REASONS FOR JUDGMENT
Introduction
1 Nominet UK is a company limited by guarantee which was incorporated in 1996 by the Internet Industry in the United Kingdom to provide a central registry for UK-based Internet domain names. The company keeps a Register of persons and organisations who use domain names under the UK country code and certain sub-domains or Second Level Domains (SLD) with codes such as .co.uk and .org.uk. Nominet UK also provides a search function using a Database derived from its Register and known as the WHOIS Database.
2 In January 2003, two Australian companies, Diverse Internet Pty Ltd (Diverse Internet) and Internet Payments Pty Ltd (Internet Payments) associated with Bradley Norrish and Chesley Rafferty used sophisticated search techniques of a kind known as 'data mining' to extract and collate names and other details of Registrants on the Nominet UK WHOIS Database. Through another company, (UK) Internet Registry Ltd ((UK) Internet Registry) controlled by Mr Rafferty and incorporated in the Republic of the Seychelles, they sent notices from Western Australia to some 50,000 of those Registrants in the UK. The Notices offered registration of domain names ending in the code .com.
3 Nominet UK commenced proceedings against the three companies and against Messrs. Norrish and Rafferty alleging infringement of its copyright in the Registry Database and the WHOIS Database. The company also alleged that the Notices sent to its Registrants were misleading in various respects. As well as containing a number of false representations, Nominet UK claimed that the Notices conveyed the false impression that (UK) Internet Registry was somehow affiliated with or had some sponsorship or approval from Nominet UK.
4 The proceedings came to trial on 21 June 2004. On that day the Court was informed that they had been settled against all respondents other than Mr Norrish. The other respondents have, in effect, conceded the bulk of the claims made against them by Nominet UK. Various declaratory and injunctive orders were made against them by consent at trial and the question of damages stood over for assessment. Those orders are set out at the commencement of these reasons.
5 Mr Norrish continued to contest his personal liability. For the reasons which I now publish, I find that he infringed the copyright of Nominet UK in its Databases by authorising their infringement by an employee of Diverse Internet, the company which he controls. I find also that the Notices sent by (UK) Internet Registry to Registrants in the United Kingdom were misleading and deceptive and that he was knowingly concerned in their preparation and dispatch.
The Internet and Domain Names - Background and History
6 The 'Internet' is a name given to a global complex of connections between computers forming networks which are owned and operated by various organisations. The history of the Internet and role of domain names in it was described, for the purposes of these proceedings, in the unchallenged evidence of William Black, who is the Executive Chairman of Nominet UK and Jay Daley, Nominet UK's Director of Information Technology.
7 The Internet had its beginnings in 1969 in the establishment of a network between the United States Department of Defence, defence contractors and various universities. The network so created was called the 'Advanced Research Projects Agency Network' ('ARPANet'). The setting up of the network involved the creation of domain names or addresses for its users.
8 A domain name identifies a particular computer connected to the Internet. Each networked computer uses a common Internet Protocol which provides a unique numeric Internet Protocol address (IP address) such as 124.57.32.6 for the relevant computer server. Although each IP address is defined by a set of numerals, Internet users have, from the beginning of the Internet, been able to adopt alphanumeric combinations which are more convenient and which are known as 'domain names'.
9 The address naming scheme for ARPANet defined different classes of domain names as users were registered under those names for the purpose of network management. So university users had domain names ending in '.edu'. Commercial corporate users ended in '.com'. Government departments ended in '.gov'. Each particular user would identify itself by an appropriate prefix. So Stanford University was 'stanford.edu'.
10 The United Kingdom and other countries developed networks of computers including defence organisations, universities, commercial organisations and government agencies. The protocols and standards which they developed for communication within these networks were not uniform. In the 1980s it became apparent that it was necessary to provide links between the various nationally-based networks. Unification of their disparate naming schemes was imperative. Generic domain name endings became known as Top Level Domains (TLDs). They describe classes of users or addresses within the Internet. Some of them were independent of any association between the addressee and a particular country. They included '.com', '.org' and '.net'.
11 Country codes were established to identify users of different national origins. So domain names ending in '.uk' identified computer servers in the United Kingdom, '.fr' for France and '.au' for Australia. These end codes became known as country code Top Level Domains (ccTLDs).
12 The assignment of generic address designations was part of the development of the Domain Name System (DNS). That development was described in a 1994 document entitled 'Domain Name System Structure and Delegation' written by Dr J Postel of the Information Sciences Institute of the University of Southern California. The paper was in the form of a memorandum written for the 'Internet community' and is frequently referred to by the alphanumeric designation RFC 1591.
13 In that memorandum, which was exhibited to Dr Black's principal affidavit, Dr Postel succinctly described the DNS thus:
'In the Domain Name System (DNS) naming of computers there is a hierarchy of names. The root of system is unnamed.(sic) There are a set of what are called 'top-level domain names' (TLDs). These are the generic TLDs (EDU, COM, NET, ORG, GOV, MIL and Int), and the two letter country codes from ISO-3166. It is extremely unlikely that any other TLDs will be created.
