Protect IGO Names
The Applicant considers the Protection of Intergovernmental Organization (ʺIGOʺ) names to be very important. The Applicant will use strings registered as second level domains in the .int gTLD as the basis for this protection. To register in the .int domain, the Registrants must be an IGO that meets the requirements found in RFC 1591. The .int domain is used for registering organizations established by international treaties between or among national governments and which are widely considered to have independent international legal personality. Thus, the names of these organizations, as with geographic names, can lend an official imprimatur, and if misused, be a source of public confusion or deception. 

Reservation of IGO names:
In addition to the mandated and additional reservation of geographic names as provided for in response to Question 22, the Applicant will reserve, and thereby prevent registration of, all names that are registered as second level domains in the most recent .int zone as of 1st November 2012. By doing so, the Applicant will extend additional protection to IGOs that comply with the current eligibility requirements for the .int gTLD as defined at http:⁄⁄www.iana.org⁄domains⁄int⁄policy⁄, and that have obtained a second-level registration in the .int zone. 

Release of IGO names:
In the future, should any of the IGOs wish to make use of the protected strings, the Registry will release and assign the domain to the respective IGOs using the following process:

a)The IGO submits a request to the Applicant in the hope of the reserved name being assigned to themselves and provides the necessary documentation and details of the proposed registrant entity for the domain name registration.
b)The Applicant will validate and authenticate the request to establish that it is a genuine bona fide request.
c)Once the request has been approved the Applicant will notify the requesting IGO as well as ICANN and the GAC of the approval for the assignment of the domain name.
d)The Applicant will issue a unique authorization code to the proposed IGO registrant.
e)The proposed IGO registrant will then be able to request that the assignment of the domain name is given to them using the authorization code with an ICANN and gTLD accredited Registrar of their choice.

4.2 Mechanism for Further Protection of Capital City Names
In parallel with the Landrush Period defined in the answer to question 18, the Applicant will implement a Capital City Claim (CCC) service whereby additional protection will be granted to the capital city names of a country or territory listed in the ISO 3166-1 standard. The CCC process is as follows:
a)Any prospective domain name registrant applying to register a domain name identical to the capital city name of a country or territory listed in the ISO 3166-1 standard will receive from the Applicant a CCC notification highlighting the fact that the applied-for domain name matches a capital city name of a country or territory listed in the ISO 3166-1 standard. 
b)A potential domain name registrant receiving a CCC notification will have to send a response to the Applicant whereby they will agree to unconditionally comply with requirements as to representations and warranties required by the Applicant in order to protect the reputation of the capital city as well as any further relevant terms and conditions provided.
c)Unconditional acceptance of the warranties set out in the CCC notification will be a material requirement for a prospective registrant to be eligible to register the domain name in question should said prospective registrant be successful in the Landrush period.
d)Upon registration during the Landrush period of a domain name identical to a capital city name of a country or territory listed in the ISO 3166-1 standard, the Applicant will send a notification in writing to the ICANN Government Advisory Committee (ʺGACʺ) Chair.

4.3 Abuse Prevention and Mitigation Seal
The Applicant has developed an Abuse Prevention and Mitigation Seal (ʺAPM Sealʺ) to further augment the security and stability of its gTLD. The APM Seal will provide users, rights holders, etc., with a direct link to an Abuse Prevention and Mitigation Reporting Website (“APM Reporting Website”), which contains a clear description and instructions that will provide the inquiring party with guidance on how to report infringement or other abusive conduct, including but not limited to the conduct identified in response to Question 28 to the Registry and relevant authorities. This will allow the user a direct and practical means of pursuing any complaints it may have.

The Applicant will implement a Governance Council, which will lead the policy development process of defining how the APM Reporting Website should best reflect the options users, rights holders, etc., have for addressing infringing content or other issues. 


