Dot what? Domains expire and thieves are waiting.

In the days after a disaster, the majority of the staff at the American Red Cross (ARC) is working feverishly to mobilize assistance and supplies to the affected areas. Meanwhile, cyber-squatters are busy ramping up as well, working equally as feverishly to profit from the charity's tied-up status and the enormous influx of donations that typically follow disasters.

"That's a huge issue for us," said Julie Ortmeier, senior legal counsel at the Washington, D.C.-based relief charity, of the prevalence of illegitimate ARC Web sites being set up by cyber-squatters. According to Ortmeier, illegitimate ARC Web sites are registered daily, but are activated much faster during times of disaster, "especially with the more nefarious Web sites, where they're clearly doing something improper, trying to funnel donations, that type of thing."

Ortmeier said she's been working for years to reverse the charity's status as a poster child for domain name abuse, but the abuses persist--and broaden. "It's a combination of our domain names expiring (and being snatched up by cyber-squatters)," said Ortmeier, "and them using variations on our names."

According to Michael Ward, director of marketing at Public Interest Registry (PIR), which maintains the master INDUSTRY database of domain names for the .ORG top-level domain (TLD), there's been a dramatic increase in the number of .ORG domain name registrants that are either intentionally or unintentionally letting their domains expire. He said this has opened the door for domain names to be snatched up by cyber-squatters, which holds serious and troubling implications for the previous owners, typically nonprofit organizations.

[ILLUSTRATION OMITTED]

A PIR study showed that through March of this year 5,915,708.ORG domain names were registered worldwide. And while it's not required that an organization have nonprofit status to register a .ORG, 60 percent are currently registered by nonprofit organizations. And according to PIR, in the minds of most Web surfers, sites that sport a .ORG domain name are associated with groups that people turn to for trusted information.

[ILLUSTRATION OMITTED]

This past November, PIR launched the ProtectYour.org International Public Awareness Campaign to educate registrants on the value of .ORG and the value of their domain name. "There's just not a broad enough understanding within the nonprofit community of the importance of domain names," said Ward. "Your .ORG domain name has value, both monetary and in the message you send to your constituents. And if your domain's been compromised, your organization can suffer serious PR consequences, and you risk damaging the relationships you've built with your members and constituents."

PRIVACY BUT NOT SECURITY

According to Ortmeier, cyber-squatters or typo-squatters--cyber-squatters who create misspelled variations of legitimate domain names, like reddcrosss.org--are only part of the problem. "The identity shield is a huge issue for us," said Ortmeier, of the process to protect registrants' privacy, established and supported by the Internet Corporation for Assigned Names and Numbers (ICANN), the international association that overseas the domain name industry. Moreover, Ortmeier said there's a possibility ICANN will modify its rules to allow for more privacy for registrants.

"It already takes a lot of work to get to the actual owner to let them know he/she/it cannot be using the domain name. And sometimes you don't reach them at all," said Ortmeier. Identity shields allow registrars to mask "WHOIS" information, protecting the identity of the registrant or domain name owner. "Us getting to the real owner cannot be a process of weeks or months--or even days."

Added Ortmeier: "I mean, typically in the days after a disaster, we have been able to shut down Web sites within hours. So taking away our ability to find out who's behind a Web site would be a real disservice."

DOMAIN TASTING 

Lori Schulman, inside counsel for March of Dimes (MOD) in White Plains, N.Y., and on the advisory council for PIR, knows all too well the importance of the domain name, and how easily it can slip through an organization's fingers. "It's easier than one would think to inadvertently let a domain expire," said Schulman. "It's possible that renewal will come up and no one will be there to renew it (the domain name)."

During 2003, and again last year, a MOD chapter in southern California lost its domain name for the chapter's--and charity's--signature event, Walk America. During both incidents, the domain name fell through the cracks and into the hands of a cyber-squatter, who monetized the site, in other words, profited financially from it without a legitimate fight.

According to Schulman, the first time around the charity was able to retrieve the domain through an arbitration proceeding. The process to regain the site from its current owners is ongoing, said Schulman, and she recently put out an offer to buy the domain name. "Once I forwarded the offer, I did it anonymously, they took (the site) down, which leads me to believe they knew we were on to them." Schulman said accepting the offer would have been cyber-squatting, and she'd have a federal case against the registrants.

"There are individuals and companies waiting for those domains to expire, and they know when they're going to expire, and they re-register them," said Ward, referring to domain tasting. Also known as domain kiting, domain tasting is a process by which individuals or businesses register a domain, determine its value based on traffic, and within the ICANN five-day-add grace period, choose to keep the domain or return it for a full refund.