Under each TLD may be created a hierarchy of names. Generally, under the generic TLDs the structure is very flat. That is, many organizations are registered directly under the TLD and any further structure is up to the individual organizations.
In the country TLDs, there is a wide variation in the structure, in some countries the structure is very flat, in others there is substantial structural organization. In some country domains the second levels are generic categories (such as, AC, CO, GO, and RE), in others they are based on political geography, and in still others organization names are listed directly under the country code.'
Dr Postel observed that each of the generic TLDs was created for a general category of organisations. The country code domains were each organised by an administrator for that country. Those administrators further delegated the management of portions of the naming tree. They performed a public service on behalf of the Internet community. He described the various world wide generic domains. In summary they are as follows:
COM - a domain intended for commercial entities
EDU - a domain originally intended for all educational institutions but restricted subsequently to universities and colleges
NET - a domain intended only for the computers of network providers
ORG - a domain intended as the miscellaneous TLD for organisations that did not fit anywhere else and which could include non-government organisations
INT - a domain intended for organisations established by international treaties or international databases.
14 Dr Black described the further development of the DNS in his affidavit. DNS now includes a number of generic TLDs and about 250 ccTLDs. A ccTLD is chosen by the local Internet community of organisations using the network in a particular country.
15 Dr Black described the DNS as providing '...a mapping function between a domain name and its corresponding IP address for the computer which hosts that domain name'. He referred to 'nameservers' which are computers permanently connected to the Internet to execute the mapping function between a domain name and its corresponding IP address and vice versa. Information on nameservers for the purpose of the mapping function is stored in a 'zone file'. The nameservers and their zone files are necessary so that users can connect to the Internet by the use of a domain name. The routing machinery on the Internet only needs to pass data packets from computer to computer. The zone files therefore only need to contain the domain names and the corresponding IP address. They do not need to keep all the other data associated with registrants of the names. Registries have to keep such data for legal, billing and other purposes and that extra information is kept in a register database. The register database is securely maintained in one place. Dr Black described the DNS as '... a complex system comprising many nameservers operated by many independent authorities and using intricate systems of protocol and message exchange'.
16 The hierarchy of domain names in the DNS follows a tree structure. All domain names actually end in a '.' (full stop) character. Modern DNS software does not require that the full stop be included. It is implied. It is called the 'root domain'. That is the highest level of the DNS tree. Root nameservers or root servers have information about the nameservers of all the TLDs and ccTLDs. They redirect Internet traffic to the nameservers for the relevant TLDs or ccTLDs as indicated in the domain name. Information in the root servers is necessary so that Internet traffic can locate the registers for each of the TLDs and ccTLDs on the Internet and from those registers find the Internet location which is being sought.
17 The ccTLD for the United Kingdom, ie '.uk', was initially managed by Professor Peter Kirstein of University College London who was appointed for that purpose by the Ministry of Defence in the United Kingdom and university users. In the early 1990s Professor Kirstein passed over the management of the '.uk' ccTLD to Dr Black. That transfer of management was approved by four or five commercial Internet companies which had then been formed in the UK by the Ministry of Defence and by the academic and research community using the Internet at the time.
18 Prior to 1996, Professor Kirstein, and subsequently Dr Black, delegated the operation of nameservers for all the .uk ccTLD names and the process of registration of their users to several Internet Service Providers (ISPs) who undertook those responsibilities as a voluntary contribution to the infrastructure required for the use of the Internet. The ISPs did not receive payment for their services and no formal contracts were in place. The term 'Second Level Domain' (SLD) is used to refer to generic domain designations within a ccTLD which identify the class of organisation whose IP address is being named. So .co.uk refers to a commercial enterprise with a .uk ccTLD. As appears from papers exhibited to Dr Black's principal affidavit responsibility for the adoption of procedures and policies for the management of SLDs and lower level hierarchies of names is delegated to TLD managers.
19 The .uk ccTLD was subdivided into a set of what Dr Black described as 'neutral second level domains' which reflected roughly the same classifications as the 'generic' TLDs. So the SLD '.co.uk' referred to commercial organisations with '.uk' Internet addresses. It was operated by EUNet GB Ltd (EUNet). The designation '.org.uk' was used for not-for-profit organisations and operated by Unipalm PIPEX Limited. The name '.ac.uk' was used by academics and researchers and was operated by UKERNA.
20 By mid-1995, the numbers of applications for domain names had grown to several hundred per month. Because of this and growing pressure to review the voluntary mechanism then in place Dr Black, as the designated manager of '.uk' initiated consultations with the Internet industry in the UK about the reshaping of the domain name registration process in that country. This led to the formation of Nominet UK, the applicant in these proceedings. Dr Black transferred responsibility for management of the .uk ccTLD to Nominet UK by formally announcing it to the local Internet community and arranging for the Internet Assigned Numbers Authority (IANA) to record the change. The IANA is an overarching authority which administers the DNS on a day to day basis. The staff of the IANA have administrative responsibility for the assignment of IP addresses, autonomous system numbers, TLDs and other unique parameters of the DNS and its protocols.
