Private Domain Name Registration = Liability for Registrars !

Ever try to look up the owner of a domain name, only to find out that the owner's identity was blocked?  Instead of the real owner's name, you see something like, "Domain by Proxy" as the registered owner—or maybe it says, "Private Registrant". 

That's known as a "private registration", and it's a service offered by Internet registrars to help people protect their identities online. 

PROBLEM:  Private registration is being used increasingly as a weapon by hackers and cybersquatters.  What's worse is that registrars offering private registration services are not willing to reveal their customers' identities—even when told that their customers may be breaking the law.

That is, until now......

The recent decision in Solid Host, NL vs. NameCheap, Inc. may change the way registrars provide private registration services. 

Why? 

Because the Solid Host decision was the first court decision to hold that private domain name registration services by an Internet registrar (such as GoDaddy, Network Solutions or, as in this case, NameCheap) may subject the registrar to civil liability for cybersquatting. 

(Yes—cybersquatting!  For those of you who have been living under a rock, "cybersquatting" is the moniker given to the illegal act of knowingly registering someone else's trademark as a domain name.)

By know you're asking, "How can that be?"  You're also probably asking, "What can registrars do to avoid liability?"  (If you're not asking these questions, I'm going to pretend you are because (i) it's my blog, and (ii) I need a segue into my analysis of the situation.)

A (Very Short) Summary of the Case

Solid Host owned a domain name, <solidhost.com>.  A hacker broke into Solid Host's domain name account, and transferred the domain name from Solid Host's registrar to a different registrar, NameCheap.  The hacker used NameCheap's private registration services to hide his identity from Solid Host

Solid Host said, "Hey NameCheap, your customer stole our domain name.  Can you tell us who your customer is so we can get the name back?"

NameCheap said, "Nope, the hacker is a private registrant.  We can't help you."  (Amazing, but true.)

SolidHost sued NameCheap under the theory that NameCheap was helping a hacker steal SolidHost's domain name.

NameCheap said, "Hey, you can't sue us.  There's a federal law that says that you can't sue Internet registrars for providing domain name registration services."  (In fact, there is a federal safe harbor provision that gives registrars immunity for damages relating to domain registration services.  You can read the law HERE.)

The Court said, "NameCheap—-you're right, and you're wrong."

The Court held that NameCheap could not be sued for providing domain name registration services.  But the Court also ruled that NameCheap's private registration services were NOT the type of services that the federal law was meant to protect.  As a result, NameCheap could be sued for cybersquatting (and other sundry causes of action).

My Thoughts on the Decision

Hooray!  The Court got it exactly correct.   

Where Registrars Go From Here  

 

The case doesn't spell the end of private registration services.  But it does send a clear message to Internet registrars that they should consider including sentences similar to the following in their private registration customer agreements:
               Customer acknowledges and agrees that Registrar will disclose Customer's
               information to third parties, without notice to Customer, if (i) compelled to do
               so by law, or (ii) if Registrar believes, in its sole but reasonable discretion, 
               that the domain names are the subject of theft, misappropriation, conversion,
               or improper transfer.  Customer shall hold Registrar harmless for any costs,
               fees, expenses or damages Customer incurs as a result of Registrar's 
               disclosure of Customer's information.

DISCLAIMER:  Am I giving you legal advice?  NO!  Don't be silly.  I'm only suggesting that there may be a way for registrars to continue to provide private domain registration services while avoiding liability for cybersquatting.  (Anyway, if you were my client, you'd already know this because I would have corrected your agreement by now....) 

Check with your attorney before changing any of your agreements. 

 del.icio.us  Stumbleupon  Technorati  Digg