Nominet UK Dispute Resolution Service

                  DISPUTE RESOLUTION SERVICE
                                   DRS 7871

                          Decision of Independent Expert




                               SMS Passcode A/S

                                         and

                              SecurEnvoy Limited




1.         The Parties:
Complainant:          SMS Passcode A/S
Address:              Park Allé 350D
                      2605 Brøndby
Postcode:
Country:              Denmark


Respondent:           SecurEnvoy Limited
Address:              1210 Parkview Arlington Business Park
                      Theale
                      Reading
Postcode:             RG7 4TY
Country:              GB




2.         The Domain Name(s):
smspasscode.co.uk




28682047                                                      1

3.         Procedural History:

28 October 2009        - Dispute received
29 October 2009        - Notification of complaint sent to parties
19 November 2009       - Response received
27 November 2009       - Reply received
27 November 2009       - Mediator appointed
02 December 2009       - Mediation started
03 February 2010       - Mediation failed
05 February 2010       - Expert decision payment received
12 February 2010       - Chris Tulley appointed as Expert



4.         Factual Background
Both parties are in the business of providing user authentication products which use a
mobile phone's text messaging function to provide unique "one time" code numbers to
identify a user when remotely logging into a network. Both parties operate on an
international basis and compete with one another at least to some extent.

The Complainant is a Danish company which was incorporated on 27 June 1999. It has
carried on business under the name SMS Passcode A/S since 2006. The Complainant owns
a registered Community Trade Mark: no. 5713425 dated 25 February 2007 for -�sms
passcode-� in lower case registered in classes 9 and 42. The Complainant-�s main website is
at www.smspasscode.com. This domain was registered on 26 January 2006.

The Respondent is a British company which was incorporated on 14 August 2003. It
claims to have made fair descriptive use of the term SMS PASSCODE since it was
incorporated in 2003. The Respondent registered the Domain Name on 21 November
2008. At least as of 16 July 2009 the Domain Name was used to resolve to the
Respondent-�s own website at www.securenvoy.co.uk.

5.         Parties-� Contentions

There have been extensive submissions and supporting documentation filed by the
parties.

Complainant:

In its Complaint, the Complainant says in summary that:

1. The Complainant is a Danish company which was incorporated on 27 June 1999. The
Complainant-�s primary name is -�Conecto A/S-� and its secondary name is -�SMS Passcode
A/S-�. The Complainant is entitled to use either name and has carried on business under
the name SMS PASSCODE since 2006.

2. The Complainant owns a registered Community Trade Mark: no. 5713425 dated 25
February 2007 for the term -�SMS PASSCODE-� in classes 9 and 42. Despite the
Respondent's challenge to its validity, the registered trade mark must be presumed to be
valid unless it is decided otherwise.

3. The Complainant-�s main website is at www.smspasscode.com. This domain was
registered on 26 January 2006.



28682047                                                                               2

4. The Complainant also relies on common law rights. By virtue of its extensive trading
and marketing activities the Complainant has acquired substantial reputation and
goodwill in the name SMS PASSCODE such that it is recognized by the public as distinctive
of the Complainant-�s business. In particular:

-�   the Complainant has sold thousands of licenses since its inception;

-�   its turnover in 2007 was almost one million Euros and during 2008 was substantially in
    excess of that amount. Virtually all of this related to the SMS PASSCODE product;

-�   exhibits have been produced showing that the Complainant has used SMS PASSCODE
    as a trade mark (including the -�r-� circle symbol) on such things as installation guides,
    price lists and brochures;

-�   the Complainant has also attended and exhibited at various international trade
    conferences;

-�   the Complainant has advertised in industry publications and issued various press
    releases under the SMS PASSCODE brand;

-�   the Complainant has approximately 100 resellers worldwide who help promote the
    SMS PASSCODE brand. These resellers also advertise under and promote the SMS
    PASSCODE brand;

-�   the Complainant-�s customers and partners are located worldwide, principally in
    locations such as Denmark, Norway, Sweden, Finland, Germany, Switzerland, Austria,
    Holland, Belgium, United Kingdom, Germany, Turkey and other EMEA (Europe, Middle
    East and Africa) based countries as well as in select markets overseas including
    Australia, North America and Asia. The customers include well-known global
    companies such as Ikano Finance, Dong Energy, Avis Car Rental, Hertz Car Rental,
    Danish Crown, UPM, KPN, Stratten Finance, Wolseley and SSP;

-�   the Complainant and its SMS PASSCODE product have also received industry
    recognition and awards such as in April 2009 "Red Herring" magazine named the
    Complainant a winner of the Red Herring 100 Europe, an award given to the top 100
    private technology companies based in the EMEA region each year. In October 2009,
    Secure Computing Magazine named the Complainant and its SMS PASSCODE product
    as one of the five most innovative solutions in the information security landscape; and

-�   a Google search against the term -�SMS Passcode-� shows that all references relate to
    the Complainant (except for one sponsored advertisement by the Respondent.)

5. It is well established under the DRS Policy that the threshold for establishing -�Rights-� is
a low one. Whilst the individual words SMS and PASSCODE may be descriptive, the
combined term is not a common one (a view that was clearly shared by OHIM) and in any
case the term has become distinctive of the Complainant-�s business arising from its
extensive use described above. The Complainant relies on the previous decision in
myspace.co.uk DRS 4960 and says that the term SMS PASSCODE is, like MY SPACE, no
more than "mildly suggestive" at most.

6. The Respondent is a direct competitor of the Complainant. On 26 March 2008 the
Respondent registered the Danish domain securenvoy.dk and thereafter launched a
version of its website in Danish. The Respondent registered the Domain Name on 21
November 2008. At around the time of registration of the Domain Name, both the


28682047                                                                                    3

Complainant and Respondent were competing for the business of two clients, one of
whom was a Norwegian company Edda Media AS.