21 Nominet UK was established in 1996 by the Internet industry in the United Kingdom to provide a central registry for domain names in the .uk ccTLD. It has been registered with IANA as the authority to administer the .uk domain and to host .uk ccTLD root name servers from 1 August 1996. The IANA website shows a page under the heading 'Root-Zone Whois Information' which shows Nominet as the sole registry of the .uk ccTLD (Exhibit WB1 p 8).
Nominet UK and its Register
22 Nominet UK is a not-for-profit company limited by guarantee. Its objects, which are set out in cl 3 of its Memorandum of Association, are as follows:
'3.1 to act as the Network Information Centre for the United Kingdom and manage and control the use of the Internet domain '.UK';
3.2 subject to all necessary consents, and to the co-operation of the governmental and non-governmental organisations concerned, to manage and control the use of sub-domains under the Internet domain '.UK' (whether directly or by means of sub-contracts, agents or any other means);
3.3 to establish, publish and administer rules for the use of the domain and sub-domains referred to in clauses 3.1 and 3.2;
3.4 to maintain a Register of Internet domain names;
3.5 to establish and implement procedures for authorising changes to the Register;
3.6 to provide facilities for searching the Register; and
3.7 to operate a domain name service;
in each case on a commercial basis.'
Nominet UK has responsibility for the management of the .uk ccTLD and for the following SLDs namely; .co.uk, .plc.uk, ltd.uk, .org.uk, .me.uk, .net.uk and .sch.uk. These are referred to by Dr Black as the Nominet Domains.
23 The DNS can be used in two ways:
1. As a registration mechanism by which users of the Internet can register their chosen domain names with a set of registers world wide.
2. An operational search mechanism by which Internet users can use software such as Internet Browser or an email tool to enter a domain name and have it automatically translated into the IP address currently associated with that domain name.
These uses are reflected in the functions of ccTLD administrators.
24 In aid of its registration function Nominet UK maintains a Database which is called its Register. The Database records each registered UK domain name immediately under the .uk ccTLD and under the SLDs for which Nominet UK has managerial responsibility. It contains information in respect of each holder of a domain name in the Nominet domains including the following:
(i) the registered holder of each domain registration;
(ii) the registered address for each registrant;
(iii) the operational name servers for each domain name;
(iv) the identity of the Tag Holder (if any) through which registration was made or is subsequently maintained (see below for discussion of Tag Holders);
(v) other information not material for present purposes.
Nominet also keeps records of relevant organisations with day to day management of the SLDs in the .uk ccTLD which Nominet does not manage.
25 To support the search mechanism, Nominet UK provides operational nameservers which contain a 'zone file' for the Nominet domains. It will be recalled that information on a nameserver that enables it to execute the mapping function between the domain name and its corresponding IP address is stored in a 'zone file'. The zone files only contain domain names and the corresponding IP addresses. It is not necessary that they maintain all the other data associated with registrants.
26 All Internet traffic for .uk domain names is routed in accordance with the Nominet UK zone file. The zone file directs traffic to the nameservers responsible for the highest level of the domain name not controlled by Nominet UK. Where Nominet UK operates the relevant SLD, eg .co.uk, the name server will rout the traffic to the computer which the Registrant specifies on the Register for registration at the third level. Where Nominet UK does not operate the relevant SLD, eg .ac.uk, the nameserver routs the traffic to the nameserver organisation that does operate it. The Nominet UK zone file is created anew from the Register each day and placed on Nominet UK's nameservers for Internet traffic direction. These nameservers are hosted by third parties under contract from Nominet UK.
27 Dr Black describes the Register as '... the single repository of information required for the operation of the .uk ccTLD'. He refers to the Register as Nominet UK's 'principal asset' and says that the primary reason for the existence of the company is to manage and maintain the Register accurately in the interests of, but not as an agent of, the UK Internet community.
28 The Nominet UK Register is a compilation Oracle database which is maintained on a Unix platform at Nominet UK's premises in Oxford. It is protected in various ways. There is a security system which uses both hardware and software to protect the network from intruders or hackers. The Register database host is located in a restricted area on Nominet UK's premises and only authorised technical staff are permitted access to it. Access is on a login basis limited to authorised technical staff. Login access to the database host is permitted only by secure shell, a program which uses powerful authentication and encryption. Essential backup tapes of the Register Database are stored in a safe on the premises and access to them is restricted to authorised technical staff. Staff monitor entry to the premises 24 hours a day and the area surrounding the building is monitored by a close circuit television system. Electronic locks controlled by identification cards restrict entry to the premises and access to high security areas inside the premises to people holding appropriate identification cards.
