Wednesday, July 20, 2011

How to steal a ccTLD: Dr Oscar Moreno and the theft of .pr ccTLD

 Apparently, if you are an administrative contact at a ccTLD, it's very easy to "steal" the ccTLD without ICANN noticing. This is what happened for Puerto Rico's .pr.

Dr Oscar Moreno(Centre) with Vint Cerf and Paul Twomey during the signing of the Puerto Rico Accountability Framework in 2007
.pr was managed by the University of Puerto Rico(UPR) under the stewardship of Dr Oscar Moreno, a proud member of the ccNSO. "To help support the administrative roles associated with the ccTLD, the University created an unicorporated(loophole) administrative unit within the university, which it named Gauss Research Laboratory" reports the University in a letter to ICANN.
 During that time and from IANA records, the ccTLD was delegated to
 University of Puerto Rico
Gauss Laboratory
Facundo Bueso Building
Office 265
Rio Piedras 00931
Puerto Rico 

But the wily Dr Oscar Moreno knew there was a way out, he could own .pr. When he retired from the University, he cleverly registered a non-profit organization appropriately named Gauss Research Laboratory Inc(Note that Gauss Laboratory was the lab under the University of Puerto Rico that previously hosted the .pr ccTLD.) and then he casually informed ICANN that .PRs contact address had changed. In short. ICANN was hoodwinked into buying into his fraudulent activities;  it's like the managers of casually informing ICANN that they have moved and changed their contact details.
No re-delegation proceeding was initiated because in the eyes of ICANN, there was no need, it was just a simple change of address; which further goes on to show the big loopholes at ICANN in the management of ccTLDs.

It is ironic that in his ICANNWiki profile, he is listed as working "with .pr, the ccTLD of Puerto Rico; the ccTLD is managed at high Performance Computing Facility at the University of Puerto Rico, and the school has partnered with GRL Inc. for the work" Note how he spins this: the university has "partnered" with GRL!

Reports DomainIncite: That’s the Sponsoring Organization. The administrative and technical contacts also stated that UPR was in charge of the domain. The contact email address was, the University’s domain.
Today, the IANA record is quite different:

Gauss Research Laboratory Inc.
Calle Vesta 801
San Juan 00923
Puerto Rico
The University is no longer listed. The contact email addresses are now These new details have been in effect apparently since some time in 2007.
 Since then, Dr Moreno has made a cool $2 million in the sales of .pr domains and now he wants out. With the registration and renewal fee for a .pr second level domains at $1,000 USD and that of third level at $100, the figure of $2million could be an understatement. He is attempting to sell the Gauss Labs which has since been converted into a for-profit/ full fledged company.Here's one of the .pr websites

The university has even reached out to Dr Moreno for some kind of agreement on a transition of responsibility of managing the ccTLD back to the University but "consistent with his practice during his tenure at the University, Dr Moreno has failed to cooperate with, let alone respond to, the University's outreach". This greedy man is a menace to the internet fraternity!

This is a big lesson to the weaker African ccTLDs some of which are currently embroiled in a struggle for re-delegation. There's need for great vigilance in the administration of the nations' internet resources.