The New Power for HMRC to Suspend Domains Directly.

United Kingdom lawmakers have officially embraced the power of online speed enforcement. His Majesty’ Revenue and Customs more commonly known as HMRC just got officially added to Nominet’ trusted notifier list. Moving forward this critical update will allow the governments’ tax collection bureau to order registry-level suspensions of illegal websites without any intermediary delays. In previous years taking down a fraudulent website has been a drawn out legal battle that required massive bureaucracy and proven judicial oversight. Thanks to this highly encrypted notifier agreement HMRC can now scan for suspected fake websites and instantly notify the registry to pull the plug. By escalating national law enforcement into the registry engines, the U.K. government can protect the integrity of their country-code space while simultaneously shutting down websites in “real time.”

This sort of unilateral escalation may sound heavy handed to private asset managers, but legislation has been carefully constructed to avoid disturbing the inherent rights of private registrants. Instead of redefining asset rights across large swaths of the independent ecosystem, Nominet has simply bridged their internal policy with HMRC’ statutory language under the newly passed Crime and Policing Act. Passed last April, the Act officially empowers U.K.-based law enforcement to request that Nominet “take such action as it considers appropriate” against offending networks at home and abroad. Adding substantial governmental weight behind Nominet’ existing take down protocols not only gives the registry more structural credibility with international law-makers, but it also allows domain investors to operate from a higher baseline of safety. As public trust in a country-code brand increases, so too does the underlying value of every clean second-tier domain parked under that namespace.

In the chart above we take a closer look at how these “selfie suspensions” technically work. Keep in mind that the core blueprint illustrated here is intentionally applicable across any industry segment planning to integrate directly with Nominet. The fundamental advantage to shortening the investigation to enforcement pipeline is that law enforcement no longer needs to prove some website is guilty before entering action. Instead they only need to prove a website looks suspicious. This is critically important for catching hardened cybercriminals that systematically hack legitimate websites to use during busy processing seasons.

As one registry technology veteran in London put it to me recently, “ It’s kind of like the difference between complaining to someone’ garbage man versus their legal team.”

 
+=======================================+
| Who Is Really Driving Innovation? |
+=======================================+

Picture yourself spending hours manually building your case in front of family courts only to have your website duplicated on another registry five minutes after you receive your victorious judgment. That used to be Nominets’ speed of enforcement. Today a state department can reach into Nominets’ registry backend and press the lock button against a suspect domain within minutes. What takes your business days can take hackers seconds. By cutting out unnecessary remediation lag times, extortion sites have significantly less time to collect on their victims.

Ever In Flux: How Domain Brands Survive in a Dynamic Regulatory Landscape

 
Clearly defining when and where public intervention is acceptable naturally creates concern around digital property rights. To prevent legitimate businesses from getting caught in the registry’ crossfire, Nominet has published a robust appeals process that favors guilty until proven innocent Registrants. If a domain is suspended for entirely innocuous reasons your business has 48 hours to prove your innocence OR the problem will be permanently logged in your domain name history. Believe me when I tell you that registry managers do not care if you were building a dick joke website or a commercial financial services platform. If your name ever pops up on Nominet’ radar it is in your best interest to make nice and validate your information immediately.

All of this data transparency begins with the core accuracy of your domain portfolio. Whenever a professional registrar acquires a domain from a private party, the contact details associated with that name are often transferred along with the product. Sadly most investors don’ know that if your contact details don’ match your corporate identity paperwork your domains are at risk of being suspended at any time. Fraudsters and verified entrepreneurs both use registrar lock technology and DNSSEC, but crooks simply don’t care about leaving their information accurate. So if the State comes sniffing around your names they’ only grab yours. Always ensure that your domain names are cleanly tied to validated corporate data before considering a sale.