7. As of 16 July 2009 the Domain Name resolved via a redirection to the Respondent-�s
website at www.securenvoy.co.uk. The Complainant-�s solicitor sent a cease and desist
letter dated 17 August 2009. The Respondent-�s solicitors replied on 8 September 2009
saying that the Respondent objected to the validity of the Complainant-�s registered trade
mark and that it had deactivated the website as an interim measure while it considered
the matter. However, the Respondent did not offer to transfer the Domain Name to the
Complainant.

8. The Respondent clearly set out to attract business intended for the Complainant. Such
activity by the Respondent presupposes that the Complainant-�s business was known and
identified by its name.

9. The Domain is identical to the Complainant-�s trade mark SMS PASSCODE, disregarding
the domain suffix.

10. The Complainant has no association with the Respondent and has never authorized or
licensed the Respondent to use its trade mark.

11. The Respondent was clearly aware of the Complainant and its business and had the
Complainant and its business in mind when registering and using the Domain Name. This
is evident from the fact that the Respondent-�s communication of 8 September 2009 did
not deny this, the Respondent is a direct competitor of the Complainant which is
internationally well-known as a major player in mobile authentication technology, the
Respondent started operating in Denmark, the Complainant-�s home territory, only eight
months before it registered the Domain Name, and the Respondent chose to register the
Domain Name not long after its expansion into Denmark and at around the time that
both parties were competing for the same business. Accordingly:

-�   the Domain Name was registered as a blocking device to prevent the Complainant
    from reflecting its trade mark in the Domain Name;

-�   the Respondent registered the Domain Name for the purpose of unfairly disrupting
    the business of the Complainant by attracting its business and diverting it to the
    Respondent; and

-�   the website associated with the Domain Name was essentially a scheme adopted by
    the Respondent to confuse, attract and profit from internet users who are searching
    for the Complainant-�s business in search engines, web browsers and otherwise on the
    internet.

The Respondent:

In its Response, the Respondent in summary says:

1. The Respondent is a British company which was incorporated on 14 August 2003 and is
a global leader in the industry. The Respondent came up with the idea of sending a
passcode to a mobile phone via SMS (short message service) messages and has patents
pending since 2002.

2. The term -�SMS PASSCODE-� is descriptive or generic in the field of SMS based passcode
authentication and the Respondent has made fair use of the term since it was
incorporated in 2003. The term -�SMS PASSCODE-� is made up of two descriptive English



28682047                                                                               4

terms, -�SMS-� meaning short message service and -�PASSCODE-� meaning a string of
characters, usually numbers, for authenticating a user. The term SMS PASSCODE is more
apt than any other term to describe passcodes which are sent via SMS messages and
hence to indicate the kind or purpose of products and services relating to SMS based
passcodes. It is a term which conveys a purely informational message about the products
or services and is not capable of functioning as a trade mark to indicate the commercial
origin of products or services relating to passcodes sent by SMS. Such a wholly descriptive
term as SMS PASSCODE is incapable of generating a secondary meaning or secondary
rights as allowed for under the Policy.

3. The Respondent was not aware that SMS PASSCODE had been registered as a trade
mark until it received a letter of 17 August 2009 from the Complainant-�s solicitors and
had no reason to think that a descriptive term which had already become established in
the authentication sector could be registered as a trade mark for products and services in
that sector.

4. The Respondent was not the only entity in the industry to have used SMS PASSCODE to
refer to passcodes sent via SMS messages. These other entities include Signify Solutions
Limited (-�Signify-�), one of the Respondent-�s main UK-based competitors, and BT, one of
the main telecommunications providers in the UK. Documents are exhibited showing use
of SMS PASSCODE by Signify, BT and other entities in the period before and after the
filing date of the Complainant-�s Community trade mark.

5. OHIM was wrong to register the trade mark because it was a descriptive term which was
already being used in the authentication sector and the Respondent has now applied to
OHIM to invalidate the Complainant-�s registration on the grounds that it is descriptive
and devoid of distinctive character.

6. The Complainant has no enforceable rights in SMS PASSCODE as a trade mark in the
United Kingdom. Article 12 of the Community Trade Mark Regulation (Council Regulation
EC No. 207/2009) limits the effects of a Community trade mark and says that:

           -�A Community trade mark shall not entitle the proprietor to prohibit a third party
           from using in the course of trade-�.(b) indications concerning the kind, quality,
           quantity, intended purpose, value, geographical origin, time of production of the
           goods or of rendering of the service, or other characteristics of the goods or
           service.-�provided he uses them in accordance with honest practices in industrial
           or commercial matters-�.

7. Accordingly, the Complainant-�s Community trade mark is not enforceable against the
Respondent because the Respondent is using -�SMS PASSCODE-� to indicate the kind or
intended purpose of the products and services which it offers, namely, software relating to
passcodes sent by SMS messages for the authentication of access to computer systems,
databases and electronic mail services.

8. The claims made in paragraphs 6 to 13 of the complaint are irrelevant because they are
concerned with matters outside of the UK and the present dispute concerns a UK domain
name. In particular:

-�   the Respondent has not encountered the Complainant in any competitive bid for SMS-
    based passcode authentication software in the UK;

-�   within the UK, which is the territory of the disputed domain name, the Respondent has
    far more resellers than the Complainant and hundreds of customers for its software,




28682047                                                                                   5

    with over 100,000 end users, including many well-known names such as John Lewis, T
    Mobile, Unipart, National Health Service, and local councils; and

-�   the Complainant-�s Exhibit 12 shows the result of a Google search for -�SMS
    PASSCODE-� from the web but a search by the Respondent of pages from the UK on 5
    November 2009, shows only two -�hits-� referring to the Complainant, four -�hits-�
    referring to the Respondent, and four -�hits-� for other entities which are unrelated to
    the Complainant and which are also using -�SMS PASSCODE-�.

