I testified before the US House Judiciary Committee today. The topic of the hearing: ICANN and how to ensure trust and accountability in the operation of the Internet. For those who are interested, my testimony is available on the US House Judiciary Committee website.
I swung the bat pretty hard at ICANN Compliance, and highlighted some examples of registrars that turn a blind eye to online pharmacy crime. My testimony took on four domain name registrars — Gransy, WebNic, Mesh Digital, and Rebel — and showed how they have consistently refused to take action against illegal online pharmacies using their services, especially those selling prescription drugs without a prescription. Then, I showed how ICANN Compliance found that the registrars “responded appropriately” to the evidence of illegality by taking little or no observable action. (Under ICANN’s registrar accreditation scheme, registrars are bound to “investigate” and “respond appropriately” to complaints about domain names being used for illegal activity; if they do not, it is within ICANN’s ambit to penalize or de-accredit the registrar.)
To illustrate the problem, consider the website smackjunkshot.com, selling heroin online. LegitScript sent a complaint to the registrar, WebNic, which did nothing, and ICANN closed the complaint, finding that the registrar “responded appropriately” to the complaint of illegal activity. The website is still online, and still selling heroin. In essence, its ability to do so is protected, and the registrar has a green light from ICANN to keep on doing business with the website.
Against this backdrop, my primary concern is about a lack of transparency in ICANN Compliance’s process. I can live with mistakes or the occasional jaw-dropping result if ICANN Compliance is willing to say, for example, “Well, the registrar asked the registrant for pharmacy license documentation, and got this in return. This addresses the concern, right?” But what’s happening is that ICANN Compliance keeps its communications with registrars a secret, and refuses to explain what the registrar did that constitutes an “appropriate response.”
The problem here is that ICANN’s closing of these complaints against “safe haven” registrars makes it look like ICANN is giving a green light to the ongoing illegality; refusing to explain what the registrar did that supposedly constituted an “appropriate response” makes it look like ICANN is part of the cover-up.
Safe Haven Registrars Momentous and Crazy8Domains
I also swung the bat a bit at Momentous Corp., an ICANN-accredited registrar operating out of Canada. (They operate Vox Populi, the registry for .SUCKS, which was also a topic of the hearing, but I wasn’t really hitting them over that.) Currently, they are listed as having about 0.05% of the total domain name market by ICANN, but as per our data, about one in every six illegal online pharmacy domain names (17.7%) is registered with a Momentous registrar. That makes Momentous the No. 1 safe haven registrar for illegal online pharmacy domain name registrations, according to our data.
I also discussed a tiny ICANN-accredited registrar called Crazy8Domains, which has an interesting apparent connection to Momentous. (As I explain below, Momentous states that it is only a historic connection.) The registrar is notable because it has fewer than 100 domain names on average, and the majority of those that are online are consistently illegal online pharmacies. The registrar itself is actually run by a woman named Sabita Limbu, who is marred to Ioan Biris; together, the two run a now-sort-of-defunct illegal online pharmacy network called 4rx, and Ms. Limbu is the registrant for several other illegal online pharmacies that operate unlawfully. Ms. Limbu works for Crazy8Domains — I’m not entirely sure, but I suspect that she’s the sole employee — and is identified as the “legal” or “compliance” point-of-contact on ICANN’s website.
In other words, Crazy8Domains is run by the illegal online pharmacy operator, and when you try to reach out to the registrar to let them know about an illegal online pharmacy, the compliance point-of-contact runs the illegal online pharmacy. The ICANN-accredited registrar is the illegal online pharmacy, and the illegal online pharmacy is the registrar. It’s a beautiful setup, isn’t it? If you need bulletproof domain names for criminal activity, just get your own ICANN accreditation.
So what’s the tie in to Momentous? Well, that’s now somewhat less clear based on a statement released by Momentous after my testimony, but as of this writing, Rob Hall, the CEO of Momentous, is the sole registered director of Crazy8Domains, according to Canadian corporate registration data. That said, it’s important to note that Momentous stated today that they sold Crazy8Domains a couple of years ago, and that neither Mr. Hall nor Momentous have anything to do with Crazy8Domains at present, and that it’s simply a case of the corporate registration records not being updated. Over the coming weeks, hopefully we’ll be able to get some clarification on the dates of Momentous Group’s sale of Crazy8Domains, and will see how that matches up with what LegitScript has documented about 4rx, Crazy8Domains, Biris and Limbu.