The APM Seal will operate as follows:

a)The Registrant will be required to agree to the Applicantʹs AUP as part of the Registration process for the second-level domains. 
b)The Terms and Conditions will require the Registrant to include the APM Seal in a prominent place on its website.
c)Following the registration, the Registry will automatically email the Registrant’s Administrative, Technical, and Billing contacts with an additional notification that the APM Seal needs to be included on the Registrant’s homepage. The Registrant has 120 days from the date of registration (the “Grace Period”) to effectuate the fixing of the APM seal.
d)During the Grace Period, the domain registration will be flagged in WHOIS or a linked system as being in the APM Seal Grace Period.
e)When the APM Seal has been activated, the second-level domain will have the APM Seal marked as active in WHOIS or a linked system.
f)If the Registrant does not activate the APM Seal before the Grace Period expires, the domain name will be flagged as being out of the Grace Period for the APM Seal activation and the Registry will notify the Registrant’s Administrative, Technical, and Billing contacts that this APM Seal activation is out of its Grace Period. The Registrant has an additional 30 days to include the APM Seal on the homepage or the site is flagged as in breach of the Registration terms.
g)Should the registrant fail to comply and activate the APM Seal within the period specified in the AUP, the Registry will conduct an investigation on that domain. If after the investigation it is determined that the domain is in breach of the AUP the Registry reserves the right to suspend and cancel the domain. 
h)Exceptions include, but are not limited to situations where a Registrar has a second-level domain that is:

(a) Used for forwarding to another domain, 
(b) Not used for a website, 
(c) Currently not in use, or 
(d) There is another reason why the seal cannot technically be included

If a site is listed to be in any of these exception states and then the use of the domain changes to a state that would require the APM Seal, the Registrant must then change the domainʹs status to comply with the AUP. The Registry will conduct an investigation to ensure compliance with the policy upon notification that a site is out of compliance via the Rights Contact. If after the investigation it is determined that the domain is in breach of the AUP the Registry reserves the right to suspend and cancel the domain.

5 Efforts to promote WHOIS Accuracy

5.1. Thick WHOIS
The Applicant will include a thick searchable WHOIS database both accessible on port 43 as well as on port 80 (http) as required in Specification 4 of the Registry Agreement. A thick WHOIS provides numerous advantages including a centralized location of registrant information, the ability to more easily manage and control the accuracy of data, and a consistent user experience, as well as greater transparency, a factor critical to rights holders as well as law enforcement in pursuing abusive uses of a domain.

5.2. Bi-Annual Audits to Ensure Accurate WHOIS
The Applicant’s TVT will perform a bi-annual review of a random sampling of domain names within the applied-for gTLD to test the accuracy and authenticity of the WHOIS information. Through this review, the Applicant’s TVT will examine the WHOIS data for evidence of inaccurate or incomplete Whois information. In the event that such errors or missing information exists, it shall be forwarded to the Registrar, who shall be required to address such deficiencies with its Registrants. 

6 Policies Handling Complaints Regarding Abuse and Rights Issues
In addition to the RPMs addressed above, the Applicant will implement a number of measures to handle complaints regarding the abusive registration of domain names in its gTLD that may infringe on the rights of others. Further details are described in the response to Question 28.

7 Registry Acceptable Use Policy
One of the key policies each new gTLD Registry needs is to have an AUP that clearly delineates the types of activities that constitute “abuse” and the repercussions associated with an abusive domain name registration. The policy must be incorporated into the applicable Registry-Registrar Agreement and reserve the right for the Registry to take the appropriate actions based on the type of abuse. This may include locking down the domain name preventing any changes to the contact and nameserver information associated with the domain name, placing the domain name “on hold” rendering the domain name non-resolvable, transferring the domain name to another Registrar, and⁄or in cases in which the domain name is associated with an existing law enforcement investigation, substituting name servers to collect information about the DNS queries to assist the investigation. The gTLD’s AUP, set forth in our response to Question 28, will include prohibitions on phishing, pharming, dissemination of malware, fast flux hosting, hacking, and child pornography. In addition, the policy will include the right of the Registry to take action necessary to deny, cancel, suspend, lock, or transfer any registration in violation of the policy. 
In addition, the Applicant reserves the right to deny attempted registrations from repeat violators of the Registry’s AUP. The Registry’s AUP will incorporate a certification by the registrant that the domain will be used only for licensed, legitimate activities, and not to facilitate piracy or infringements. The registrant will be required to accept these terms as part of its registration agreement. The Applicant reserves the right to suspend or cancel a domain for violation of the Registry’s AUP.