9. The Complainant has not demonstrated an enforceable common law right in the
United Kingdom. The majority of the submissions made by the Complainant relate to its
alleged use of SMS PASSCODE outside of the United Kingdom. As far as the United
Kingdom is concerned, the term -�SMS PASSCODE-� is a good illustration of the point made
by the House of Lords in Office Cleaning Services Limited v Westminster Window and
General Cleaners Limited (1946) 63 RPC 39 HL, which highlights the pitfalls facing traders
who use words in common usage as trade names and says that they must run the risk of
confusion -�unless the first user is allowed unfairly to monopolised the words-�. In this case,
the Complainant is not the first user but -�SMS PASSCODE-� is a term in common use in the
authentication industry and it would be unfair if the Complainant monopolised the term.

10. The threshold for establishing rights under the DRS Policy may be low but it is not so
low as to confer rights on solely descriptive terms such as SMS PASSCODE, SHOESHOP or
INTERNET SERVICE PROVIDER.

11. The Respondent registered thirty-six domain names in March 2008. The Respondent
also launched a multi-countries website with thirty micro-sites for many countries across
the world. The site for Denmark was not created and launched in isolation but was part of
a worldwide export strategy using the Respondent-�s corporate image and standard web
page layout. The document making up the Complainant-�s Exhibit 13 has been cropped to
remove all reference to the Respondent-�s name and product range.

12. The Respondent registered the Domain Name on 21 November 2008 as part of an
expansion of the Respondent-�s web strategy, which involved registering domain names
containing technical terms widely used in the authentication industry and indicative of
the Respondent-�s products. The following domain names were also registered as part of
this strategy:

-�   mysecurenvoy.com;

-�   saveon2fa.com;

-�   secureenvoy.com;

-�   tokenlessauthentication.com; and

-�   vpn2fa.com

13. Using the Domain Name to resolve to its own website was not an attempt to copy a
rival company-�s website. It was simply a linking back of a domain name containing a well-
known technical phrase to the Respondent-�s main website. The evidence making up the
Complainant-�s Exhibit 15 has been clipped to delete the part which shows the
Respondent-�s name, logo and products.

14. There was no need for the Respondent to offer to transfer the Domain Name to the
Complainant in the response to the cease and desist letter because the term -�SMS


28682047                                                                                   6

PASSCODE-� is widely used in the authentication industry and is free for anyone to use as a
descriptive term. The Respondent deactivated the link from the disputed Domain Name to
its website as an interim precautionary measure and the response made it clear that this
was done to avoid the unnecessary costs of a complaint which has now been made.

15. The Domain Name is not an Abusive Registration, and in particular:

-�   the Respondent denies that it set out to attract business intended for the
    Complainant. The registration of the Domain Name was an exercise of the
    Respondent-�s freedom to use a purely descriptive term to attract customers of
    products for which SMS PASSCODE is an apt description;

-�   the Domain Name is generic or descriptive and the Respondent is making fair use of it
    and has done so since 2003, long before it was aware of the Complainant-�s cause for
    complaint and, indeed, before the Complainant-�s Community trade mark was
    registered;

-�   the Respondent denies that its registration of the domain name was intended to
    prevent the Complainant from reflecting its trade mark in the Domain Name because
    the Respondent did not know of the Complainant-�s trade mark when the Domain
    Name was registered and considered it a descriptive term;

-�   the Respondent denies that it registered the Domain Name unfairly to disrupt the
    business of the Complainant as the Respondent had already been using SMS
    PASSCODE in its descriptive sense for six years before it received the letter of 17
    August 2009 from the Complainant-�s solicitors. If anything, the Complainant-�s
    registration of SMS PASSCODE as a trade mark is an attempt to block the legitimate
    use of the term by competitors and this is one of the grounds on which the
    Respondent is seeking to invalidate the Complainant-�s Community trade mark;

-�   the Complainant has alleged that the Respondent was aware of the Complainant and
    its business when the Domain Name was registered but the Respondent had not
    encountered the Complainant in any competitive bids for business in the UK;

-�   the Respondent denies the allegation that the Domain Name was a scheme to use,
    attract and profit from internet users who are searching for the Complainant-�s
    business. SMS PASSCODE is a purely descriptive term and the use of the Domain
    Name was to help prospective customers find the appropriate software. It was made
    absolutely clear to anyone entering the Respondent-�s website via the Domain Name
    that they had been directed to the Respondent-�s web page, with the Respondent-�s
    logo and product range. The logo and product information on the Respondent-�s
    website has remained unchanged since 2007 and the printout on pages 1 and 2 of the
    Complainant-�s Exhibit 15 is not a true reflection of the Respondent-�s website because
    it has been deliberately cropped to remove the logo and product range;

-�   the fact that the Respondent-�s communication of 8 September 2009 did not contain
    any express denials is not an admission of any of the Complainant-�s allegations. The
    Respondent felt that the obvious descriptive meaning of SMS PASSCODE and that
    fact that it had already been using the term for several years meant that there was no
    case to answer; and

-�   at no time did the Respondent register the Domain Name to divert business from the
    Complainant. It was always made clear to anyone entering the Respondent-�s website
    via other domain names that they had entered the Respondent-�s own website by the
    use of the Respondent-�s logo and list of products. The Respondent-�s website has thirty


28682047                                                                                7

    local country sites or pages, including the page for Denmark which has remained
    unchanged, apart from dynamic news content, since July 2008.

The Complainant's Reply

In its Reply, the Complainant says in summary that:

1. It does not accept that the Respondent is a -�global leader-� or a major player in the
industry but does accept that it is a competitor.

2. The Respondent has provided no proof that it -�came up-� with the idea of sending a
-�passcode-� to a mobile phone via SMS or of patents pending since 2002, predating the
Respondent-�s incorporation.

3. The Respondent's evidence supporting its claim of -�fair use-� since 2003 consists of a
few, very lengthy, and apparently internal, documents. The exhibit does not appear to
include evidence of public use. The Respondent has not identified particular references
and, while the Complainant has found a few, it sees nothing indicating extensive use.

