« Security Awareness Sticker Program: Creative Behavior Change | Main | Book Review: The Little Book of Big Scams »

Monday, 11 June 2012

Someone’s registered my personal name as a domain name!

Many individuals register their full names as personal name domain names. Over 250,000 such domains are registered in the NAME TLD alone, and plenty are registered in COM and other Top Level Domains as well, but irrespective of what TLD you choose, a personal domain name is more than a virtual vanity plate. It can be a valuable branding tool to complement your social media personality. Unfortunately, that same domain name can do you harm when you haven’t registered your personal name domain name but someone with ulterior motives does.

 Mx

Why target me?

You don’t have to be a high profile individual - actor, musician, renowned professionals, or politician – to be a target of an online reputation scam. In the social networking era, maintaining a positive online reputation has become an important consideration for nearly everyone. College admissions, scholarships, job opportunities, family, client or customer relationships can be affected by what others discover about you online. Widespread concern for online reputation creates a fertile market for mischief or crime. It’s not you: everyone is a potential target. Even individuals with modest online presence are potentially at risk of being embarrassed or extorted.



Dear_Walt_m
Photo by Paul Keller

How the scam plays out

You use your personal name as you make your mark in your profession: in marketing collateral, on Facebook, Twitter and LinkedIn. A party contacts you and informs you that he has registered your name as a domain name. In the “less evil” scenario (sometimes called cybersquatting), the party offers to transfer the domain name to you for an exorbitant sum. 

In the “more evil” scenario, he threatens to host a web site in your name and post content that will ruin your reputation and career unless you agree to pay a monthly “maintenance” fee for your personal domain name protection.

What are my legal options?

I am not an attorney, so I invited colleague, attorney, and law professor David Steele[1] to share a (US) legal perspective with me.

Skeptic: Is registering someone else’s personal name as a domain name legal?

Steele: In most cases, it is unlawful.  Under U.S. law 15 § U.S.C. 1129, it is unlawful to register a domain name that consists of, or is similar to, the name of another living person without their consent (note there are few exceptions). Several states (including California) also have a similar state law regarding the registration of someone else’s personal name as domain name.

Additionally, U.S. Federal Law 15 § U.S.C. 1125(d), (the Anti-Cybersquatting Consumer Protection Act, or the ACPA) protects against the registration, use or trafficking in, of any domain name with a bad faith intent to profit from a trademark (or service mark) that is protected under federal law. However, federal law often will not protect a personal name as a trademark unless the personal name has acquired distinctiveness (think “become well known by the public”).

But to take advantage of these law (the U.S. law or any state law) you’ll need to prepare and file a law suit against the registrant of the domain name.

Skeptic: This is beginning to sound expensive. How expensive?

Steele:  Filing a lawsuit is almost always a costly endeavor.  In this type of case the costs could vary widely depending on the registrant’s tenacity.  One upside to filing a lawsuit is that there are often remedies available if you prevail. For example, under the ACPA, in addition to recovering the domain name, you could also recover damages of up to $100,000 per domain name and the attorneys’ fees (although I can’t recall when that meant all the attorneys’ fees! Courts tend to not award all the fees, believing them too high).  So there’s some serious risk to the registrant if you bring suit and win – and this has a tendency to help matter get resolved more quickly and before either side spends too much money on lawyers.

Skeptic: Is this blackmail? Are there other US Laws relevant to this kind of (criminal) act?

Steele: Blackmail (extortion) is a crime and thus does not give the harmed individual an independent legal cause of action—meaning you can’t sue for the criminal act. The U.S. government (or a State depending on which laws are broken) prosecutes criminal acts, not individuals.  So, state or federal law enforcement can be notified, and they may step in when a crime such as extortion is committed. But an individual cannot. On the other hand, an individual can file a private civil action (tort).

Skeptic: How does a private action play out in this scenario?