8 Monitoring for Malicious Activity 
The Applicant is committed to ensuring that those domain names associated with abuse or malicious conduct in violation of the AUP are dealt with in a timely and decisive manner. These include taking action against those domain names that are being used to threaten the stability and security of the gTLD, or are part of a real-time investigation by law enforcement. 
Once a complaint is received or detected by the Registry, the Registry will use commercially reasonable efforts to verify the information in the complaint. If that information can be verified to the best of the ability of the Registry, the sponsoring Registrar will be notified and be given 12 hours to investigate the activity and either take down the domain name by placing the domain name on hold or by deleting the domain name in its entirety, or to provide a compelling argument to the Registry to keep the name in the zone. If the Registrar has not taken the requested action after the 12-hour period (i.e., is unresponsive to the request or refuses to take action), the Registry may place the domain on “ServerHold”. Although this action removes the domain name from the gTLD zone, the domain name record still appears in the gTLD WHOIS database so that the name and entities can be investigated by law enforcement should they desire to get involved.

9 Resourcing Plans Specific to Backend Registry Activities
Responsibility for rights protection rests with a variety of functional groups. The Trademark Validation Team and Sunrise Validation Teams are primarily responsible for investigating claims of marks for domain registration. The customer service team also plays an important role in assisting with the investigations, responding to customers, and notifying Registrars of abusive domains. Finally, the Policy⁄Legal team is responsible for developing the relevant policies and procedures. 

The rights protection mechanisms described in the response above involve a wide range of tasks, procedures, and systems. The responsibility for each mechanism varies based on the specific requirements. In general the development of applications such as sunrise and IP claims is the responsibility of the Engineering team, with guidance from the Product Management team. Customer Support and Legal play a critical role in enforcing certain policies such as the rapid suspension process. These teams have very substantial experience implementing these or similar processes. 
The necessary resources will be pulled from the pool of available resources described in detail in the response to Question 31. The following resources will be made available:
-Development⁄Engineering – 19 people
-Product Management - 4 people
-Customer Support – 12 people
The resources are more than adequate to support the rights protection mechanisms of the Registry. 

Administrative Services Provider – Famous Four Media Limited

In addition to those resources set out above provided by the Registry’s backend services provider the Applicant‘s Administration Services Provider shall provide the following extra resources:
-Sunrise Validation Team - This shall comprise of 11 employees of which at least one shall be a qualified lawyer specializing in intellectual property law.
-Ongoing Rights Protection Team - This shall comprise of 11 employees of which at least one shall be a qualified lawyer specializing in intellectual property law.
The two key objectives of the Sunrise Validation Team and the Ongoing rights Protection Team (together the “Rights Team”) is to:

a)Prevent abusive registrations; and
b)Identify and address the abusive use of registered names on an ongoing basis
Given that rights protection is a fundamental core objective of the Applicant it has contracted with its Registry Administration Services Provider that the number of full time personnel made available to the Applicant will be 125% of the estimated requirement to ensure that at all times the Applicant is over resourced in this area.
In addition the Applicant shall instruct outside Counsel in any relevant jurisdiction on all matters that are unable to be adequately dealt with by the Sunrise Validation Team or the Ongoing Rights Protection Team.

10 Registry Backend Services Provider Experience with Rights Protection Measures
The gTLD’s Registry Backend Services Provider, Neustar Inc., has already implemented Sunrise and⁄or Trademark Claims programs for numerous gTLDs including .biz, .us, .travel, .tel and .co and will implement both of these services on behalf of the Applicant.