4. The Complainant has also undertaken a Google UK search with -�SMS PASSCODE-� in
quotes (unlike the Respondent-�s search) and this again shows that virtually all references
are to the Complainant, many including the -�R-� sign. A UK search without quotes shows
four of the results relate to the Complainant including the top two. Whatever the nature
of the Google search for -�SMS PASSCODE-�, whether in the UK or worldwide, the
Complainant dominates the results.

5. The Complainant does not deny isolated use by others but this falls well short of
establishing that the term has become generic or that it has become customary in the
current language of the trade.

6. Little weight can be placed on the current references to SMS PASSCODE on the
Respondent-�s website because these could have been placed recently to support the
Respondent-�s case and/or help justify registration of the Domain Name.

7. The Respondent's 60 page exhibit in support of its claim to use of the term by Signify
and BT does not highlight the references relied on but it appears that there are a few
examples where Signify used the term to brand one of their services but this use was
discontinued in 2005. A current search of Signify-�s website shows only a handful of
references, most dating back to 2002/2003. The BT document is a confidential internal
draft document which falls well-short of evidencing any significant use of the term. There
are no current references on BT-�s website.

8. A good indicator of genericness is the extent of use of the term on the websites of the
main players in the industry:

a. rsa.com
b. entrust.com
c. nordicedge.se
d. april.se
e. vasco.com
f. aladdin.com

Recent site searches show no references to -�SMS PASSCODE-� on any of them. Only the
Complainant uses the term in an extensive, consistent manner. The Complainant
invariably uses the term in an entirely capitalized form.



28682047                                                                                8

9. SMS PASSCODE is not -�wholly descriptive-�. The average person would not automatically
know the meaning of this combined term. It might (or might not) suggest something
connected with (mobile-related) SMS and with a password or passcode (assuming the
person knew the difference) but it could mean say a password required to use a mobile
SMS system, not one sent by SMS. Or indeed the SMS reference could be to one of the
some 70 other SMS abbreviations exhibited by the Complainant. The meaning is by no
means as apparent as say -�airmail letter-�.

10. Many well-known terms with a degree of descriptiveness are perfectly capable of
functioning as trade marks e.g. British Airways, British Gas, Easyjet and various Microsoft
trade marks.

11. In any case, under the DRS Policy, rights -�may include rights in descriptive terms which
have acquired a secondary meaning-�. To the extent that the term is descriptive, which is
not admitted, the Complainant has acquired secondary rights. See, e.g.,
machinebuildingsystems.co.uk (DRS 7195) where the complainant was found to have
acquired a reputation in the name -�Machine Building Systems-� as a source of products
used by machine builders notwithstanding that use also by some competitors to describe
such products. The expert took into account the complainant-�s dominant presence in a
Google search.

12. The Respondent does not contest the evidence of extensive use by the Complainant of
the term -�SMS PASSCODE-� but dismisses it on the basis that -�matters outside of the UK-�
are irrelevant. However, while there is some UK use, -�rights-� are defined as those
-�enforceable by the Complainant, whether under English law or otherwise...-�. See, e.g.,
4inkjet.co.uk (DRS 4192) where registered and unregistered US rights sufficed.

13. The Complainant will be resisting the Respondent-�s revocation application. For the
purposes of the DRS, the CTM must be presumed valid. The DRS would be unworkable if
respondents could reopen decisions of trade mark registries.

14. Not only was the Respondent well aware of the Complainant, it almost certainly knew
of the registered mark also, given the extensive use of the -�R-� sign on the Complainant-�s
website homepage. In particular:

-�   the Respondent was clearly aware of the Complainant when registering the Domain
    Name. The Respondent-�s reluctance to face up to this is telling. If genuine, it would
    surely have been more candid. Instead, it has carefully evaded the issue. In dealing
    with its failure to address the point in correspondence, the Respondent simply asserts
    that lack of an express denial is not an admission. Yet even here it fails to explain its
    position;

-�   the Respondent claims that it was unaware of the Complainant-�s registered mark until
    receipt of the Complainant-�s letter. Even if that is so, was the Respondent otherwise
    aware of the Complainant? The Complainant had stated in its complaint that the
    parties competed for the business of two clients including Edda Media AS in Norway
    at around the time of registration. Yet in the Response the Respondent simply claims,
    again choosing its words carefully, that it has not encountered the Complaint in any
    competitive bid -�in the UK-�. But the location is irrelevant. What matters is that the
    Respondent was competing with the Complainant and clearly aware of it. An email is
    exhibited from Edda Media in June 2008 informing the Complainant that the
    Respondent was another bidder;

-�   the Respondent downplays its activities in Denmark, the Complainant-�s home country
    presumably to imply lack of knowledge of the Complainant. No detail or proof is given



28682047                                                                                   9

    as to alleged micro-sites. However, not only did the Respondent have a .dk site in
    Danish, the Respondent-�s representatives were physically present in Denmark close to
    the date of registration of the Domain Name. An email is exhibited dated 18 June
    2008 from a Danish reseller of the Complainant mentioning a recent visit by the
    Respondent and another dated 7 November 2008 concerning a forthcoming
    presentation by the Respondent-�s European Sales Manager. Yet the Respondent
    makes no mention of any of this; and

-�   the Complainant has identified that a UK user with a geo-IP address in the
    Basingstoke area, close to the Respondent, visited the Complainant-�s website
    frequently, particularly around the time the Domain Name was registered including
    14, 19, 20 and 24 November 2008. It is reasonable to infer, on the balance of the
    probabilities, that this was the Respondent. An extract from the Complainant-�s weblog
    is exhibited together with a postcode search showing the location of the Respondent
    near Basingstoke, an IP search showing the IP location in the Basingstoke area and a
    spreadsheet listing the visits from that IP address to the site.