+========================================+
| REGISTRANT QUALITY SCORECARD |
+========================================+
| LOW-RISK PROFILE | HIGH-RISK PROFILE |
|____________________________________________________|

WHOIS INFO MATCHES WHOLESALE CORP DB |WHOIS INFO IS INVALID / INTENTIONALLY DISTORTED|
Trademark Covered by a .UK String? |CrimeFeed Compatible Typo Variants Detected |
DNSSEC | Registry DNSHosting |
Enabled | Unsecured |
|____________________________________________________|

In the unfortunate event that your domain does get flagged for reasons you do not understand, Nominet has outlined a technical dispute resolution channel that can be leveraged from inside your dashboard. Your business will be required to verify both your identity and intended use case before any remediation efforts can be started. If you can prove you were in the clear, your domain name will return to service with no questions asked. This ensures that no bureaucratic machinery can be repurposed into an extortion racket.

For digital investors, brand protection literally is the business of domain resale. Imagine how crazy it would be if your competitor could register

www.amazontransparent.com and your government could do nothing to stop it. Safe to say companies would think twice before registering .Amazon brand space. But that wouldn’ be fair, would it? Truth is when it comes to phishing crackdowns BIG BRANDS ALWAYS WIN. By removing as much positional advantage as possible for criminal networks, Nominet is ensuring that bona-fide businesses always have a clear path to protection.

 
Timing is Everything: Taking Advantage of Industry Lead Times

Few if any global domain zones have been as aggressive about curbing fast-flux networks as Nominet. In fact, Nominet was one of the first registries to publicly commit significant resources towards shutting down cybercriminal operations. Investors with big enough portfolios obviously have a direct financial interest in rooting out bad actors. I have spoken to dozens of brand owners that value their .UK domains so highly they will pay thousands in legal fees to protect their own names fromWould you pay money to have Nominet take down a competitor website wrongfully squatting on your brand?

 
This newfound regulatory certainty is why premium domain sales continue to pour into central registries at record pace. When buyers perceive that a country-code extension is truly serious about protecting its name, they pay top dollar to do business inside that namespace. In many ways Nominet’ latest counter measure benefits domain investors more than any other commercial constituency. By placing orderly guard rails around the wild west elements of their registry, thousands of innocent brands are protected by default.

 
Part of the reason that Nominet’ resale market is flourishing right now is that registrars also have less overhead when it comes to abuse complaints. Instead of spending their day manually evaluating suspicious networks, registrars can defer entire investigations over to law enforcement. Layering these decisions on top of each other allows each registrar to focus solely on serving their customers instead of playing internet police. As domain professionals continue to rally behind unified solutions like DNSChain and DSATR the domino effect will be felt across every layer of the value chain.

Mitigating Risk in an Age of Registry Immunity

As vigilant domain investors ourselves there is plenty that we can do inside our own portfolio to limit exposure from future regulatory updates. The first order of business is to simply audit your own portfolio and confirm that every single domain name in your control is 100% aligned with your corporate entities WHOIS object. Any domains with outdated contact information should ideally be updated within the next week. This is step 1 for a reason. Proper WHOIS hygiene is your first line of defense against automated takedown frameworks.

 
+========================================+
| PORTFOLIO SECURITY CHECKLIST |
+========================================+
| [Step 1: Export Record]--> Compile a list of every domain you own. |
| [Step 2: Correlate Data]--> Cross reference your list with your corporate |
| registries WHOIS objects. |
| [Step 3: Enforce DNSSEC]--> TURN ON DNSSEC for all domains. |
| [Step 4: Lock your Domains]--> Enable private Registrar Lock service. |
+========================================+

From there you need to force enable DNSSEC protection across your portfolio. DNSSEC serves a multitude of security purposes that are too expansive to cover in this article, but one big advantage is that malware outfits simply don’t enable DNSSEC. By forcing DNSSEC state across your portfolio you instantly remove your biggest websites from global phishing blacklist until some other negligent owner does the same thing. Speaking of negligence…

The final step in this preemptive compliance framework is to sign up for DNSChain alerts that monitor the registration of new infringing copies of your brands. DNSChain is a powerful brand protection tool that will instantly notify you when copycat registrations are first logged into the ICANN registry. Now you have all the pieces you need to future proof your portfolio from regulatory uncertainty. Armed with knowledge there is no such thing as overnight takedowns.