Scintilla – a flash, a spark, an iota. Shorthand for creativity and an indicator of inventiveness under Australian law.

Tuesday, September 22, 2015

Locking down flighty cybersquatters – new UDRP rules

By Scott Joblin, Lawyer

On 31 July this year, an updated version of the Rules for Uniform Domain Name Dispute Resolution Policy (the UDRP Rules) came into effect. The Rules, in combination with the supplemental rules of the various dispute resolution providers, set out procedural requirements to be complied with in disputes relating to abusive registration and use of domain names. The previous Rules will continue to apply to complaints which were submitted before 31 July 2015.


The new UDRP Rules have introduced a number of changes that are, for the most part, intended to address a practice known as cyberflight. This is where a domain name holder, after learning about a complaint that has been filed against it, alters details of the registration or changes the registrar, with the intention of avoiding or delaying proceedings. This has been a tactic commonly associated with cybersquatters (ie those who try to profit from registering and reselling, or hosting paid advertising on, domains that incorporate established company or brand names).

The updated Rules standardise the practice of 'locking' a domain name when a UDRP action has been filed. Under the previous version of the Rules, there was no explicit requirement for registrars to place restrictions on a domain name in these circumstances.

Nevertheless, uncertainty around how, and when, a registrar should 'lock' a domain name following the filing of a complaint often provided registrants with an opportunity to transfer the domain name to someone else prior to formal commencement of the proceedings. The updated Rules have attempted to rectify this issue.

New complaint filing procedures / mandatory registrar locks

Previously, a complainant was required to serve its complaint on a respondent at the time of filing it. Under the updated Rules, complainants are no longer required to notify respondents in this way.

Now, when a complaint is filed, the relevant dispute resolution provider is required to send a request to the registrar for the disputed domain name to be locked, pursuant to Rule 4(a). A 'lock' is defined as:
a set of measures that a registrar applies to a domain name, which prevents at a minimum any modification to the registrant and registrar information by the Respondent, but does not affect the resolution of the domain name or the renewal of the domain name.
This means that the domain name can continue to function as normal while the dispute is resolved.

Following receipt of the lock request, updated Rule 4(b) provides that a registrar must lock the domain name within two business days and inform the dispute resolution provider. Any updates to the respondent's data must be made before that period is up or before the lock is confirmed (for example, updates resulting from 'a request by a privacy or proxy provider to reveal the underlying customer data').

Once the dispute resolution provider has received confirmation that the domain name has been locked, the dispute resolution provider may then notify the respondent of the complaint.

The lock remains in place from the time a complaint is submitted to the time the decision has been implemented or the complaint has been terminated. In situations where the complaint is either withdrawn or dismissed due to an administrative deficiency, Rule 4(e) requires that the lock must be withdrawn by the registrar within one business day of being notified.

New settlement procedure

The other major change to the Rules is that Rule 17 now outlines a new procedure to be used by the parties to settle UDRP proceedings. Prior to 31 July, the Rules provided for a proceeding to be terminated if a settlement was agreed, but there was no procedure specified.

The new procedure includes completing a standard settlement form which summarises the essential terms of the parties’ settlement agreement and is provided to the relevant dispute resolution provider. This form is not intended to be an agreement itself. Once a registrar has been notified of the actions to be taken under the settlement agreement (eg transferring the domain name), the registrar must remove the lock on the domain name within two business days.

Other changes

Updated Rule 5(b) now provides respondents with the ability to request an additional four calendar days to respond to a complaint. This extension will be granted automatically upon request.

Further, Rule 16(a) now provides that registrars must notify the parties, the dispute resolution provider and ICANN of the date for implementation of the decision within three business days of receiving the decision from the dispute resolution provider. The previous rules provided that this was to happen 'immediately'.

How does the auDRP compare?

In relation to .au Dispute Resolution Policy (auDRP) proceedings concerning .au domain names, it is already auDA policy that the registrar must make a request to AusRegistry to place a server lock on the relevant domain name within 24 hours of receiving a copy of an auDRP complaint (the registrar is notified when the proceeding is commenced). However, under the current auDRP Rules, there is no obligation on the complainant to notify the respondent of the complaint at the time of filing (as was the case under the previous UDRP Rules).

No comments:

Post a Comment