First, let me make clear that I am counsel to Tucows in certain limited matters, and that precisely these sorts of issues are regularly referred by Tucows to my attention.
Second, Tucows policy may be more flexible than you believe it to be. Whether Tucows would implement the actions of some legal authority in Djibouti will also depend on whether the reseller or you were located in Djibouti. Tucows does not have a direct registrar relationship with its registrants (outside of Hover.com), but it does have resellers whom Tucows expects to comply with the law of wherever they are.
That's why Tucows, and others in the space, will typically refer to "competent jurisdiction" than saying, e.g. "Canada". Obviously, people are subject to the law of wherever they happen to be, so if a reseller or registrant is in Djibouti, and some legal authority in Djibouti takes action in relation to that reseller or domain registrant, Tucows will generally abide by that authority in relation to that domain name and that registrant.
Uniregistry did the same thing (unsurprisingly). If someone showed up with an administrative warrant, investigative subpoena, or other non-court mechanisms regularly used in criminal investigations, they would generally have to coordinate with the Cayman Office of the Director of Public Prosecutions absent some apparent connection between the registrant and the issuing jurisdiction, among other considerations.
My company, based in Toronto,
is the reseller for all of my company's domain names at Tucows, naturally.
Registrant = Toronto, Ontario, Canada
Reseller = Toronto, Ontario, Canada
Registrar (Tucows) = Toronto (and perhaps more, see below)
According to:
https://tucowsdomains.com/help/legal-submissions/submitting-court-and-legal-documents-to-tucows-inc/
Can non-Canadian-based court documents be submitted?
Yes. Tucows will accept court documents from Canada, Denmark, Germany, and the U.S.A.
https://tucowsdomains.com/help/legal-submissions/
Valid Subpoenas
If you seek the registrant information of a Tucows registrant in connection with a civil legal matter, please attach the valid subpoena here. Valid subpoenas are those issued by (a) any Canadian federal, provincial, or municipal, (b) any Danish County or High Court, (c) any German federal or local court, (d) any U.S. federal, state, or county.
Tucows will not respond to subpoenas or analogous discovery mechanisms issued by any other jurisdiction unless they are domesticated into one of the above-listed jurisdictions.
[they missed the word "court" after the word "municipal" in (a), and after "county" in (d); I thought I copied/pasted incorrectly....]
So, Denmark, Germany and the USA might also be in play, due to Tucows' presence in those jurisdictions (eNom = USA, Ascio = Denmark & Germany; and I think they were incorporated in Pennsylvania; plus Ting is in the USA). Whether they would consider Denmark/Germany to be competent jurisdictions for domains not registered at Ascio (i.e. registered at Tucows/OpenSRS or eNom), where the registrant/reseller has no connection to Denmark/Germany, is unclear.
But, going back to Verisign as registry operator, their decision calculus will not always be the same as the registrar (and it's at Verisign's sole discretion, with limited or no recourse for the registrant). If they open an office in India or China, perhaps that would affect their decision.... and guess what....
Verisign has historical SEC filings listing their subsidiaries. In 2019 (the latest I could find):
https://www.sec.gov/Archives/edgar/data/1014473/000101447320000006/vrsn-20191231x10kxex21.htm
Name of Subsidiary | Jurisdiction |
eNIC Cocos (Keeling) Islands Pty Ltd | Australia |
eNIC Corporation | U.S. - Washington |
Global Registration Services Limited | United Kingdom |
The .TV Corporation International | U.S. - Delaware |
The .TV Corporation (Tuvalu) Proprietary Co. Ltd | Tuvalu |
VeriSign Global Holdings Limited | United Kingdom |
VeriSign Holdings Limited | Cayman Islands |
VeriSign India Private Limited | India |
VeriSign International Holdings, Inc. | U.S. - Delaware |
VeriSign Internet Services Sàrl | Switzerland |
VeriSign Internet Technology Services (Beijing) Co. Ltd. | China |
VeriSign Naming and Directory Services LLC | U.S. - Delaware |
VeriSign Netherlands B.V. | Netherlands |
VeriSign Sàrl | Switzerland |
VeriSign Services India Private Limited | India |
VeriSign Switzerland SA | Switzerland |
(emphasis added)
And even simpler on this page it says:
https://www.verisign.com/en_US/company-information/contact-us/index.xhtml
Verisign has business offices in North America, India, China, Switzerland, the United Kingdom and Australia.
(emphasis added)
Obviously the Tuvalu ones are likely goners, given GoDaddy took over .TV. But, notice there's India, China, Switzerland, the Netherlands, and the Cayman Islands in the list of subsidiaries, and business offices of India, China, etc.
So, what's Verisign going to do, if they had a bank account in the Cayman Islands holding many millions of dollars (gotta optimize global taxes!) and the Cayman Islands government gave them an order involving a registrant in Tokyo, Japan with a Japanese registrar (a country not in the above list)? Are they going to take one for the team and tell the Cayman Islands government "go to Japan"?
Same example, but now with the Chinese or Indian governments, where they have business offices. ????!!!???
With that litigation involving the registrars and India, we might find out the answer, should the Indian government escalate it to Verisign, since the offending text is already active in the .com agreement! (if some of the domain names in dispute are .com)
[As for Uniregistry, they did have a Newport Beach, California office, so I would think US court orders would be respected. It'd be interesting to know what GoDaddy considers, given they have subsidiaries and offices in a lot of places...]
The folks at Facebook should be worried, if/when the registry operator has such powers. As folks will remember, they setup their own registrars (RegistrarSafe/RegistrarSEC, see the WHOIS of fb.com, meta.com, etc.):
https://registrarsec.com/
as a risk mitigation strategy. Their strategy is
thwarted if a government, etc. can go straight to Verisign, and if Verisign finds that government order acceptable (i.e. competent jurisdiction, etc.) in situations Facebook would not have found it applicable.
Anyhow, this is a complex topic, and I'm glad folks are starting to become more aware of these issues, since it was overlooked by most in 2020. Do the set of sloppy sentences in the .net proposed agreement (and in the active .com agreement that they sneaked through in 2020) adequately protect registrant interests? I think not!