29 Dr Black said that a full copy of the Register database has only been allowed outside Nominet UK's premises in limited circumstances. These were the off-site storage of backups for security purposes which are transported in unmarked vans to an underground private vault. They have also been allowed off the premises to conduct statistical analysis on registration and renewal trends. They have also been allowed off premises for the purpose of discovery in these proceedings. Partial copies of the Register have been distributed for the purposes of a Public Register Subscription Service (PRSS) but only on the contractual condition that direct marketing using the PRSS is prohibited. It contains information for the administration, billing and technical contacts but not registration information fields.
30 As at 1 February 2003, the Register contained records of about 3,800,000 domain names in the Nominet domains. About 3,458,000 of these or 91% of the Register related to domain names in the '.co.uk' SLD. Dr Black summarises the primary purposes of the Register thus:
'(a) provision of a record of the details of Registrants, etc for each of the domain names in the Nominet Domains;
(b) generation of operational zone files for the Nominet Domains; and
(c) provision of a public reference for identifying who has registered given domain names in the Nominet Domains.'
31 The software system used by Nominet UK's predecessors until early 1996 to compile and maintain information on the Register was known as the First Automaton. It was developed during the period that EUNet was managing the .co.uk SLD on a voluntary basis. Early in 1996, the First Automaton was replaced by an improved system called the Second Automaton which was used until July 2000 by Nominet UK to compile information for the Register.
32 From 1 July 1996, Nominet UK used a sub-contractor to manage and operate the Register as part of a phasing in program until it had recruited staff and established its own nameservers. From 1 July 1997 until 1998 or 1999 that agreement was reduced to one of simple leasing by Nominet UK of the computer system on which the Second Automaton and other software operated and which held the Register. From that time employees of Nominet UK maintained the Register and used the Second Automaton on Nominet UK's behalf.
33 Nominet UK formally took control of the Register and began charging a fee for each domain name registration on 1 August 1996.
34 None of the code associated with the Second Automaton has been used by Nominet UK since July 2000. At that time it was replaced by a program called the Third Automaton. The Register then contained a little over 2 million registrations of .uk domain names. The change to the Third Automaton involved a complete rewriting of the code of the Second Automaton using a different programming language. This was done by an external consultant, Tessella Support Services.
35 Dr Black describes the Third Automaton, like the programs before it, as '... in essence a computer software tool maintained and used by Nominet for the purpose of maintaining the Register'. It includes the collection of information for inclusion in the Register and its collation and placement in the Register when new domain names are registered as well as the updating and modification of information relating to existing registrations.
36 The term 'Internet Service Provider' (ISP) refers to a body that provides individual and/or other organisations with access to the Internet and other related services. One category of ISP is called a Tag Holder. These are bodies which provide registration services to their customers and have a tag from Nominet UK which enables them to interface with the Third Automaton on behalf of their customers. A tag is a term for a unique alpha-numeric identifier which is allocated to a Tag Holder and is to be used when communicating with the Third Automaton to enable Nominet UK to identify the source of messages sent to the Third Automaton.
37 The Tag Holders send email messages to Nominet UK regarding new or existing domain name registrations in the Nominet domains. The Third Automaton receives those messages and checks and processes the information contained in them. Domain name applications are processed by the Third Automaton in a matter of seconds. In the period from 1 August 2003 to 31 December 2003, Nominet UK processed a total of 2,105,671 requests through the Third Automaton. This represented an average of 17,845 requests per day.
38 The Third Automaton runs continuously. It is maintained and operated by Nominet UK staff and by contractors of Tessella on behalf of Nominet UK. As at January 2003, its operation was overseen by a senior systems administrator, two further administrators and a software developer. That team was in turn supervised by Nominet UK's Director of Information Technology, Jay Daley and its Chief Technical Adviser, Mr Geoff Sisson. Since February 2003, an additional two systems administrators have been employed to oversee the operation of the Third Automaton.
39 The cost of maintaining and operating the Register and Third Automaton is fully funded by Nominet UK. It raises the majority of the necessary funds by charging registration fees to each Registrant.
40 All of the individuals involved in the maintenance and operation of the Third Automaton are employees of Nominet UK and residents of the UK. Their work is performed at the company's premises in the UK using its equipment and resources and generally during ordinary business hours.
41 A person or organisation wishing to register a domain name with Nominet UK can do so in one of two ways. It can do so directly through Nominet UK or through a Tag Holder. It is unusual to register a domain name directly because to do so requires specialist technical knowledge and equipment. A potential registrant must provide the IP addresses of at least two nameservers permanently connected to the Internet. Registrations through Tag Holders are far more common and usually less expensive for Registrants. Nominet UK charges Tag Holders, who are members of Nominet UK, discounted registration fees for each domain name they register on behalf of a Registrant. Tag Holders are required to obtain a Pretty Good Privacy Key (PGP Key) which is a commonly used software security mechanism based on digital signature technology. They are required to provide Nominet UK with details of the Key. This enable it to authenticate messages which Tag Holders sent to the Third Automaton.