Steele: A person harmed in the manner you describe could turn to some of the tort law claims with more bite and seek punitive damages. Basically, if the injured party can prove the motive was to extort, then he would be able to raise a number of other tort claims and seek more serious (monetary) damages. If everyone who was harmed by these types of scams filed suit, it would deter further bad acts from happening to others in the future (because they would know they’d get sued).

Skeptic: Can you give an attorney’s perspective of what recourse ICANN’s Uniform Domain-Name Dispute-Resolution Policy (UDRP) offers here?

Steele: The UDRP applies to most domain name registrations, including all .com and .net registrations (and virtually all domain name registrations are controlled by some form of dispute policy—if not the UDRP).

The UDRP protects trademarks from domain name registrations that are made (and used) with a bad faith intent. And Several UDRP panel decisions have specifically protected personal names under the UDRP policy; however, these decisions required that the personal name had acquired distinctiveness before extending the protections provided under the UDRP. 

Skeptic: Is a UDRP complaint less than filing a law suit?

Steele: Not only is the UDRP much less expensive, it is much faster too!  UDRP complaints tend to take about 45 days from start to finish.  Law suits often take more than a year.  But you cannot recover anything other than the domain name in a UDRP complaint (no damages).

Skeptic:  Are there any other ways to resolve these types of situations?

Steele: It not unheard of for a registrant to fold up and go home once they get a cease and desist letter from an attorney that threatens a law suit.  If the registrant folds when receiving the letter, the domain name case be transferred quickly and the cost can be reasonable.  Of course, this isn’t always the case when sending a letter, but it’s often worth a try.

Skeptic:  Thank, David! You've given us a terrific insight into the issues and possible remedies should someone register our personal names as domain names.

[1] David also contributed to a 2010 post, Disclaimers and email Signatures.

Posted at 01:00 AM in Domain names and DNS, Stop Think Connect |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

The comments to this entry are closed.

Find me on Mastodon and Facebook

Spotlight Posts

  • Interisle Study Reveals Alarming Rise in Online Abuse and Identifies Exploitable Links in Cybercriminal Supply Chains
    My Interisle colleagues and I today published our 2024 Cybercrime Suppy Chain study. We analyzed 16 million cybercrime events to expose a dramatic rise in criminal exploitation of name, address, hosting, and financial supply chains. Our year-over-year findings show that cybercriminals exploit lax policies to easily and cheaply obtain resources for phishing, malware, and spam campaigns. In our report, we provide actionable insights for those aiming to curb cybercrime. Among the major findings in the study, Interisle reports that: The total number of malware, phishing, and spam attacks grew year-over-year by nearly 54%, to nearly 16.3 million attacks. Spam doubled,...
  • Malware quarterly reports for July-September
    Malware quarterly reports for July-September 2024 is now posted at the Cybercrime Information Center. For the period... Malware identified as targeting endpoint devices increased 277% over the prior period. WordPress blog sites used for malware accounted for nearly all the malicious documents reported for this period. We continue to see an uptick in malicious scripts. IPv4 addresses reported for exhibiting characteristics of attackware and traffic injectors increased 38% to just under 1 million. ASNs in China and India again have the most IPv4 addresses reported for hosting malware. More malware trends for the period at https://www.cybercrimeinfocenter.org/malware-trends-july-september-2024. For historical reporting of...
  • Interisle's Phishing Landscape 2024 is here
    Our Interisle team today announced the publication of an industry report, Phishing Landscape 2024, A Study of the Scope and Distribution of Phishing. Interisle’s fourth annual study examines nearly four million phishing reports collected from May 2023 to April 2024 and provides historical measurements using over 15 million phishing reports collected at the Cybercrime Information Center over a four year period. Findings from the study: • The total number of phishing attacks grew to ~1.9 million incidents worldwide. • Phishing attacks hosted at subdomain providers increased by 450,000+ reported names, representing 24% of all phishing attacks. • The use of...
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....

Search

My Photo

Categories