15. The Respondent claims that it registered the Domain Name as part of a -�web
strategy-� of registering domains comprising technical terms in the authentication
industry. But the registration dates of the other domains relied on by the Respondent were
registered over a six year period as follows:

-�   securenvoy.com                     4 August 2003

-�   tokenlessauthentication.com       19 November 2007

-�   mysecurenvoy.com                          26 March 2008

-�   saveon2fa.com                      29 September 2008

-�   vpn2fa.com                         19 May 2009

16. Two of these represent the Respondent-�s own trading name. That leaves three
domains registered over 18 months (none including -�SMS-�). This can hardly be described
as a -�strategy-�. In any case the Domain Name is a .co.uk unlike the others. The
Respondent-�s implausible claim is further evidence that its intentions were not genuine.

17. It is clear from the timing and circumstances of registration of the Domain Name that
it was registered to target the Complainant and not for its so-called genericness or
descriptiveness. The Respondent registered the Domain Name only some six years after it
allegedly first used the term and has deliberately avoided answering as to its knowledge
of the Complainant on registration, while at the same time making misleading assertions
relating to this issue. And it has come up with an implausible explanation about
registering the Domain Name as part of a -�web strategy-�. It is impossible to conceive that
the Respondent-�s purpose was other than to target the Complainant.

18. In machinebuildingsystems.co.uk (DRS 7195) the expert concluded that although the
words -�machine building systems-� were used descriptively on competitor sites and on the
respondent-�s own site, the respondent must have been aware of its use by the
complainant. At least, some of the site visitors would expect to find the complainant and,
in the circumstances (including the lack of identification on the website), the domain
name was an abusive registration. Similarly, in danceexperiences.co.uk (DRS 7027), the
expert rejected the Respondent-�s claim that it registered the domain because it was -�a
nice descriptive term-�. Registration and use of the domain was done in full knowledge of




28682047                                                                               10

the complainant and it was difficult to see how advantage or detriment could be anything
other than unfair.

19. The Complainant did not say that the Respondent-�s website was a copy of the
Complainant-�s website. The Complaint said that the Respondent-�s purpose was to create
and capitalise on the likelihood of confusion in the minds of the relevant public as to an
association between the Respondent and the Complainant. It makes no difference
whether or not the Respondent-�s name or logo appeared on the website - due to the
concept of initial interest confusion.

20. The Complainant-�s exhibit 13 has not been -�cropped-�. The document was exhibited
exactly as printed. The Respondent is also entirely wrong to claim that the Complainant-�s
Exhibit 15 was deliberately cropped. The Respondent-�s webpage is such that some images
do not reproduce when printed. Respondent-�s exhibit R5 likewise omits the Respondent-�s
logo.



6.         Discussions and Findings

Before dealing with the complaint, one procedural issue needs to be dealt with. Neither
party has taken the point but it is nevertheless appropriate to consider whether or not the
DRS proceedings should be suspended under Paragraph 20 of the DRS Procedure, which
states as follows:

           20. Effect of Court Proceedings

           a. If legal proceedings relating to a Domain Name are issued in a court of
           competent jurisdiction before or during the course of proceedings under the DRS
           and are brought to our attention, we will suspend the proceedings, pending the
           outcome of the legal proceedings.

           b. A Party must promptly notify us if it initiates legal proceedings in a court of
           competent jurisdiction in relating to a Domain Name during the course of
           proceedings under the DRS.

The Complainant has registered SMS PASSCODE as a Community Trade Mark (CTM) and
bases its claim to Rights on the CTM and common law use rights. In response to the
complaint, the Respondent has applied to OHIM (the Community trade mark office) for a
declaration that the CTM is invalid and should be revoked, claiming that "SMS passcode"
was a generic descriptive term at the time of registration and was registered in bad faith
and has not subsequently acquired a secondary meaning through use. The OHIM
application was made two days before the Response was filed.

I have considered whether or not an application to OHIM to declare invalid a CTM being
relied upon for Rights brings Paragraph 20 a) of the DRS Procedure into effect such that
the DRS complaint proceedings should be stayed pending the outcome of the OHIM
proceedings. This depends upon whether or not such an OHIM invalidity application is, in
the terms of Paragraph 20 a), "legal proceedings relating to a Domain Name ... issued in a
court of competent jurisdiction."

Nominet's mediation process proceeded notwithstanding the OHIM application. In
general terms, I would be reluctant to conclude that a respondent could always "trump" a
DRS complaint by issuing trade mark invalidity proceedings, and thus suspend the effect
of a DRS complaint for quite some time. However, Peter Smith J. has recently confirmed in


28682047                                                                                  11

Evans -v- Focal Point Fires (2009 EWHC 2784) that the UK Intellectual Property Office is "a
court of competent jurisdiction" when dealing with invalidity proceedings. In coming to
that conclusion the judge distinguished invalidity from opposition proceedings and
reviewed and followed the reasoning of the court in Special Effects -v- L'Oreal (2007 EWCA Civ 1) and Hormel Foods -v- Antilles Landscape (2005 EWHC 13). Following that
reasoning, the Cancellation Division of OHIM must likewise be a court of competent
jurisdiction when dealing with invalidity applications.

The CTM is identical to the Domain Name, ignoring the co.uk suffix, and is one of the
bases upon which Rights are being asserted. The definition of "Rights" for the purposes of
the DRS are rights enforceable by the Complainant, whether under English law or
otherwise, "and may include rights in descriptive terms which have acquired a secondary
meaning". Whether or not "SMS passcode" was a descriptive term and, if so, whether or
not it has now acquired a distinctive character by reason of the Complainant's use of it, is
precisely the issue to be decided in the OHIM proceedings under Article 52 of the CTM
Regulation (EC No. 207/2009).