42 Where information sent to the Third Automaton from a Tag Holder relates to an application for a new registration, the Third Automaton will check whether the domain name is the subject of an existing registration. If it is not, the Third Automaton checks to see whether all requisite information has been provided and, if so, creates a new database entry for the domain name sought. If the information concerns a request to modify fields in an existing registration, the Third Automaton will check to see whether the Tag Holder requesting the change is the Tag Holder nominated by the relevant Registrant to maintain the registration. If the answer to that question is in the affirmative, it will then check whether the requested modification is acceptable and able to be completed by a Tag Holder. If it is, the registration for the domain name will be registered.
43 Tag Holders can apply to register new domain names for potential Registrants in any of the SLDs which Nominet UK manages using the REQUEST operation. They can request modifications to an existing domain name registration using the MODIFY operation. They can hand over administration of a domain name to another Tag Holder by using the RELEASE operation. They can apply to renew a domain name on the Tag Holder's tag during the renewal period by using the RENEW operation. They can also apply to check details held by Nominet UK on a domain name registration by using the QUERY operation. Tag Holders can seek cancellation of an erroneous domain name registration before the first invoice has been issued by using the DELETE operation. They can request a list of registrations on the Tag Holder's tag by using the LIST operation and they can request that the Tag Holder's tag be removed from a domain name registration to indicate a permanent end to the Tag Holder's relationship with the relevant Registrant. This is done using a RELEASE operation. Nominet UK can perform equivalent functions directly to the Register.
44 There is a number of functions relevant to the operation of the Register which can only be undertaken by Nominet UK. No Tag Holder can modify the 'registered for' field of a domain name registration. Only Nominet UK can cancel a domain name registration after the first monthly invoice is issued. A Tag Holder can only amend and update the Register Database in relation to domain names currently bearing its tag. It does not have power to make amendments across the entire Database. Only Nominet UK holds and has access to the whole Register. It also provides and updates the instructions for the various Tag Holder operations referred to above. It provides technical support and training to Tag Holders in connection with the use of the Third Automaton. It can override any Tag Holder's ability to make changes. At a Registrant's direct request, it will perform updates or move a domain name to a new tag regardless of whether the existing Tag Holder consents to such amendments. Nominet UK can delete or suspend a Tag Holder's tag. It is the body registered with the UK Information Commissioner in respect of the personal data on the Register. Only Nominet UK can make copies of the Register openly, unchallenged and without asking permission from a third party. If it is notified that there is incorrect information on the Register which invalidates a registration it will delete the domain name. It has engaged in certain 'data cleaning' exercises which include the location of domain name registrations with obviously incorrect data.
45 Since about September 2002, Nominet UK has been conducting an ongoing review of the records of approximately 26,000 Registrants who were registered before it acquired the direct maintenance of the Register. It seeks to identify the Registrant because the information provided to Nominet UK on its formation was frequently incomplete or inaccurate. It attempts to contact the Registrant and requests that the Registrant sign Nominet UK's terms and conditions. If a Registrant cannot be contacted or if a company has been wound up or if it does not agree to the terms and conditions, then Nominet UK will cancel the registration of that domain name.
The WHOIS Database
46 Information about domain name registrations held by generic TLD registries and many ccTLD registries is available through WHOIS services accessible free of charge on the Internet. The availability of such services reflects a commitment by the Internet industry to open access to the identities of Registrants of domain names. This commitment is reflected in a paper published by the Council for European National Top Level Domain Registries (CENTR) on 31 July 2001 in which it was said:
'The members of CENTR consider that their duties involve a public trusteeship, bringing with it the obligation to provide open information on the identifies of the Registrants of Domain Names.
The CENTR members, therefore, support a comprehensive Whois service, which provides (in addition to the technical information required to operate the Internet) the name and postal contact address of the Registrant of the Domain Name as a minimum.'
The policy is supported by the World Intellectual Property Organisation as reflected in a paper dated 20 June 2001, 'ccTLD Best Practices for the Prevention and resolution of Intellectual Property Disputes' and by the Organisation for Economic Co-operation and Development - see paper entitled 'Consumer Policy Considerations on the Importance of Accurate and Available WHOIS Data', published on 2 June 2003.
47 Nominet UK provides a WHOIS service. One of the objects for which the company was established, set out in its Memorandum of Association, is to 'provide facilities for searching the register'. One of its stated core functions includes making information about the Database publicly available.
48 Nominet UK's standard contract with Registrants provides that personal data submitted by a Registrant will be posted to the WHOIS Database. Access to the WHOIS Database is provided on Nominet UK's website and through direct queries to its WHOIS servers. These mechanisms are provided free of charge. The system has been used for all WHOIS queries in the past but is currently intended for use by those making queries on their own behalf. A newer service called WHOIS2 allows members of Nominet UK to provide an interface to the WHOIS service from the member's own website. It is intended for use by those relaying queries by third parties to Nominet UK. Nominet UK has given access to the WHOIS2 software to many of its members on an informal and undocumented basis.