Neustar’s Experience with Sunrise Process:
In early 2002, Neustar became the first Registry operator to successfully launch an authenticated Sunrise process. This process permitted qualified trademark owners to pre-register their trademarks as domain names in the .us gTLD space prior to the opening of the space to the general public. Unlike any other “Sunrise” plans implemented or proposed before that time, Neustar validated the authenticity of trademark applications and registrations with the United States Patent and Trademark Office (USPTO). 
As the back-end Registry operator for the .tel gTLD and the .co ccTLD, Neustar launched a validated Sunrise program employing processes that are very similar to those that will be used by the TMCH for new gTLDs. 
Below is a high level overview of the implementation of the .co Sunrise period and the Trademark Claims service that was part of the .biz launch. Neustar’s experience in each of these RPMs will enable it to seamlessly provide these services on behalf of the Applicant as required by ICANN. 
Sunrise and .co
The Sunrise process for .co was divided into two sub-phases: 
- Local Sunrise giving holders of eligible trademarks that have obtained registered status from the Colombian trademark office the opportunity to apply for the .co domain names corresponding with their marks. 
- Global Sunrise program giving holders of eligible registered trademarks of national effect, that have obtained a registered status in any country of the world the opportunity to apply for.co domain names corresponding with their marks for a period of time before registration is open to the public at large. 
Like the new gTLD process set forth in the Applicant Guidebook, trademark owners had to have their rights validated by a Clearinghouse provider prior to the registration being accepted by the Registry. The Clearinghouse used a defined process for checking the eligibility of the legal rights claimed as the basis of each Sunrise application using official national trademark databases and submitted documentary evidence. 
Applicants and⁄or their designated agents had the option of interacting directly with the Clearinghouse to ensure their applications were accurate and complete prior to submitting them to the Registry via an optional “Pre-validation Process”. Regardless of whether an Applicant was “pre-validated”, all Applicants had to submit their corresponding domain name applications through a .co accredited Registrar. When the Applicant was pre-validated through the Clearinghouse, they were given an associated approval number that had to be supplied to the Registry. If Applicants were not pre-validated, they were required to submit the necessary trademark information through their Registrar to the Registry.
At the Registry level, Neustar, subsequently either delivered the: 
- Approval number and domain name registration information to the Clearinghouse, or
- When there was no approval number, trademark information and the domain name registration information was provided to the Clearinghouse through EPP (as is currently required under the Applicant Guidebook). 
Information was then used by the Clearinghouse for further validation of those pre-validated applications, or initial validation of those that did not select pre-validation. If the Applicant was validated and their trademark matched the domain name applied for, the Clearinghouse communicated that fact to the Registry via EPP. 
When there was only one validated sunrise application for a domain name, the application proceeded to registration when the .co launched. If there were multiple validated applications for the same domain name (recognizing that there could be multiple trademark owners sharing the same trademark), those were processed via the .co Sunrise auction process. Neustar tracked all of the information it received and the status of each application on a secure Website to enable trademark owners to view the status of their Sunrise application. 
Although the exact process for the Sunrise program and its interaction with trademark owners, Registry, Registrars, and TMCH is not finalized at the time of the application, Neustar’s expertise in launching multiple Sunrise processes and its established software will ensure a smooth and compliant Sunrise process for the new gTLDs.
a) Trademark Claims Service Experience
When Neustar’s .biz gTLD launched in 2001, Neustar became the first gTLD with a Trademark Claims (“TC”) service. Neustar developed the TC Service by enabling companies to stake claims to domain names prior to the commencement of live .biz domain registrations. 
During the TC process, Neustar received over 80,000 TC from entities around the world. Recognizing that multiple intellectual property owners could have trademark rights in a particular mark, multiple TC for the same string were accepted. All applications were logged into a TC database managed by Neustar. 
The Trademark Claimant was required to provide various information about their trademark rights, including the:
- Particular trademark or service mark relied on for the trademark Claim
- Date a trademark application on the mark was filed, if any, on the string of the domain name
- Country where the mark was filed, if applicable
- Registration date, if applicable
- Class or classes of goods and services for which the trademark or service mark was registered
- Name of a contact person with whom to discuss the claimed trademark rights. 
Once all TC and domain name applications were collected, Neustar then compared the claims contained within the TC database with its database of collected domain name applications (DNAs). In the event of a match between a TC and a domain name application, an e-mail message was sent to the domain name Applicant notifying the Applicant of the existing TC. The e-mail also stressed that if the Applicant chose to continue the application process and was ultimately selected as the registrant, the Applicant would be subject to Neustar’s dispute proceedings if challenged by the Trademark Claimant for that particular domain name. 
The domain name Applicant had the option to proceed with the application or cancel the application. Proceeding with an application meant that the Applicant wanted the application to proceed to registration despite having been notified of an existing Trademark Claim. By choosing to “cancel,” the Applicant made a decision in light of an existing TC notification to not proceed. 
If the Applicant did not respond to the e-mail notification from Neustar, or elected to cancel the application, the application was not processed. This prevented the Applicant from registering the actual domain name. If the Applicant affirmatively elected to continue the application process after being notified of the claimant’s (or claimants’) alleged trademark rights to the desired domain name, Neustar processed the application. 
This process is very similar to the one ultimately adopted by ICANN and incorporated in the latest version of the Applicant Guidebook. Although the collection of TC for new gTLDs will be by the TMCH, many of the aspects of Neustar’s TC process in 2001 are similar to those in the Applicant Guidebook. This makes Neustar uniquely qualified to implement the new gTLD TC process.
Neustar was also a key contributor to the development of the Uniform Dispute Resolution Policy (“UDRP”) in 1998. This became the first “Consensus Policy” of ICANN and has been required to be implemented by all domain name registries since that time. The UDRP is intended to be an alternative dispute resolution process to transfer domain names from those that have registered and used domain names in bad faith. Although there is not much of an active role that the domain name Registry plays in the implementation of the UDRP, Neustar has closely monitored UDRP decisions that have involved the gTLDs which it supports and ensures that the decisions are implemented by the Registrars supporting its gTLDs.
-end-