A subsequent finding by OHIM that SMS PASSCODE was and still is a generic descriptive
term in relation to the relevant goods and services could therefore have an important
bearing on the Complainant's position. However, my view on balance is that, whilst
indirectly having an impact on the Domain Name, I do not believe the OHIM proceedings
"relate" to the Domain Name as such. They relate to the validity of the registered trade
mark.

My view is therefore that Paragraph 20 a) of the DRS Procedure does not apply and the
DRS proceedings do not need to be suspended pending the outcome of the OHIM
proceedings. I am supported in that conclusion by my opinion that even if the
Respondent is successful in the OHIM invalidity proceedings, that will not necessarily be
determinative of these DRS proceedings. In coming to that view I am conscious that the
definition of "Rights" in the previous version of the DRS Policy was as follows:

           -�Rights includes but is not limited to, rights enforceable under English law.
           However, a Complainant will be unable to rely on rights in a name or term which is
           wholly descriptive of the Complainant-�s business-�.

The previous definition expressly excluded reliance on names or terms that were "wholly
descriptive" whereas the current definition is phrased in an inclusive manner, so that a
complainant may rely on rights in descriptive terms which have acquired a secondary
meaning.

On balance, whilst the change of definition may have raised the hurdle for a complainant
a little higher, I do not believe that the current definition of Rights for the purposes of the
DRS necessarily and automatically excludes, by implication, any reliance upon rights in
descriptive terms which have not acquired a secondary meaning distinctive of the
complainant sufficient for the purposes of registration as a trade mark. It may leave only
a narrow area of enforceable "Rights", but the definition is phrased in an inclusive manner
and under English law, an unregistrable descriptive mark (i.e. one where the use made of it
has not yet been sufficient for it to have acquired a secondary meaning for the purpose of
registerability) can still constitute a common law mark depending upon the particular
circumstances of the mark and its use.

Therefore, for the reasons outlined above, my view is that Paragraph 20 a) of the DRS
Procedure does not apply and the DRS proceedings should not be suspended pending the
outcome of the Respondent's CTM invalidity proceedings.




28682047                                                                                   12

In order to succeed in the complaint the Complainant must prove, on the balance of
probabilities, two matters, i.e. that:

1. The Complainant has Rights in respect of a name or mark which is identical or similar
   to the Domain Name; and

2. The Domain Name, in the hands of the Respondent, is an Abusive Registration.

These terms are defined in the DRS Policy as follows:

-�   Rights means rights enforceable by the Complainant, whether under English law or
    otherwise, and may include rights in descriptive terms which have acquired a
    secondary meaning;

-�   Abusive Registration means a Domain Name which either:

    i. was registered or otherwise acquired in a manner which, at the time when the
    registration or acquisition took place, took unfair advantage of or was unfairly
    detrimental to the Complainant's Rights; or

    ii. has been used in a manner which took unfair advantage of or was unfairly
    detrimental to the Complainant's Rights.

Complainant-�s Rights

The first point to make is that the Respondent appears to be labouring under the
mistaken belief that because the Complaint is concerned with a .uk domain name any use
and rights relied on by the Complainant outside of the UK are irrelevant for the purposes
of the DRS Policy. They are not. Even rights existing wholly outside the UK can still be
Rights for the purposes of the DRS. They are given equal weight to any rights and use
within the UK.

This is made clear in the "Dispute Resolution Service -� Experts-� Overview" document
published on Nominet's website to assist all participants or would-be participants in
disputes under the DRS Policy by explaining commonly raised issues and how Experts have
dealt with those issues to date. It also draws attention to areas where Experts-� views
differ. Paragraph 1.5 of the Overview states as follows:

           "1.5 Can an overseas right constitute a relevant right within the definition of
           Rights?

           Yes. The rights must be enforceable rights, but there is no
           geographical/jurisdictional restriction. If the Upper Volta Gas Board can
           demonstrate rights in respect of its name enforceable in Upper Volta, the Policy is
           broad enough to deal with a cybersquatter, for example, registering
           "uppervoltagasboard.co.uk". If it was otherwise, the -�.uk-� domain would be likely to
           become a haven for cybersquatters."

The Complainant claims Rights in SMS PASSCODE being a name or mark identical to the
Domain Name, ignoring the suffix. The Complainant relies on the fact that it has "sms
passcode" (in lower case) registered as a Community trade mark and in addition relies on
quite extensive evidence of widespread use of the mark since 2006. That would normally
be more than enough to establish relevant Rights for the purposes of the DRS.




28682047                                                                                    13

However, the Respondent is challenging the validity of the CTM via an application for a
declaration of invalidity made to OHIM saying that at all material times SMS PASSCODE
was and still is a generic descriptive phrase and was registered in bad faith.
In support of its claim that SMS PASSCODE is generic, the Respondent relies principally on
its own use and some use by two other companies, BT and Signify. The Complainant
denies that SMS PASSCODE is anywhere near being a generic phrase. It points to the fact
that the evidence put forward in support by the Respondent shows scant use by a very
small number of companies and points out that none of the websites of what it says are
all the main players in the industry use the phrase at all.

I have outlined above why I do not believe the existence of the OHIM invalidity
proceedings is a reason to suspend these DRS proceedings. It is not my role to decide the
likely outcome of the Respondent's OHIM invalidity proceedings and it must be borne in
mind that the Respondent's evidence may be improved by the time of the hearing.
However, I think I can take note of the current apparent relative weakness of the
Respondent's supporting evidence in its quest to establish that the phrase has always
been and still is a generic descriptive phrase in common use in the industry in which both
parties do business. That is the extent of the evidence put before me by the Respondent
for the purpose of defending the Complainant's DRS complaint and, at present, the
Complainant has a registered CTM for "sms passcode" and any registered CTM is
presumed valid unless and until it is revoked.

