2001: Code signing certificate mistake In January 2001, Verisign mistakenly issued two Class 3
code signing certificates to an individual claiming to be an employee of
Microsoft. The mistake was not discovered and the certificates were not revoked until two weeks later during a routine audit. Because Verisign code-signing certificates do not specify a Certificate Revocation List Distribution Point, there was no way for them to be automatically detected as having been revoked, placing Microsoft's customers at risk. Microsoft had to later release a special security patch in order to revoke the certificates and mark them as being fraudulent.
2002: Domain transfer lawsuit In 2002, Verisign was sued for
domain slamming – transferring domains from other registrars to themselves by making the registrants believe they were merely renewing their domain name. Although they were found not to have broken the law, they were barred from suggesting that a domain was about to expire or claim that a transfer was actually a renewal.
2003: Site Finder legal case In September 2003, Verisign introduced a service called
Site Finder, which redirected Web browsers to a search service when users attempted to go to non-existent or domain names.
ICANN asserted that Verisign had overstepped the terms of its contract with the
U.S. Department of Commerce, which in essence grants Verisign the right to operate the
DNS for and , and Verisign shut down the service. Subsequently, Verisign filed a lawsuit against ICANN in February 2004, seeking to gain clarity over what services it could offer in the context of its contract with ICANN. The claim was moved from federal to California state court in August 2004. In late 2005, Verisign and ICANN announced a proposed settlement which defined a process for the introduction of new registry services in the registry. The documents concerning these settlements are available at ICANN.org. The ICANN comments mailing list archive documents some of the criticisms that have been raised regarding the settlement.
2003: Gives up domain In keeping with ICANN's charter to introduce competition to the domain name marketplace, Verisign agreed to give up its operation of top-level domain in 2003 in exchange for a continuation of its contract to operate , which, at the time had more than 34 million registered addresses.
2005: Retains domain In mid-2005, the existing contract for the operation of expired and five companies, including Verisign, bid for management of it. Verisign enlisted numerous IT and telecom heavyweights including Microsoft, IBM, Sun Microsystems, MCI, and others, to assert that Verisign had a perfect record operating . They proposed Verisign continue to manage the DNS due to its critical importance as the domain underlying numerous "backbone" network services. Verisign was also aided by the fact that several of the other bidders were based outside the United States, which raised concerns in national security circles. On June 8, 2005, ICANN announced that Verisign had been approved to operate until 2011. More information on the bidding process is available at
ICANN. On July 1, 2011, ICANN announced that VeriSign's approval to operate .net was extended another six years, until 2017.
2010: Data breach and disclosure controversy In February 2012, Verisign revealed that their network security had been repeatedly breached in 2010. Verisign stated that the breach did not impact the
Domain Name System (DNS) that they maintain, but would not provide details about the loss of data. Verisign was widely criticized for not disclosing the breach earlier and apparently attempting to hide the news in an October 2011 SEC filing. Because of the lack of details provided by Verisign, it was not clear whether the breach impacted the certificate signing business, acquired by Symantec in late 2010. Some, such as Oliver Lavery, the Director of Security and Research for nCircle, doubted whether sites using Verisign SSL certificates could be trusted. As registry operator for , Verisign performed the required takedowns of the 82 sites under order from law enforcement.
InformationWeek reported that "Verisign will say only that it received sealed court orders directing certain actions to be taken with respect to specific domain names". The removal of the 82 websites was cited as an impetus for the launch of "the Dot-P2P Project" in order to create a decentralized DNS service without centralized registry operators. Following the disappearance of
WikiLeaks during the following week and its forced move to wikileaks.ch, a Swiss domain, the
Electronic Frontier Foundation warned of the dangers of having key pieces of Internet infrastructure such as DNS name translation under corporate control.
2012: Web site domain seizure In March 2012, the U.S. government declared that it has the right to seize domains ending in , , , , , and if the companies administering the domains are based in the U.S. The U.S. government can seize the domains ending in , , , , and by serving a court-order on Verisign, which manages those domains. The domain is managed by the
Virginia-based non-profit
Public Interest Registry. In March 2012, Verisign shut down the sports-betting site Bodog.com after receiving a court order, even though the domain name was registered to a Canadian company. == References ==