Q30A
The Applicant and our back-end operator, Neustar, recognize the vital need to secure the systems and the integrity of the data in commercial solutions. The Applicant’s registry solution will leverage industry-best security practices including the consideration of physical, network, server, and application elements.

The Applicant and Neustar’s approach to information security starts with comprehensive information security policies. These are based on the industry best practices for security including SANS (SysAdmin, Audit, Network, Security) Institute, NIST (National Institute of Standards and Technology), and Center for Internet Security (CIS). Policies are reviewed annually by Neustar’s information security team.

The following is a summary of the security policies that will be used in the Applicant’s registry, including:

1. Summary of the security policies used in the registry operations
2. Description of independent security assessments
3. Description of security features that are appropriate for the TLD
4. List of commitments made to registrants regarding security levels

All of the security policies and levels described in this section are appropriate for the Applicant’s registry.

30(a).1 Summary of Security Policies 
Neustar, Inc. has developed a comprehensive Information Security Program in order to create effective administrative, technical, and physical safeguards for the protection of its information assets, and to comply with Neustarʹs obligations under applicable law, regulations, and contracts. This Program establishes Neustarʹs policies for accessing, collecting, storing, using, transmitting, and protecting electronic, paper, and other records containing sensitive information.

The Program defines:
- The policies for internal users and our clients to ensure the safe, organized and fair use of information resources.
- The rights that can be expected with that use. 
- The standards that must be met to effectively comply with policy.
- The responsibilities of the owners, maintainers, and users of Neustar’s information resources.
- Rules and principles used at Neustar to approach information security issues

The following policies are included in the Program:

1. Acceptable Use Policy
The Acceptable Use Policy provides the “rules of behavior” covering all Neustar Associates for using Neustar resources or accessing sensitive information.

2. Information Risk Management Policy
The Information Risk Management Policy describes the requirements for the on-going information security risk management program, including defining roles and responsibilities for conducting and evaluating risk assessments, assessments of technologies used to provide information security and monitoring procedures used to measure policy compliance.

3. Data Protection Policy 
The Data Protection Policy provides the requirements for creating, storing, transmitting, disclosing, and disposing of sensitive information, including data classification and labeling requirements, the requirements for data retention. Encryption and related technologies such as digital certificates are also covered under this policy.