However, the Respondent goes further and says that even if the CTM remains registered,
it is not infringed by and cannot be enforced against descriptive use made by the
Respondent. I would again refer the Respondent to the Experts' Overview document
which confirms, at paragraph 4.9, that even use of a purely generic or descriptive term can
be abusive in appropriate circumstances. Whilst I am conscious of the fact that any
relevant rights for the purposes of the DRS have to be enforceable rights, the Respondent
is confusing trade mark infringement law as applied to particular circumstances with the
general test of enforceable rights under the DRS Policy. The two are not the same.

The Respondent may be correct in saying that, under UK law, any purely descriptive non
trade mark use of a name or phrase (or at least use that is perceived as such by relevant
consumers) does not infringe a registered trade mark in any event. But that is just an
example of one particular type of use. It does not mean that the trade mark is not an
enforceable right per se. The registered trade mark might be enforced against use of the
same name or phrase which in fact is perceived by a substantial proportion of relevant
consumers as being use in a non-descriptive trade mark sense, regardless of the intentions
of the user. In addition, some countries, for example the Netherlands, have taken
advantage of Article 5(5) of Directive 89/104 (the Directive to Approximate the Laws of
the Member States Relating to Trade Marks) by giving registered trade marks additional
protection against "the use of a sign other than for the purposes of distinguishing goods or
services". Further, many countries have common law or statutory rights based on
principles of unfair competition or unfair trading and which can apply irrespective of the
registerability of a trade mark. In the present case, the Complainant also claims to have
enforceable common law rights and, in support, it has exhibited evidence of widespread
use of the phrase both in and outside the UK, it being used and claimed as a trade mark.

For the purposes of the DRS Policy, the relevant rights have to be enforceable rights, but
that just means they have to be enforceable in some appropriate circumstances under the
laws of at least one jurisdiction. They do not need to be shown to be enforceable in all
and any particular circumstances, including against purely descriptive use in the UK. Once
Rights have been established, the particular manner or type of use by a respondent under
a DRS complaint is only relevant to deciding whether or not that particular use by that
particular respondent is abusive.



28682047                                                                                 14

In the present case, the Complainant has a registered CTM for SMS PASSCODE, which is
presumed to be valid unless and until revoked, and quite extensive common law use. SMS
PASSCODE is a combination of a reasonably well known acronym when associated with
mobile phones and a reasonably common word broadly equivalent to "password". But the
two in combination do not appear to be an inherently obvious generic term, and the
Respondent has put forward only limited evidence of use by itself and a small number of
others to support its claim that the term has at all material times been in common use in
the parties' industry.

In my view, on the evidence before me, the Complainant has proved, on the balance of
probabilities, that it does have Rights in SMS PASSCODE, being a name or mark identical
to the Domain Name.

Abusive Registration

From the matters relied on by the Complainant in its submissions the following parts of
paragraph 3 of the Policy (being factors which may be evidence that the Domain Name is
an Abusive Registration) are potentially relevant:

Paragraph 3 a. i.

"Circumstances indicating that the Respondent has registered or otherwise acquired the
Domain Name primarily:

B. as a blocking registration against a name or mark in which the Complainant has Rights;
or

C. for the purpose of unfairly disrupting the business of the Complainant."

Paragraph 3 a. ii.

"Circumstances indicating that the Respondent is using the Domain Name in a way which
has confused people or businesses into believing that the Domain Name is registered to,
operated or authorised by, or otherwise connected with the Complainant."

From the matters relied on by the Respondent in its submissions the following parts of
paragraph 4 of the Policy (being factors which may be evidence that the Domain Name is
not an Abusive Registration) are potentially relevant:

Paragraph 4 a. i.

"Before being aware of the Complainant's cause for complaint (not necessarily the
'complaint' under the DRS), the Respondent has:

A. used or made demonstrable preparations to use the Domain Name or a domain name
which is similar to the Domain Name in connection with a genuine offering of goods or
services;

B. been commonly known by the name or legitimately connected with a mark which is
identical or similar to the Domain Name;

C. made legitimate non-commercial or fair use of the Domain Name;"

Paragraph 4 a. ii.




28682047                                                                              15

"The Domain Name is generic or descriptive and the Respondent is making fair use of it"
The crux of this case is what the Respondent is likely to have had in mind when first
registering the Domain Name on 21 November 2008 and then using it to resolve to its
main website.

If the Respondent had not even known of the existence of the Complainant when
registering and then subsequently using the Domain Name it would make it much harder
for the Complainant to allege and prove that it is an Abusive Registration.

The Respondent has been challenged by the Complainant on the basis that it must have
known of the Complainant and its trade mark rights. I agree with the Complainant that
the Respondent's answers on that point give every appearance of having been very
carefully worded and being somewhat economical with the truth. For example, it says
that it was unaware of the CTM being registered and that it had not encountered the
Complainant "in any competitive bids for business in the UK". The Respondent does not
say whether or not it had encountered the Complainant in any competitive bids for
business outside the UK or if it had actually been aware of the Complainant at all. It also
ignored the fact that it had recently moved into the Danish market. In its Reply, the
Complainant has exhibited emails showing that the Respondent was in fact actively
competing against the Complainant.

The Complainant has even examined its website visitor traffic to identify a UK visitor with
a geo-IP address in the Basingstoke area, close to the Respondent, who visited the
Complainant-�s website frequently, particularly around the time the Domain Name was
registered including 14, 19, 20 and 24 November 2008. The Complainant says it is
reasonable to infer, on the balance of the probabilities, that this was the Respondent.

I would not go as far as to say that this particular visitor to the website was the
Respondent. It may or may not have been. Having said that, in addition to SMS
PASSCODE being the Complainant's trading name, the Complainant's website
prominently and frequently displays SMS PASSCODE as a trade mark, including use of the
® symbol after the name. Given that the Respondent was in competition with the
Complainant for particular customers' business and that its sales staff were visiting the
Complainant's resellers and giving presentations to them, it seems to me to be more likely
than not that the Respondent will at the very least have visited the Complainant's
website to assess what its competitor was offering. I note that at least one of the
documents exhibited by the Respondent in support of its claim of prior use of SMS
PASSCODE as a descriptive term is its "Product comparison" report comparing the
Respondent's product with a competitor product, so actively assessing its competitors'
products is something which the Respondent clearly does.

