featured 78597

ICANN Notifies Freenom’s Registrar of Data Breach

ICANN Issues Third Breach Notice to OpenTLD, Part of Freenom Group

The Internet Corporation for Assigned Names and Numbers (ICANN) has once again taken action against OpenTLD B.V., an accredited registrar associated with the Freenom group of companies. This marks the third time ICANN has issued a formal breach notice to OpenTLD, signaling persistent concerns over the registrar’s compliance with crucial contractual obligations.

The words Breach Notice in red block letters on black background

The latest breach notice (PDF) details several instances where ICANN believes OpenTLD has fallen short of its responsibilities as an accredited registrar. These shortcomings touch on fundamental aspects of domain name registration and management, raising questions about the integrity and reliability of services offered through OpenTLD.

Freenom, the parent company of OpenTLD, is widely recognized for its provision of free domain registrations, particularly within a shrinking selection of country code top-level domains (ccTLDs). However, the company has faced increasing scrutiny and legal challenges related to its operations.

While Freenom’s primary focus lies on free domain offerings, its connection to OpenTLD allows it to operate within the ICANN-accredited domain space, providing a pathway for offering generic top-level domains (gTLDs). Currently, it appears that new registrations are not being actively offered through the freenom.com website.

ICANN’s Concerns Regarding OpenTLD’s Compliance

The core of ICANN’s breach notice centers on OpenTLD’s alleged failure to adequately respond to information requests and adhere to established policies governing domain name management. Specifically, ICANN has highlighted the following key areas of concern:

  1. Failure to Provide Registration Data: ICANN asserts that OpenTLD has not consistently provided registration data and records when requested, a direct violation of Section 3.4.3 of the Registrar Accreditation Agreement (RAA). This provision mandates that registrars promptly furnish requested information to ICANN to ensure accountability and transparency within the domain name system.
  2. Violation of Expired Registration Recovery Policy (ERRP): According to ICANN, OpenTLD has not allowed Registrants at Expiration (RAEs) the opportunity to renew their expired domain name registrations, a requirement stipulated in Section 2.2.5 of the ERRP. This policy aims to protect domain name holders by providing a grace period and renewal options before an expired domain is released back into the market.
  3. Non-Compliance with Transfer Policy: ICANN also alleges that OpenTLD has failed to provide Registered Name Holders (RNHs) with AuthInfo codes and remove the “ClientTransferProhibited” status from domain names upon their request, as mandated by Section I.A.5 of the Transfer Policy. Furthermore, ICANN claims that OpenTLD has not provided valid justifications for denying transfer requests, contravening the principles of the Transfer Policy. The AuthInfo code is crucial for domain owners to transfer their domain to another registrar.

The breach notice includes a list of specific domain names for which ICANN is requesting detailed information. In addition to these specific cases, ICANN is also seeking a compliance certificate from OpenTLD, demonstrating the registrar’s commitment to addressing the identified issues and adhering to ICANN’s policies.

A History of Non-Compliance

This latest breach notice is not an isolated incident. ICANN has previously raised similar concerns with OpenTLD, issuing breach notices in both 2017 and 2020. This pattern of non-compliance suggests a systemic issue within OpenTLD’s operations and raises questions about its commitment to meeting the standards expected of an ICANN-accredited registrar.

Potential Consequences of Non-Compliance

The consequences of failing to address the concerns outlined in the breach notice could be significant for OpenTLD. ICANN has the authority to take a range of actions, including:

  • Financial Penalties: ICANN can impose fines on OpenTLD for each instance of non-compliance.
  • Suspension of Accreditation: In more severe cases, ICANN can suspend OpenTLD’s accreditation, preventing it from registering new domain names.
  • Termination of Accreditation: Ultimately, ICANN has the power to terminate OpenTLD’s accreditation, effectively removing it from the ICANN-accredited registrar ecosystem.

The severity of the consequences will depend on the extent of the non-compliance and OpenTLD’s willingness to rectify the identified issues. Continued failure to comply with ICANN’s policies could ultimately jeopardize OpenTLD’s ability to operate as an accredited registrar.

Impact on Domain Name Holders

The ongoing compliance issues surrounding OpenTLD raise concerns for domain name holders who have registered domains through the registrar. The inability to transfer domains, renew expired registrations, or access accurate registration information can create significant challenges and potentially lead to the loss of valuable domain assets.

Domain name holders who have registered domains through OpenTLD should carefully monitor their accounts and be prepared to take action if necessary to protect their interests. This may include initiating domain transfers to other registrars or seeking legal advice.

ICANN’s Role in Domain Name Governance

This situation highlights ICANN’s crucial role in maintaining the integrity and stability of the domain name system. As the governing body for domain names, ICANN is responsible for ensuring that registrars adhere to established policies and procedures, protecting the rights of domain name holders and promoting a fair and competitive marketplace.

ICANN’s enforcement actions, such as the issuance of breach notices, serve as a deterrent to non-compliance and help to maintain the overall health of the domain name ecosystem. By holding registrars accountable for their actions, ICANN contributes to a more reliable and trustworthy internet environment.

The Future of OpenTLD and Freenom

The future of OpenTLD and its relationship with Freenom remains uncertain. The persistent compliance issues and legal challenges facing Freenom have cast a shadow over both organizations. Whether OpenTLD can successfully address ICANN’s concerns and regain its good standing remains to be seen.

The domain name industry will be closely watching how this situation unfolds, as it has implications for the overall credibility and stability of the domain name system. ICANN’s actions in this case will set a precedent for how it handles similar compliance issues in the future.

For now, domain name holders and industry stakeholders alike must remain vigilant and advocate for transparency and accountability within the domain name ecosystem. The long-term health of the internet depends on it.