4. Third Party Policy
The Third Party Policy provides the requirements for handling service provider contracts, including specifically the vetting process, required contract reviews, and on-going monitoring of service providers for policy compliance.

5. Security Awareness and Training Policy
The Security Awareness and Training Policy provide the requirements for managing the on-going awareness and training program at Neustar. This includes awareness and training activities provided to all Neustar Associates.

6. Incident Response Policy
The Incident Response Policy provides the requirements for reacting to reports of potential security policy violations. This policy defines the necessary steps for identifying and reporting security incidents, remediation of problems, and conducting “lessons learned” post-mortem reviews in order to provide feedback on the effectiveness of this Program. Additionally, this policy contains the requirement for reporting data security breaches to the appropriate authorities and to the public, as required by law, contractual requirements, or regulatory bodies.

7. Physical and Environmental Controls Policy
The Physical and Environment Controls Policy provides the requirements for securely storing sensitive information and the supporting information technology equipment and infrastructure. This policy includes details on the storage of paper records as well as access to computer systems and equipment locations by authorized personnel and visitors.

8. Privacy Policy
Neustar supports the right to privacy, including the rights of individuals to control the dissemination and use of personal data that describes them, their personal choices, or life experiences. Neustar supports domestic and international laws and regulations that seek to protect the privacy rights of such individuals.

9. Identity and Access Management Policy
The Identity and Access Management Policy covers user accounts (login ID naming convention, assignment, authoritative source) as well as ID lifecycle (request, approval, creation, use, suspension, deletion, review), including provisions for system⁄application accounts, shared⁄group accounts, guest⁄public accounts, temporary⁄emergency accounts, administrative access, and remote access. This policy also includes the user password policy requirements. 

10. Network Security Policy
The Network Security Policy covers aspects of Neustar network infrastructure and the technical controls in place to prevent and detect security policy violations. 

11. Platform Security Policy
The Platform Security Policy covers the requirements for configuration management of servers, shared systems, applications, databases, middle-ware, and desktops and laptops owned or operated by Neustar Associates.

12. Mobile Device Security Policy
The Mobile Device Policy covers the requirements specific to mobile devices with information storage or processing capabilities. This policy includes laptop standards, as well as requirements for PDAs, mobile phones, digital cameras and music players, and any other removable device capable of transmitting, processing or storing information.

13. Vulnerability and Threat Management Policy
The Vulnerability and Threat Management Policy provides the requirements for patch management, vulnerability scanning, penetration testing, threat management (modeling and monitoring) and the appropriate ties to the Risk Management Policy.

14. Monitoring and Audit Policy
The Monitoring and Audit Policy covers the details regarding which types of computer events to record, how to maintain the logs, and the roles and responsibilities for how to review, monitor, and respond to log information. This policy also includes the requirements for backup, archival, reporting, forensics use, and retention of audit logs.

15. Project and System Development and Maintenance Policy
The System Development and Maintenance Policy covers the minimum security requirements for all software, application, and system development performed by or on behalf of Neustar and the minimum security requirements for maintaining information systems.

30.(a).2 Independent Assessment Reports
Neustar IT Operations is subject to yearly Sarbanes-Oxley (SOX), Statement on Auditing Standards #70 (SAS70) and ISO audits. Testing of controls implemented by Neustar management in the areas of access to programs and data, change management and IT Operations are subject to testing by both internal and external SOX and SAS70 audit groups. Audit Findings are communicated to process owners, Quality Management Group and Executive Management. Actions are taken to make process adjustments where required and remediation of issues is monitored by internal audit and QM groups.

External Penetration Test is conducted by a third party on a yearly basis. As authorized by Neustar, the third party performs an external Penetration Test to review potential security weaknesses of network devices and hosts and demonstrate the impact to the environment. The assessment is conducted remotely from the Internet with testing divided into four phases:

- A network survey is performed in order to gain a better knowledge of the network that was being tested
- Vulnerability scanning is initiated with all the hosts that are discovered in the previous phase
- Identification of key systems for further exploitation is conducted
- Exploitation of the identified systems is attempted.