It is possible that anyone seeing the frequent use of SMS PASSCODE® on the
Complainant's website might believe it was a claim to a Danish national registered trade
mark or simply not bother looking any further to confirm details of the claim that it is a
registered trade mark. They might then be able to say, choosing their words carefully,
that at the relevant time they were not aware that it had, in fact, been registered as a
trade mark either at all or at least as a CTM. But closing one's eyes to the obvious does
not enable a respondent to deny Nelsonian knowledge of a complainant's cause for
complaint.

The Respondent has also put forward a positive case to explain why it chose the Domain
Name and why it registered it when it did. The Respondent says that it registered the
Domain Name on 21 November 2008 as part of an expansion of the Respondent-�s web
strategy, which involved registering domain names containing technical terms widely
used in the authentication industry and indicative of the Respondent-�s products, such as



28682047                                                                                16

mysecurenvoy.com; saveon2fa.com; secureenvoy.com; tokenlessauthentication.com; and
vpn2fa.com which were also registered as part of this strategy.

However, and as the Complainant pointed out in its Reply, this explanation does not sit
very neatly with the fact that the other domain names relied on were registered over a 6
year period and two of the domain names represent the Respondent-�s own trading name.

I believe that the Respondent's evasive response on the issue of its knowledge of the
Complainant and its somewhat implausible explanation as to why it registered the
Domain Name when it did, gives support to a finding that, on the balance of probabilities,
when registering and subsequently using the Domain Name the Respondent was well
aware of the Complainant's existence, its trading name and the fact that it was at least
claiming SMS PASSCODE to be its registered trade mark. It was therefore aware of the
Complainant's cause for complaint at the relevant times of registering and then using the
Domain Name.

I would also point out that just because there may have been innocent use of a name or
phrase by a respondent before having knowledge of a complainant's cause for complaint,
that does not give a respondent carte blanche to add to or, depending upon the
circumstances, even continue the same use once it does have knowledge of the cause for
complaint.

The Respondent says that the use it made of the Domain Name to resolve to its main
website would not have caused any visitor to be confused as it would be very clear to any
visitor that the website was that of the Respondent and not the Complainant. This issue
is discussed in paragraph 3.3 of the Experts' Overview document which discusses the
nature of confusion for the purposes of the DRS as follows:

           3.3 Paragraph 3(a)(ii) concerns confusing use of the domain name. What is
           meant by confusing use?

           The -�confusion-� referred to in this paragraph of the Policy is confusion as to the
           identity of the person/entity behind the domain name. Will an Internet user seeing
           the domain name or the site to which it is connected believe or be likely to believe
           that -�the domain name is registered to, operated or authorised by, or otherwise
           connected with the Complainant-�?

           -�..

           Commonly, Internet users will visit web sites either by way of search engines or by
           guessing the relevant URL. If the domain name in dispute is identical to the name
           of the Complainant and that name cannot sensibly refer to anyone else, there is
           bound to be a severe risk that a search engine, which is being asked for the
           Complainant, will produce high up on its list the URL for the web site connected to
           the domain name in issue. Similarly, there is bound to be a severe risk that an
           Internet user guessing the URL for the Complainant-�s web site will use the domain
           name for that purpose.

           In such cases, the speculative visitor to the registrant-�s web site will be visiting it in
           the hope and expectation that the web site is a web site -�operated or authorised
           by, or otherwise connected with the Complainant.-� This is what is known as -�initial
           interest confusion-� and the overwhelming majority of Experts view it as a possible
           basis for a finding of Abusive Registration, the vice being that even if it is
           immediately apparent to the visitor to the web site that the site is not in any way
           connected with the Complainant, the visitor has been deceived. Having drawn the
           visitor to the site, the visitor may well be faced with an unauthorised tribute or


28682047                                                                                         17

           criticism site (usually the latter) devoted to the Complainant; or a commercial web
           site, which may or may not advertise goods or services similar to those produced by
           the Complainant. Either way, the visitor will have been sucked in/deceived by the
           domain name.

           Findings of Abusive Registration in this context are most likely to be made where
           the domain name in issue is identical to the name or mark of the Complainant and
           without any adornment (other than the generic domain suffix).

           -�."

In the present case, the Domain Name is identical to the name and mark of the
Complainant and without any adornment (other than the generic domain suffix). Its use
to resolve to the Respondent's website is a classic case of initial interest confusion.

Therefore, in summary, the Respondent cannot rely on paragraph 4 a. i. of the DRS as I
have found that, on the balance of probabilities, it was aware of the Complainant's cause
for complaint when registering and then using the Domain Name. Neither can it rely on
paragraph 4 a. ii. of the DRS as, on the evidence before me, I am not satisfied that the
Domain Name is generic, and, whilst it may be somewhat descriptive, the use made of it
by the Respondent to resolve to its website is not fair use because it is likely to cause
initial interest confusion.

In the circumstances, the Domain Name, in the hands of the Respondent, is an Abusive
Registration as its registration by the Respondent when being aware of the Complainant's
cause for complaint took unfair advantage of and was unfairly detrimental to the
Complainant's Rights. In addition, the subsequent use of the Domain Name in a manner
likely to cause initial interest confusion, also took unfair advantage of and was unfairly
detrimental to the Complainant's Rights.


7.         Decision

For the reasons outlined above I find that the Complainant has proved, on the balance of
probabilities, that it has Rights in respect of the name SMS PASSCODE being a name or
mark which is identical or similar to the Domain Name, and that the Domain Name, in the
hands of the Respondent, is an Abusive Registration.

In the circumstances I order that the Domain Name be transferred to the Complainant.




Signed Chris Tulley                                       Dated 3 March 2010




28682047                                                                                   18