Many individuals register their full names as personal name domain names. Over 250,000 such domains are registered in the NAME TLD alone, and plenty are registered in COM and other Top Level Domains as well, but irrespective of what TLD you choose, a personal domain name is more than a virtual vanity plate. It can be a valuable branding tool to complement your social media personality. Unfortunately, that same domain name can do you harm when you haven’t registered your personal name domain name but someone with ulterior motives does.
Why target me?
You don’t have to be a high profile individual - actor, musician, renowned professionals, or politician – to be a target of an online reputation scam. In the social networking era, maintaining a positive online reputation has become an important consideration for nearly everyone. College admissions, scholarships, job opportunities, family, client or customer relationships can be affected by what others discover about you online. Widespread concern for online reputation creates a fertile market for mischief or crime. It’s not you: everyone is a potential target. Even individuals with modest online presence are potentially at risk of being embarrassed or extorted.
Photo by Paul Keller
How the scam plays out
You use your personal name as you make your mark in your profession: in marketing collateral, on Facebook, Twitter and LinkedIn. A party contacts you and informs you that he has registered your name as a domain name. In the “less evil” scenario (sometimes called cybersquatting), the party offers to transfer the domain name to you for an exorbitant sum.
In the “more evil” scenario, he threatens to host a web site in your name and post content that will ruin your reputation and career unless you agree to pay a monthly “maintenance” fee for your personal domain name protection.
What are my legal options?
I am not an attorney, so I invited colleague, attorney, and law professor David Steele to share a (US) legal perspective with me.
Skeptic: Is registering someone else’s personal name as a domain name legal?
Steele: In most cases, it is unlawful. Under U.S. law 15 § U.S.C. 1129, it is unlawful to register a domain name that consists of, or is similar to, the name of another living person without their consent (note there are few exceptions). Several states (including California) also have a similar state law regarding the registration of someone else’s personal name as domain name.
Additionally, U.S. Federal Law 15 § U.S.C. 1125(d), (the Anti-Cybersquatting Consumer Protection Act, or the ACPA) protects against the registration, use or trafficking in, of any domain name with a bad faith intent to profit from a trademark (or service mark) that is protected under federal law. However, federal law often will not protect a personal name as a trademark unless the personal name has acquired distinctiveness (think “become well known by the public”).
But to take advantage of these law (the U.S. law or any state law) you’ll need to prepare and file a law suit against the registrant of the domain name.
Skeptic: This is beginning to sound expensive. How expensive?
Steele: Filing a lawsuit is almost always a costly endeavor. In this type of case the costs could vary widely depending on the registrant’s tenacity. One upside to filing a lawsuit is that there are often remedies available if you prevail. For example, under the ACPA, in addition to recovering the domain name, you could also recover damages of up to $100,000 per domain name and the attorneys’ fees (although I can’t recall when that meant all the attorneys’ fees! Courts tend to not award all the fees, believing them too high). So there’s some serious risk to the registrant if you bring suit and win – and this has a tendency to help matter get resolved more quickly and before either side spends too much money on lawyers.
Skeptic: Is this blackmail? Are there other US Laws relevant to this kind of (criminal) act?
Steele: Blackmail (extortion) is a crime and thus does not give the harmed individual an independent legal cause of action—meaning you can’t sue for the criminal act. The U.S. government (or a State depending on which laws are broken) prosecutes criminal acts, not individuals. So, state or federal law enforcement can be notified, and they may step in when a crime such as extortion is committed. But an individual cannot. On the other hand, an individual can file a private civil action (tort).
Skeptic: How does a private action play out in this scenario?
Steele: A person harmed in the manner you describe could turn to some of the tort law claims with more bite and seek punitive damages. Basically, if the injured party can prove the motive was to extort, then he would be able to raise a number of other tort claims and seek more serious (monetary) damages. If everyone who was harmed by these types of scams filed suit, it would deter further bad acts from happening to others in the future (because they would know they’d get sued).
Skeptic: Can you give an attorney’s perspective of what recourse ICANN’s Uniform Domain-Name Dispute-Resolution Policy (UDRP) offers here?
Steele: The UDRP applies to most domain name registrations, including all .com and .net registrations (and virtually all domain name registrations are controlled by some form of dispute policy—if not the UDRP).
The UDRP protects trademarks from domain name registrations that are made (and used) with a bad faith intent. And Several UDRP panel decisions have specifically protected personal names under the UDRP policy; however, these decisions required that the personal name had acquired distinctiveness before extending the protections provided under the UDRP.
Skeptic: Is a UDRP complaint less than filing a law suit?
Steele: Not only is the UDRP much less expensive, it is much faster too! UDRP complaints tend to take about 45 days from start to finish. Law suits often take more than a year. But you cannot recover anything other than the domain name in a UDRP complaint (no damages).
Skeptic: Are there any other ways to resolve these types of situations?
Steele: It not unheard of for a registrant to fold up and go home once they get a cease and desist letter from an attorney that threatens a law suit. If the registrant folds when receiving the letter, the domain name case be transferred quickly and the cost can be reasonable. Of course, this isn’t always the case when sending a letter, but it’s often worth a try.
Skeptic: Thank, David! You've given us a terrific insight into the issues and possible remedies should someone register our personal names as domain names.