Each phase of the audit is supported by detailed documentation of audit procedures and results. Identified vulnerabilities are classified as high, medium and low risk to facilitate management’s prioritization of remediation efforts. Tactical and strategic recommendations are provided to management supported by reference to industry best practices.

30.(a).3 Augmented Security Levels and Capabilities
The Applicant and its backend provider Neustar will provide the same high level of security provided across all of the registries it manages. 

A key to Neustar’s Operational success is Neustar’s highly structured operations practices. The standards and governance of these processes: 
- Include annual independent review of information security practices 
- Include annual external penetration tests by a third party
- Conform to the ISO 9001 standard (Part of Neustar’s ISO-based Quality Management System)
- Are aligned to Information Technology Infrastructure Library (ITIL) and CoBIT best practices
- Are aligned with all aspects of ISO IEC 17799
- Are in compliance with Sarbanes-Oxley (SOX) requirements (audited annually)
- Are focused on continuous process improvement (metrics driven with product scorecards reviewed monthly).

A summary view to Neustar’s security policy in alignment with ISO 17799 can be found in section 30.(a).4 below.

BITS Recommendations
The Applicant will structure its policies around the BITS Recommendations where relevant to this gTLD. 

The Applicants goal with this gTLD is to provide a safe and secure browsing experience for consumers of this gTLD. A domain within this gTLD that is owned, operated by or compromised by a malicious party could cause harm to consumers, to the TLD’s reputation and to the reputation of the Internet itself. As such, additional controls are in place relating to the validity of registrations, as well as additional measures to ensure the correct identity of both Registrants and Registrars relating to changes made within the SRS, and to protecting the integrity of the DNS service as a whole.

The Security Standards Working Group (SSWG) formed by BITS drafted a set of policy recommendations that should be applied to financial TLDs. The policy comprises of a set of 31 recommendations that should be adopted by ICANN in evaluating any applicant of a financial TLD. The recommendations were posted by BITS in the form of a letter to ICANN at [http:⁄⁄www.icann.org⁄en⁄correspondence⁄aba-bits-to-beckstrom-crocker-20dec11-en.pdf]

We welcome the recommendations from SSWG and will strongly consider the recommendations relating to the implementation of this gTLD where considered relevant. 
Coalition for Online Accountability (“COA”) Recommendations

The Applicant will structure its policies around the COA Recommendations where relevant to this gTLD.

The Applicant’s goal with this gTLD is to provide a safe and secure browsing experience for consumers of this gTLD. A domain within this gTLD that is owned, operated by or compromised by a malicious party could cause harm to consumers, to the gTLDʹs reputation and to the reputation of the Internet itself. As such, additional controls are in place relating to the validity of registrations, as well as additional measures to ensure the correct identity of both Registrants and Registrars relating to changes made within the SRS, and to protecting the integrity of the DNS service as a whole.

The Coalition for Online Accountability have drafted a set of policy recommendations, also endorsed by many other international organizations representing the creative industries, that should be applied to entertainment gTLDs - especially those dependent on copyright protection. The policy comprises of a set of 7 recommendations that should be adopted by ICANN in evaluating any applicant for an entertainment-based gTLD. The recommendations were posted by COA in the form of a letter to ICANN at http:⁄⁄bit.ly⁄HuHtmq.

We welcome the recommendations from the COA and will strongly consider the recommendations relating to the implementation of this gTLD where considered relevant.

30.(a).4 Commitments and Security Levels 
The Applicant’s registry commits to high security levels that are consistent with the needs of the TLD. These commitments include:

Compliance with High Security Standards
- Security procedures and practices that are in alignment with ISO 17799
- Annual SOC 2 Audits on all critical registry systems
- Annual 3rd Party Penetration Tests
- Annual Sarbanes Oxley Audits

Highly Developed and Document Security Policies
- Compliance with all provisions described in section 30.(a).4 below and in the attached security policy document.
- Resources necessary for providing information security
- Fully documented security policies
- Annual security training for all operations personnel