49 According to Dr Black, Nominet UK provides the WHOIS and WHOIS2 services to allow end users to make specific inquiries about the availability or registration of particular domain names within the Nominet Domains. It has not given permission to any person to reproduce, store or transmit the whole or any part of the WHOIS Database or the Register. In 2002, Nominet UK decided that the following notice would be automatically included at the end of every WHOIS and WHOIS2 result message:
'(c) Nominet UK
For further information and terms of use please see http:/www.nic.uk/whois
Nominet reserves the right to withhold access to this service at any time.'
50 The terms of use of Nominet UK's WHOIS service include the following statements:
'You are not allowed to reuse, compile, store or transmit any or all of the WHOIS records unless you have our prior written consent. You are not allowed to conduct automated queries or use this service for advertising or similar activities... By conducting a WHOIS search you agree to be bound by these terms.'
51 Before October 2002, the public WHOIS did not contain address information. From October 2002, Nominet UK started to phase in the address field beginning with commercial organisations.
52 Dr Black says that on average the WHOIS service is queried about 21 million times for .uk domain names each month. Not all the queries relate to domain names actually on the Register as WHOIS is also used to establish whether a domain name is registered or not prior to making an application. Nominet UK creates from the Register a wholly derived WHOIS Database which contains only the fields displayed for a domain name in the results of a WHOIS search. These are the domain name, the identity of the Registrant, the Registrant's address, or a notice that the address is withheld, the date of registration and any modification and renewal and nameserver and agent details.
53 The WHOIS Database is periodically renewed from the Register to ensure that it remains up to date. It is hosted on Nominet UK's machines in London. The database software currently in use was written in 1997 by an employee of Nominet UK and totally rewritten in December 1999. The software automates the updating process so that changes to the main Register are mirrored in the WHOIS Database after a short time delay. Technical staff employed by Nominet UK also make manual corrections or general updates from time to time where it is shown that an error may have arisen. They also monitor abuse of WHOIS by those who make too many queries or make them so fast that the WHOIS system cannot process and respond to them satisfactorily.
54 Dr Black says, and it is not contested, that, as is the case with the Register and the Third Automaton, all of the individuals involved in the maintenance and operation of the WHOIS Database on behalf of Nominet UK are and have been, since the WHOIS Database was established, employees of Nominet UK resident in the United Kingdom. Their work is performed using Nominet UK's equipment and resources and is within the scope of their employment by Nominet UK.
Nominet UK's Reputation
55 In Dr Black's principal affidavit of 15 January 2004 he says, and it is unchallenged, that the development of the DNS and its tree structure means that there could only be one registry organisation for the .uk ccTLD. Nominet UK has been the sole .uk ccTLD registry since 1996 and has compiled and maintains the .uk Register.
56 Although Nominet UK does not promote sales of .uk domain names registration it has taken active steps to communicate with the UK Internet community and to establish itself as an educator and expert on the DNS and the Internet. Since June 1997, the company has used media consultants to promote press coverage of it by the distribution of press releases, the cultivation of contacts with industry journalists and the organisation of limited press events.
57 In early 1998, Nominet UK launched an advertising campaign in the UK national broadsheet press under the slogan 'Is your .uk OK?'. The purpose of the campaign was to educate and remind registrants of the need to renew in order to keep their registrations. Leaflets for registrants were also included with invoices and an advice booklet was written for Tag Holders. The company's website contains a great deal of information about, and regarding, the Register, Nominet UK's operations and the WHOIS service.
58 In an affidavit sworn on 6 April 2004, Dr Black exhibited various publicly available documents to demonstrate that there is widely available information about the existence of domain registries and to illustrate the use of the term 'registry' in the context of the Internet and the DNS. The documents exhibited included printouts from the websites for the German and Japanese ccTLD administrators. These referred respectively to the organisations DENIC and JPNIC as 'the central registry for all domains' under the TLD and 'the National Internet Registry in Japan'. The glossary for Versign, including references to its COMNET Registry and a printout from a question and answer page for the Irish Registry of the .ie ccTLD were also exhibited.
59 Publications exhibited to Dr Black's April affidavit included a section of the US Government White Paper entitled 'Management of Internet Names and Addresses', a Decision dated 21 May 2003 of the Commission of the European Communities on the Designation of the .eu TLD Registry and the Report from the Australian ccTLD Manager, .au.domain Administration Ltd (auDA) dated June 2001. That report was entitled 'Competition Model for the .au Domain Space'. Dr Black also exhibited a printout from websites for ICANN and Inforserve Media and for the Canadian organisation, Canada Web Hosting.
60 Dr Black said that in the case of domain names the term 'registry' refers to the entity which holds the authoritative register of domain names and their proprietorship for a specific TLD and which makes the information available in the standard DNS format. He disagreed with the proposition that the word 'registry' is often used in connection with companies or businesses that offer to facilitate the registration of domain names as distinct from those that maintain a certain registry. There was no challenge to this evidence.