"All of that is perfectly legitimate," added Ward. "But, it does become an issue for .ORG registrants, who are primarily non-commercial in nature, who focus on a specific issue or cause, spend a lot of their time on fundraising and creating awareness for their particular issue, and generally have a domain name to create their own visibility."

Ward said the frequency of domain tasting has exploded. The secondary domain market--or domain-name resellers--is a multi-million dollar industry, he said, "and some suggest the space will generate more revenue than...the primary domain space. "According to one insider, of the more than 35 million domain names that were registered worldwide during May 2006, fewer than 3 million were legitimate. The remaining 92 percent were dropped within five days without incurring registration fees.

Moreover, there are now more domain name options than ever, with .INFO, .MOBI (for wireless), and others joining the big four, .ORG, .COM, .EDU and .NET. "Absolutely, it's harder to keep tabs on all of them," said Mary Latham, staff attorney with American Heart Association (AHA) in Dallas. "When these new ones are created we have people going out and registering 'Americanheart dot,' whatever they're using, but there's so many that it creates problems for us."

Schulman said she'd like to see the PIR initiative shed light on the importance of domain name management, a long-ignored issue. "It's not covered very often--no, almost never," said Schulman, who cited a speech she gave recently on the issue, to lawyers. "Intellectual property and domain names isn't always looked at as closely, but it's key to an organization. The name's the thing. If people don't trust the name and people don't trust the Web address--trust is huge with nonprofits."

According toward, there are two challenges right now. "One is getting nonprofits to understand what is going on. They're very focused and very good at leveraging technology to raise funds, raise awareness, achieve their goals," he said. "But there isn't a high enough awareness of the importance of their .ORG brand."

The second challenge is getting nonprofits to talk about the issue. "Because when it happens to nonprofit organizations, a lot of them don't want to publicly speak about it." Ward said he'd like to see more nonprofits come forward and share their stories.

Added Ward: "Just as the real estate industry consists of homes, office buildings, etc., and within the industry there are brokers and appraisers that determine the value of the property, there's also those same types of forces taking place in the online space today."

13 Ideas To Prevent Being Unlucky

The occurrence of domain tasting, or snatching up expired domain names and testing them for profitability, has exploded in the .ORG domain-name marketplace and is causing harm to the nonprofit organizations falling victim to this process.

It's not unusual that a cybersquatter will pick up an expired .ORG and use it to sell goods and/or services completely unrelated--and oftentimes offensive--to the original nonprofit owners.

Michael Ward, director of marketing at Public Interest Registry (PIR), together with Lori Schulman, inside counsel for March of Dimes (MOD) and on the advisory council for PIR, and Michael Palage, an intellectual property attorney and information technology consultant, offered the following advice for both protecting your domain name and, worst case scenario, what to do if it gets into the wrong hands.

1 There are more than 200 registrars to choose from, so do your homework. The Internet Corporation for Assigned Names and Numbers (ICANN) must accredit all registrants. However, there are resellers through which you can also register domains.

2 It's essential that you verify that you or an authorized representative of your organization has been selected as the registrant. Go to the WHOIS database at PIR's Web site and view the name of the registrant, administrative contact, and technical contact for your .ORG domain(s).

3 Employ a buddy system within your organization so there's not just one person responsible for managing the domain name(s) and updating the information.

4 Check that email contact is valid. And instead of registering using contact information specific to one person at the organization, use a genetic email address that will go to a ghost account.

5 Consolidate .ORG domains. Many registrars offer domain-name consolidation services that enable you to establish a master account.

6 if you're a national organization, centralize your portfolio of affiliate domain names by giving it to national.

7 Register your domain name(s) for the maximum amount of time. For organizations that unintentionally let their domain expire:

8 The redemption grace period that ICANN has put in place provides actual and constructive notice that something's wrong. If you haven't paid, they remove you from the file and your email and Web site stop working.

9 Look up the new owner's information on WHOIS and send a demand letter. Seek the advice of a competent counsel in this area. There are internal legal specialists who may be willing to do it pro bono.

10 Contact your Internet Service Provider (ISP) and alert them of fraud. Sometimes they will take the site down.

11 File a proceeding under the Uniform Dispute Resolution Policy (UPRP).

12 File an action in federal court under the Anticybersquatting Act, which is part of the Lanham Act.

For those who are considering intentionally letting their domain expire."

13 Hold onto it. "You might need that domain down the road," said Ward. "It has more value than you may think and there are other organizations out there that know the value of it. "Ward said he's seen domains go for six figures.

--MARLA E. NOBLES