High Levels of Registry Security
- Multiple redundant data centers
- High Availability Design
- Architecture that includes multiple layers of security
- Diversified firewall and networking hardware vendors
- Multi-factor authentication for accessing registry systems
- Physical security access controls
- A 24x7 manned Network Operations Center that monitors all systems and applications
- A 24x7 manned Security Operations Center that monitors and mitigates DDoS attacks
- DDoS mitigation using traffic scrubbing technologies

We commit to the following:
– Safeguarding the confidentiality, integrity and availability of registrant’s data.
– Compliance with the relevant regulation and legislation with respect to privacy.
– Working with law enforcement where appropriate in response to illegal activity or at the request of law enforcement agencies.
– Validating requests from external parties requesting data or changes to the registry to ensure the identity of these parties and that their request is appropriate. This includes requests from ICANN.
– That access to DNS and contact administrative facilities requires multi-factor authentication by the Registrar on behalf of the registrant.
– That Registry data cannot be manipulated in any fashion other than those permitted to authenticated Registrars using the EPP or the SRS web interface. Authenticated Registrars can only access Registry data of domain names sponsored by them.
– A Domain transfer can only be done by utilizing the AUTH CODE provided to the Domain Registrant.
– Those emergency procedures are in place and tested to respond to extraordinary events affecting the integrity, confidentiality or availability of data within the registry.

The Applicant will further be implementing a thorough and extensive Abuse Prevention and Mitigation plan, designed to minimise abusive registrations and other detrimental activities that may impact security and negatively impact internet users. This plan includes the establishment of a single abuse point of contact, responsible for addressing matters requiring expedited attention and providing a timely response to abuse complaints concerning all names registered in the gTLD through all Registrars of record, including those involving a reseller. Details of this point of contact will be clearly published on the Applicant’s website. 

The following is an overview of certain other security related initiatives undertaken by the Applicant - (see response to Q28 for more detail):

- Policies and Procedures to Minimize Abusive Registrations 
- Abuse Point of Contact
- Policies for Handling Complaints Regarding the Abuse Policy
- Acceptable Use Policy (ʺAUPʺ)
- Measures for removal of Orphan Glue records
- Measures to promote Whois accuracy both directly by the Registry and by Registrars via requirements in the Registry-Registrar Agreement (“RRA”)):
 - Registry semi-annual WHOIS verification 
 - Authentication of Registrant information as complete and accurate at time of registration. 
 - Regular monitoring of registration data for accuracy and completeness
 - Registrar self-certification
 - WHOIS Data reminder processes
 - Establishing policies and procedures to ensure Registrar compliance with policies, which may include audits, financial incentives, penalties, or other means.
 - Registrar verification of WHOIS
- Policies and procedures that define malicious or abusive behavior
- Abuse Response Process 
 - Service Levels Requirements for Resolution
 - Service Levels Requirements for Law enforcement Requests
 - Coordination with Industry Groups and Law Enforcement
- Controls to ensure proper access to domain functions:
 - Enabling two-factor authentication from Registrants to process update, transfers, and deletion requests;
 - Enabling multiple, unique points of contact to request and⁄or approve update, transfer, and deletion requests;
 - Enabling the notification of multiple, unique points of contact when a domain has been updated, transferred, or deleted
- Additional Abuse Prevention and Mitigation initiatives:
 - Additional Mechanism for Protection of Capital City Names
 - Additional Mechanisms to Protect and Reserve IGO Names
- Increasing Registrant Security Awareness
- Registrant Disqualification
- Restrictions on Proxy Registration Services
- Registry Lock Option

Resourcing Plans 

The development and maintenance of the information security policies and practices are the primary responsibility of the Information Security team. As described in response to Question 31, the information security team is comprised of highly trained security professionals. They establish security policies, actively monitor for intrusions and other nefarious activity, and ensure that all Neustar employees are adhering to Neustar’s security policies and best practices. These engineers ensure that the registry data is not compromised in any way.
The necessary resources to support all of the registry’s security needs will be pulled from the pool of resources described in detail in the response to Question 31. The following resources are available from the team: 

- Information Security - 16 employees 

The resources are more than adequate to support the database needs of all the TLDs operated by Neustar, including the Applicant’s registry. 
-end-