Imagine sitting down at your computer on Monday, heading to your company's website and finding nothing but a page of lurid links to pornographic websites.
You write an email to find out what is going on, but it fails to send. In fact, you can't access email at all. Someone calls the people you originally bought the Internet address from. They ring back soon afterwards and tell you, unfortunately, there's nothing they can do, and you are unlikely to get your name back for at least two years - if ever. Meanwhile, you are being called by customers, clients and friends, all of whom want to know why they are being directed to "sexy live cam action".
This worst-case scenario has already occurred many times: a cub scout pack in Virginia (pack216.org) has had its website replaced with nothing but porn ads; and a rape crisis centre in New York (crisiscentersyr.org) became a giant billboard for sex toys and adult websites. Only this month, a website dedicated to helping those with a language impairment to communicate online (wwaac.org) was again replaced with a link farm offering sex and not much else.
Yet while reprehensible, such online landgrabs are legitimate as in most cases people have allowed their domain names to lapse, whether knowingly or by accident. What's more, new Internet technologies have made it increasingly simple and profitable to do. Concern has reached such heights that many big companies are now pushing for changes in the basic rules governing domain names before the situation gets out of hand.
"The rape crisis centre was the most outrageous misuse of a former name," says David Maher, the head of policy and law at Public Interest Registry, the organisation that runs all dot-org domains. "PIR doesn't have a positive or negative view of a secondary market in domain names. What we are concerned about are these unfortunate results that have come about partly because of the automated systems. It is a growing phenomenon."
To understand why it has suddenly become worth people's while to grab old domains, you need only look at Google. "Pay per click" technology makes it feasible for advertisers to pay a very small fee every time someone clicks on an agreed link that leads to their website. Google has used this to make billions from its search engine.
But the same technology has also created a black market in "link farms" - sites packed full of those agreed links - and domain name speculation. A certain percentage of people who visit a website, even if they don't find what they expected, will click on an advertising link there, and each click will pay the website owner anything from 1c to 50c. If the overall income over the course of a year exceeds the cost of the domain (typically $6), the domain is profitable.
In this strange bubble of economics, the domain's name is irrelevant, as is what may have been posted there for years before. In fact, the more respected a website is, the more links to it have been formed over time, and the greater its value is to the link farmer. The link farmer may not even know what material was on the site previously; he simply grabs the domain and fills it with the highest-paying links (typically from the adult industry).
Link farms are often built by people who buy scores of domains at once, fill them with links, and then see which ones make money. Those which don't are quickly sold back to domain registrars under existing rules.
Education the solution
One solution proposed by PIR to stop the worst of the automated excesses is to charge a tiny fee - 5c (2.6p) - when more than 90% of domains registered by one organisation are returned within five days. But that is only a partial solution to part of the problem. Far more important is educating users.
"We've launched an educational programme to non-commercial users pointing out that if you let your domain be deleted or neglect to renew it, you can get into trouble," explains Maher. The rape crisis centre domain was allowed to lapse because it was twinned with another centre, and a new domain was used. Likewise, the wwaac.org domain was shifted over to "wwaac.eu", and the original .org forgotten about. Ask either organisation if they would have preferred to pay $10 to keep their older domain and redirect it for a year or two to the new website, and the answer will be a resounding yes.
Camille Ede, director of domain services at the world's biggest registrar, GoDaddy, agrees with Maher that education is the best solution. "The real solution to this issue - because it does happen frequently - is educating registrants when they register the domain name to make sure that they are in fact the registrant for the domain name," she explains. "Make sure that it reflects them, that it reflects their company, so if their account is compromised they can still provide evidence that they have all rights to the domain name so they can gain access to the account."
The biggest common error is when the email address given during registration is either changed, or not watched, or belongs to someone who has since left the company. As a result, the warning notices sent out about the domain's expiration are not received and the first anyone knows about it is when their website disappears.
This happens more often than you'd like to think. "We get about 60 to 70 requests a day," explains Ede. The problem is so widespread that GoDaddy has introduced a $24.99 annual fee for which it will add an extra level of protection to your domain. Even if you fail to renew your domain or respond to any emails, it will keep your domain name for a year, giving you plenty of time to notice.
But it's not all expiring domains, Ede warns. Sometimes a business arrangement breaks down and a domain name - and hence the company website - is used as a pawn. Sometimes out-of-pocket or unscrupulous website builders refuse to hand over control. And sometimes it's calculated theft: someone will check to see if the registering email address - especially if it is a Hotmail or Yahoo free account - has expired. If it has, they re-register the email address and use that to transfer the domain through the system.
As ever with the Internet, technological advances are forcing the rest of the world to to catch up, even when the organisations themselves are part of the Internet industry. Aside from the various protections now included by registrars (often, it should be noted, for an extra fee), some are calling for changes to the way in which the domain name system works.
The Internet's overseeing body Icann, which is in ultimate charge of the domain name system, has responded by ordering an independent review of the domain name market at a board meeting earlier this month. A "reputable economic consulting firm" will be asked to look into issues and make recommendations.
With that report at least eight months away, however, you would do well to check on the details of your own domain name and makes sure it really is safe.
• Securing your domain
1. Make sure the registrant information is correct and the email address is current.
2. Do not share the password unless you have to. Consider putting one person in charge of renewing domains.
3. Ask your registrar to 'lock' your domain so it can't be transferred without a further security check