61 I see no reason not to accept Dr Black's uncontroverted testimony which derives from extensive experience and knowledge of the DNS and of the operations of Nominet UK, that there is a large amount of publicly available and readily accessible information concerning national domain name registries and the existence of organisations which operate those registries. While it would be going too far to find that most domain name users know of the existence and identity of the administrator of their national ccTLD in the UK, I find, on the balance of probabilities, that there is a significant number who do even if they may be in a minority. That finding is based on the amount of information publicly available and the publicity campaign conducted by Nominet UK. There is, in my opinion, a further number of domain name registrants who, even if unaware of the existence of Nominet UK, would be aware of the existence of a single administrator responsible for the register of domain names on which they are registered.
Data Mining by Third Parties
62 In an affidavit sworn on 6 April 2004, Jay Daley, the Director of Information Technology for Nominet UK, discussed the basis upon which the WHOIS service may be accessed. He reiterated that the WHOIS service only allows a user to conduct a search of the WHOIS Database by reference to a specific domain name. It is not practicable for third parties to obtain large amounts of information from the WHOIS Database by manual queries. It is possible however for third parties to use computer programs to automate the querying process so that a large number of queries for different domain names can be made in a systematic way. Third parties can then obtain significant amounts of information in the WHOIS Database over a period of time. The third party must have a list of domain names to be used in the queries. Such names can be randomly or systematically generated or obtained from an existing source such as a directory of email or website addresses. The use of automated requests and the extraction of information from databases by repeated requests is known in the Internet industry as 'data mining'.
63 Because they involve a large number of requests, data mining practices create a 'large amount of traffic' into the Nominet UK WHOIS server resulting in its noticeable slowing and an occasional failure. According to Mr Daley, to protect its copyright and information in the Register and the WHOIS Database and to ensure that the WHOIS service operates properly, Nominet UK monitors the activity of the WHOIS server using an automatic system known as CHASM. If this system determines that the WHOIS service is being abused, it contacts the duty member of the systems administrator's team within the IT Department at Nominet UK so that remedial action can be taken. Staff employed within the IT Department also sometimes manually monitor WHOIS traffic.
64 If a particular IP Address is identified as making excessive queries of the WHOIS service, it is Nominet UK's practice to block that IP Address from accessing the system in question. That is done by adding the IP Address to a 'block list' contained in a file in Nominet's computer system. The system then operates to block queries originating from IP Addresses included on the block list. In early 2003, when events relevant to the present proceedings occurred, the block of particular IP addresses in this way was the only mechanism for limiting access to the WHOIS service other than by completely suspending it for all Internet users.
Data Mining in January 2003
65 Jay Daley in his affidavit described data mining events that occurred in January 2003. On or about 8 January 2003, he became aware of high volume queries detected by Nominet UK's monitoring procedures. These automated queries were investigated by staff in the IT Department under his supervision. They appeared to be being made in strict alphabetical order according to the domain names which were the subject of the queries. IT staff looked for queries which appeared to be connected to each other on that basis. Their investigations confirmed that a very high volume of systematic queries was being made. The alphabetic pattern of the queries indicated that they originated from a single external source or a co-ordinated set of sources. The volume of the queries was consistent with a series of automated queries being made by a third party to obtain information from the Register or the WHOIS Database. Mr Daley said that, given the sheer volume of the queries, they must have been facilitated through the use of a computer program. In the light of the evidence and the admissions made in this case, I accept that opinion as correct.
66 Nominet UK's investigations indicated that a number of proxies, computers which pass on queries from one computer to another, were being used to make the queries. During the initial stages, a 'probe' query for the domain name 'michael.co.uk' would be received from numerous proxies. Subsequently a large number of WHOIS queries for different names were received from each of those proxies until Nominet UK blocked access for the IP addresses of those proxies. The pattern was distinctive and after a time any proxy that conducted a WHOIS search for the domain name 'michael.co.uk' was blocked as soon as the search was conducted and before the proxy was able to make further WHOIS searches. The use of michael.co.uk continued even after the third party behind the automated queries stopped following strict alphabetical order.
67 In spite of the initial blocking action, a high volume of queries continued from 8 January 2003 to 23 January 2003. Nominet UK staff added more than 500 IP addresses to the block list to prevent them from accessing WHOIS Database. Some proxies were blocked more than once if the third party which operated the proxy complained that it was unable to access the WHOIS service. Once Nominet UK was satisfied that the high volume automatic queries were no longer being attempted from that address, the block was removed only to be reimposed if the proxy began to make high volume automated queries again at a later stage.
68 The January 2003 data mining episode differed from those previously experienced by Nominet UK in relation to the WHOIS service by virtue of the large number of proxies being used from a wide range of networks. Mr Daley was not aware of any technical reason why such a large number would be used to make queries in this way other than to enable those responsible to avoid detection or to enable a gathering of information from the WHOIS database more quickly by making automated requests through several proxies at one time.
69 The pattern of data mining changed on the morning of 21 January 2003. The repeated use of a range of proxies ceased and instead a very high volume of queries was received by Nominet UK from three IP addresses in a period of less than one hour. The staff of the IT Department were able to identify those addresses. They were source IP addresses and not proxies. Mr Daley was confident of that conclusion because the IP distribution and domain names were characteristic of users of one ISP, in this case Telstra Bigpond, as opposed to network machines such as website proxies. Moreover the addresses were very similar to an IP address which had been referred to Nominet UK by the operators of three different proxies which had previously been blocked.
70 All pre-existing blocks were removed on 21 January 2003 except on two addresses which continued to make high volume automated queries and on certain groups of addresses operated by Telstra Bigpond. A complaint was sent to Telstra Bigpond and emails subsequently exchanged with the Manager of Online Security at that ISP.
71 On the evening of 23 January 2003, the pattern of queries changed yet again. Direct queries made from the three identified IP addresses ceased and the use of proxies resumed. That use resumed at such a high level that at about 11pm on 23 January 2003, Mr Daley decided to disable the WHOIS service in its entirety. It was disabled until 7.45am on 24 January 2003. He described this as 'a drastic and unprecedented step for Nominet'. Nominet UK had never suspended the WHOIS service for that reason previously.
72 Mr Daley was not aware of any further automated queries related to those which had occurred between 8 and 23 January 2003 being conducted once the WHOIS service was resumed on 24 January 2003. He said it was possible that further automated requests of the WHOIS service were conducted at a lower rate, not detected by Nominet UK's systems or staff.
73 I find in the light of the unchallenged evidence and the admissions in the pleadings referred to below, that the data mining of Nominet UK's Database and the WHOIS Database was conducted by and on behalf of Diverse Internet and Internet Payments, the first and second respondents.
The UKIR Notices
74 It is established by admissions on the pleadings that following the data mining exercise, the information obtained from the Database and the WHOIS Database was used to create at least 50,000 documents (UKIR Notices) prepared in Australia by Zipform Pty Ltd (Zipform) and each containing the following information:
- The name of a Registrant in the database.
- The Registrant's address.
3. A .uk domain name which was current as at 20 February 2003 in the name of that Registrant.
Nominet UK alleges in its statement of claim that all the respondents were engaged in creating those documents. Mr Norrish denies this and says it was Mr Rafferty who arranged for the documents to be prepared by (UK) Internet Registry. He denies that Mr Rafferty acted on behalf of anyone other than (UK) Internet Registry.
75 The Notices were each headed up 'UK Internet Registry' above an address, '33 St James's Square London SW1Y 4J5' and an online address 'www.ukinternetregistry.com'.
76 Mr Norrish admits in his defence, the following features of the UKIR Notices pleaded in par 12 of the statement of claim. He does not admit that he was responsible for them or that they were prepared on his behalf or with his authority. The admitted features were:
- Each UKIR Notice was entitled 'UK Internet Registry' and referred to registration or hosting of domain names with UK Internet Registry.
- Each UKIR Notice had the style and presentation of an invoice for services that had been solicited by the Registrant named in it.
- Each UKIR Notice used the word 'UNREGISTERED' near a reference to a .co.uk domain name from the infringing copy.
- Each UKIR Notice had a payment slip for an amount that had not been agreed with the Registrant to be included in it.
- Each UKIR Notice referred to an address in London.
Mr Norrish also admits the documents were collected in Australia by G3 Worldwide Mail (Australia) Pty Ltd, an Australian company, from Zipform and were processed and delivered by G3 Worldwide Mail to the Royal Mail for distribution in the United Kingdom. It is alleged and admitted by Mr Norrish that payments were received by (UK) Internet Registry in Australia from Registrants in response to the UKIR Notices. Further, while denying any personal involvement in the preparation or sending of the Notices, Mr Norrish admits that those things were done without the licence or approval of Nominet UK.
77 As appears from the UKIR Notices in evidence each of them contained a statement to addressees as follows:
'[Registrant's name].CO.UK REGISTRATION ADVICE
Your.com domain corresponding to your registered .com.uk domain is currently UNREGISTERED.
It is important today to have your .com and .co.uk domain names registered, secure your domain for a two year period by providing payment with the slip below.'
There then appeared the following:
'Description Amount
Registration of [Registrant name].com for
2 year period ₤[amount]
Web, URL and email forwarding →[Registrant
Name].co.uk ₤[amount]
Total ₤[amount]'
There then followed the statement:
'Thank you for registering with UK Internet Registry Ltd.'
Below that statement was the heading 'Register your domain for the following:'. This heading preceded a list of reasons for registering a .com domain. They included common confusion by Internet users between '.co.uk' and '.com' extensions for domains.
78 The 'PAYMENT SLIP' appeared at the bottom of the Notices and contained provision for payment by cheque or credit card.
79 On the basis of Mr Norrish's admissions and the documentary evidence of the existence and content of the UKIR Notices, I find that they were created and sent as alleged in par 12 of the statement of claim and that their contents were as set out in the statement of claim.
80 Mr Norrish admits, as alleged in par 15(e), (h) and (j)-(q) of par 15 of the statement of claim, that the UKIR Notices referred to in the statement of claim as UKIR invoices, falsely represented that: