DISPUTE RESOLUTION SERVICE DRS 7871 Decision of Independent Expert SMS Passcode A/S and SecurEnvoy Limited 1. The Parties: Complainant: SMS Passcode A/S Address: Park Allé 350D 2605 Brøndby Postcode: Country: Denmark Respondent: SecurEnvoy Limited Address: 1210 Parkview Arlington Business Park Theale Reading Postcode: RG7 4TY Country: GB 2. The Domain Name(s): smspasscode.co.uk 28682047 1 3. Procedural History: 28 October 2009 - Dispute received 29 October 2009 - Notification of complaint sent to parties 19 November 2009 - Response received 27 November 2009 - Reply received 27 November 2009 - Mediator appointed 02 December 2009 - Mediation started 03 February 2010 - Mediation failed 05 February 2010 - Expert decision payment received 12 February 2010 - Chris Tulley appointed as Expert 4. Factual Background Both parties are in the business of providing user authentication products which use a mobile phone's text messaging function to provide unique "one time" code numbers to identify a user when remotely logging into a network. Both parties operate on an international basis and compete with one another at least to some extent. The Complainant is a Danish company which was incorporated on 27 June 1999. It has carried on business under the name SMS Passcode A/S since 2006. The Complainant owns a registered Community Trade Mark: no. 5713425 dated 25 February 2007 for -sms passcode- in lower case registered in classes 9 and 42. The Complainant-s main website is at www.smspasscode.com. This domain was registered on 26 January 2006. The Respondent is a British company which was incorporated on 14 August 2003. It claims to have made fair descriptive use of the term SMS PASSCODE since it was incorporated in 2003. The Respondent registered the Domain Name on 21 November 2008. At least as of 16 July 2009 the Domain Name was used to resolve to the Respondent-s own website at www.securenvoy.co.uk. 5. Parties- Contentions There have been extensive submissions and supporting documentation filed by the parties. Complainant: In its Complaint, the Complainant says in summary that: 1. The Complainant is a Danish company which was incorporated on 27 June 1999. The Complainant-s primary name is -Conecto A/S- and its secondary name is -SMS Passcode A/S-. The Complainant is entitled to use either name and has carried on business under the name SMS PASSCODE since 2006. 2. The Complainant owns a registered Community Trade Mark: no. 5713425 dated 25 February 2007 for the term -SMS PASSCODE- in classes 9 and 42. Despite the Respondent's challenge to its validity, the registered trade mark must be presumed to be valid unless it is decided otherwise. 3. The Complainant-s main website is at www.smspasscode.com. This domain was registered on 26 January 2006. 28682047 2 4. The Complainant also relies on common law rights. By virtue of its extensive trading and marketing activities the Complainant has acquired substantial reputation and goodwill in the name SMS PASSCODE such that it is recognized by the public as distinctive of the Complainant-s business. In particular: - the Complainant has sold thousands of licenses since its inception; - its turnover in 2007 was almost one million Euros and during 2008 was substantially in excess of that amount. Virtually all of this related to the SMS PASSCODE product; - exhibits have been produced showing that the Complainant has used SMS PASSCODE as a trade mark (including the -r- circle symbol) on such things as installation guides, price lists and brochures; - the Complainant has also attended and exhibited at various international trade conferences; - the Complainant has advertised in industry publications and issued various press releases under the SMS PASSCODE brand; - the Complainant has approximately 100 resellers worldwide who help promote the SMS PASSCODE brand. These resellers also advertise under and promote the SMS PASSCODE brand; - the Complainant-s customers and partners are located worldwide, principally in locations such as Denmark, Norway, Sweden, Finland, Germany, Switzerland, Austria, Holland, Belgium, United Kingdom, Germany, Turkey and other EMEA (Europe, Middle East and Africa) based countries as well as in select markets overseas including Australia, North America and Asia. The customers include well-known global companies such as Ikano Finance, Dong Energy, Avis Car Rental, Hertz Car Rental, Danish Crown, UPM, KPN, Stratten Finance, Wolseley and SSP; - the Complainant and its SMS PASSCODE product have also received industry recognition and awards such as in April 2009 "Red Herring" magazine named the Complainant a winner of the Red Herring 100 Europe, an award given to the top 100 private technology companies based in the EMEA region each year. In October 2009, Secure Computing Magazine named the Complainant and its SMS PASSCODE product as one of the five most innovative solutions in the information security landscape; and - a Google search against the term -SMS Passcode- shows that all references relate to the Complainant (except for one sponsored advertisement by the Respondent.) 5. It is well established under the DRS Policy that the threshold for establishing -Rights- is a low one. Whilst the individual words SMS and PASSCODE may be descriptive, the combined term is not a common one (a view that was clearly shared by OHIM) and in any case the term has become distinctive of the Complainant-s business arising from its extensive use described above. The Complainant relies on the previous decision in myspace.co.uk DRS 4960 and says that the term SMS PASSCODE is, like MY SPACE, no more than "mildly suggestive" at most. 6. The Respondent is a direct competitor of the Complainant. On 26 March 2008 the Respondent registered the Danish domain securenvoy.dk and thereafter launched a version of its website in Danish. The Respondent registered the Domain Name on 21 November 2008. At around the time of registration of the Domain Name, both the 28682047 3 Complainant and Respondent were competing for the business of two clients, one of whom was a Norwegian company Edda Media AS. 7. As of 16 July 2009 the Domain Name resolved via a redirection to the Respondent-s website at www.securenvoy.co.uk. The Complainant-s solicitor sent a cease and desist letter dated 17 August 2009. The Respondent-s solicitors replied on 8 September 2009 saying that the Respondent objected to the validity of the Complainant-s registered trade mark and that it had deactivated the website as an interim measure while it considered the matter. However, the Respondent did not offer to transfer the Domain Name to the Complainant. 8. The Respondent clearly set out to attract business intended for the Complainant. Such activity by the Respondent presupposes that the Complainant-s business was known and identified by its name. 9. The Domain is identical to the Complainant-s trade mark SMS PASSCODE, disregarding the domain suffix. 10. The Complainant has no association with the Respondent and has never authorized or licensed the Respondent to use its trade mark. 11. The Respondent was clearly aware of the Complainant and its business and had the Complainant and its business in mind when registering and using the Domain Name. This is evident from the fact that the Respondent-s communication of 8 September 2009 did not deny this, the Respondent is a direct competitor of the Complainant which is internationally well-known as a major player in mobile authentication technology, the Respondent started operating in Denmark, the Complainant-s home territory, only eight months before it registered the Domain Name, and the Respondent chose to register the Domain Name not long after its expansion into Denmark and at around the time that both parties were competing for the same business. Accordingly: - the Domain Name was registered as a blocking device to prevent the Complainant from reflecting its trade mark in the Domain Name; - the Respondent registered the Domain Name for the purpose of unfairly disrupting the business of the Complainant by attracting its business and diverting it to the Respondent; and - the website associated with the Domain Name was essentially a scheme adopted by the Respondent to confuse, attract and profit from internet users who are searching for the Complainant-s business in search engines, web browsers and otherwise on the internet. The Respondent: In its Response, the Respondent in summary says: 1. The Respondent is a British company which was incorporated on 14 August 2003 and is a global leader in the industry. The Respondent came up with the idea of sending a passcode to a mobile phone via SMS (short message service) messages and has patents pending since 2002. 2. The term -SMS PASSCODE- is descriptive or generic in the field of SMS based passcode authentication and the Respondent has made fair use of the term since it was incorporated in 2003. The term -SMS PASSCODE- is made up of two descriptive English 28682047 4 terms, -SMS- meaning short message service and -PASSCODE- meaning a string of characters, usually numbers, for authenticating a user. The term SMS PASSCODE is more apt than any other term to describe passcodes which are sent via SMS messages and hence to indicate the kind or purpose of products and services relating to SMS based passcodes. It is a term which conveys a purely informational message about the products or services and is not capable of functioning as a trade mark to indicate the commercial origin of products or services relating to passcodes sent by SMS. Such a wholly descriptive term as SMS PASSCODE is incapable of generating a secondary meaning or secondary rights as allowed for under the Policy. 3. The Respondent was not aware that SMS PASSCODE had been registered as a trade mark until it received a letter of 17 August 2009 from the Complainant-s solicitors and had no reason to think that a descriptive term which had already become established in the authentication sector could be registered as a trade mark for products and services in that sector. 4. The Respondent was not the only entity in the industry to have used SMS PASSCODE to refer to passcodes sent via SMS messages. These other entities include Signify Solutions Limited (-Signify-), one of the Respondent-s main UK-based competitors, and BT, one of the main telecommunications providers in the UK. Documents are exhibited showing use of SMS PASSCODE by Signify, BT and other entities in the period before and after the filing date of the Complainant-s Community trade mark. 5. OHIM was wrong to register the trade mark because it was a descriptive term which was already being used in the authentication sector and the Respondent has now applied to OHIM to invalidate the Complainant-s registration on the grounds that it is descriptive and devoid of distinctive character. 6. The Complainant has no enforceable rights in SMS PASSCODE as a trade mark in the United Kingdom. Article 12 of the Community Trade Mark Regulation (Council Regulation EC No. 207/2009) limits the effects of a Community trade mark and says that: -A Community trade mark shall not entitle the proprietor to prohibit a third party from using in the course of trade-.(b) indications concerning the kind, quality, quantity, intended purpose, value, geographical origin, time of production of the goods or of rendering of the service, or other characteristics of the goods or service.-provided he uses them in accordance with honest practices in industrial or commercial matters-. 7. Accordingly, the Complainant-s Community trade mark is not enforceable against the Respondent because the Respondent is using -SMS PASSCODE- to indicate the kind or intended purpose of the products and services which it offers, namely, software relating to passcodes sent by SMS messages for the authentication of access to computer systems, databases and electronic mail services. 8. The claims made in paragraphs 6 to 13 of the complaint are irrelevant because they are concerned with matters outside of the UK and the present dispute concerns a UK domain name. In particular: - the Respondent has not encountered the Complainant in any competitive bid for SMS- based passcode authentication software in the UK; - within the UK, which is the territory of the disputed domain name, the Respondent has far more resellers than the Complainant and hundreds of customers for its software, 28682047 5 with over 100,000 end users, including many well-known names such as John Lewis, T Mobile, Unipart, National Health Service, and local councils; and - the Complainant-s Exhibit 12 shows the result of a Google search for -SMS PASSCODE- from the web but a search by the Respondent of pages from the UK on 5 November 2009, shows only two -hits- referring to the Complainant, four -hits- referring to the Respondent, and four -hits- for other entities which are unrelated to the Complainant and which are also using -SMS PASSCODE-. 9. The Complainant has not demonstrated an enforceable common law right in the United Kingdom. The majority of the submissions made by the Complainant relate to its alleged use of SMS PASSCODE outside of the United Kingdom. As far as the United Kingdom is concerned, the term -SMS PASSCODE- is a good illustration of the point made by the House of Lords in Office Cleaning Services Limited v Westminster Window and General Cleaners Limited (1946) 63 RPC 39 HL, which highlights the pitfalls facing traders who use words in common usage as trade names and says that they must run the risk of confusion -unless the first user is allowed unfairly to monopolised the words-. In this case, the Complainant is not the first user but -SMS PASSCODE- is a term in common use in the authentication industry and it would be unfair if the Complainant monopolised the term. 10. The threshold for establishing rights under the DRS Policy may be low but it is not so low as to confer rights on solely descriptive terms such as SMS PASSCODE, SHOESHOP or INTERNET SERVICE PROVIDER. 11. The Respondent registered thirty-six domain names in March 2008. The Respondent also launched a multi-countries website with thirty micro-sites for many countries across the world. The site for Denmark was not created and launched in isolation but was part of a worldwide export strategy using the Respondent-s corporate image and standard web page layout. The document making up the Complainant-s Exhibit 13 has been cropped to remove all reference to the Respondent-s name and product range. 12. The Respondent registered the Domain Name on 21 November 2008 as part of an expansion of the Respondent-s web strategy, which involved registering domain names containing technical terms widely used in the authentication industry and indicative of the Respondent-s products. The following domain names were also registered as part of this strategy: - mysecurenvoy.com; - saveon2fa.com; - secureenvoy.com; - tokenlessauthentication.com; and - vpn2fa.com 13. Using the Domain Name to resolve to its own website was not an attempt to copy a rival company-s website. It was simply a linking back of a domain name containing a well- known technical phrase to the Respondent-s main website. The evidence making up the Complainant-s Exhibit 15 has been clipped to delete the part which shows the Respondent-s name, logo and products. 14. There was no need for the Respondent to offer to transfer the Domain Name to the Complainant in the response to the cease and desist letter because the term -SMS 28682047 6 PASSCODE- is widely used in the authentication industry and is free for anyone to use as a descriptive term. The Respondent deactivated the link from the disputed Domain Name to its website as an interim precautionary measure and the response made it clear that this was done to avoid the unnecessary costs of a complaint which has now been made. 15. The Domain Name is not an Abusive Registration, and in particular: - the Respondent denies that it set out to attract business intended for the Complainant. The registration of the Domain Name was an exercise of the Respondent-s freedom to use a purely descriptive term to attract customers of products for which SMS PASSCODE is an apt description; - the Domain Name is generic or descriptive and the Respondent is making fair use of it and has done so since 2003, long before it was aware of the Complainant-s cause for complaint and, indeed, before the Complainant-s Community trade mark was registered; - the Respondent denies that its registration of the domain name was intended to prevent the Complainant from reflecting its trade mark in the Domain Name because the Respondent did not know of the Complainant-s trade mark when the Domain Name was registered and considered it a descriptive term; - the Respondent denies that it registered the Domain Name unfairly to disrupt the business of the Complainant as the Respondent had already been using SMS PASSCODE in its descriptive sense for six years before it received the letter of 17 August 2009 from the Complainant-s solicitors. If anything, the Complainant-s registration of SMS PASSCODE as a trade mark is an attempt to block the legitimate use of the term by competitors and this is one of the grounds on which the Respondent is seeking to invalidate the Complainant-s Community trade mark; - the Complainant has alleged that the Respondent was aware of the Complainant and its business when the Domain Name was registered but the Respondent had not encountered the Complainant in any competitive bids for business in the UK; - the Respondent denies the allegation that the Domain Name was a scheme to use, attract and profit from internet users who are searching for the Complainant-s business. SMS PASSCODE is a purely descriptive term and the use of the Domain Name was to help prospective customers find the appropriate software. It was made absolutely clear to anyone entering the Respondent-s website via the Domain Name that they had been directed to the Respondent-s web page, with the Respondent-s logo and product range. The logo and product information on the Respondent-s website has remained unchanged since 2007 and the printout on pages 1 and 2 of the Complainant-s Exhibit 15 is not a true reflection of the Respondent-s website because it has been deliberately cropped to remove the logo and product range; - the fact that the Respondent-s communication of 8 September 2009 did not contain any express denials is not an admission of any of the Complainant-s allegations. The Respondent felt that the obvious descriptive meaning of SMS PASSCODE and that fact that it had already been using the term for several years meant that there was no case to answer; and - at no time did the Respondent register the Domain Name to divert business from the Complainant. It was always made clear to anyone entering the Respondent-s website via other domain names that they had entered the Respondent-s own website by the use of the Respondent-s logo and list of products. The Respondent-s website has thirty 28682047 7 local country sites or pages, including the page for Denmark which has remained unchanged, apart from dynamic news content, since July 2008. The Complainant's Reply In its Reply, the Complainant says in summary that: 1. It does not accept that the Respondent is a -global leader- or a major player in the industry but does accept that it is a competitor. 2. The Respondent has provided no proof that it -came up- with the idea of sending a -passcode- to a mobile phone via SMS or of patents pending since 2002, predating the Respondent-s incorporation. 3. The Respondent's evidence supporting its claim of -fair use- since 2003 consists of a few, very lengthy, and apparently internal, documents. The exhibit does not appear to include evidence of public use. The Respondent has not identified particular references and, while the Complainant has found a few, it sees nothing indicating extensive use. 4. The Complainant has also undertaken a Google UK search with -SMS PASSCODE- in quotes (unlike the Respondent-s search) and this again shows that virtually all references are to the Complainant, many including the -R- sign. A UK search without quotes shows four of the results relate to the Complainant including the top two. Whatever the nature of the Google search for -SMS PASSCODE-, whether in the UK or worldwide, the Complainant dominates the results. 5. The Complainant does not deny isolated use by others but this falls well short of establishing that the term has become generic or that it has become customary in the current language of the trade. 6. Little weight can be placed on the current references to SMS PASSCODE on the Respondent-s website because these could have been placed recently to support the Respondent-s case and/or help justify registration of the Domain Name. 7. The Respondent's 60 page exhibit in support of its claim to use of the term by Signify and BT does not highlight the references relied on but it appears that there are a few examples where Signify used the term to brand one of their services but this use was discontinued in 2005. A current search of Signify-s website shows only a handful of references, most dating back to 2002/2003. The BT document is a confidential internal draft document which falls well-short of evidencing any significant use of the term. There are no current references on BT-s website. 8. A good indicator of genericness is the extent of use of the term on the websites of the main players in the industry: a. rsa.com b. entrust.com c. nordicedge.se d. april.se e. vasco.com f. aladdin.com Recent site searches show no references to -SMS PASSCODE- on any of them. Only the Complainant uses the term in an extensive, consistent manner. The Complainant invariably uses the term in an entirely capitalized form. 28682047 8 9. SMS PASSCODE is not -wholly descriptive-. The average person would not automatically know the meaning of this combined term. It might (or might not) suggest something connected with (mobile-related) SMS and with a password or passcode (assuming the person knew the difference) but it could mean say a password required to use a mobile SMS system, not one sent by SMS. Or indeed the SMS reference could be to one of the some 70 other SMS abbreviations exhibited by the Complainant. The meaning is by no means as apparent as say -airmail letter-. 10. Many well-known terms with a degree of descriptiveness are perfectly capable of functioning as trade marks e.g. British Airways, British Gas, Easyjet and various Microsoft trade marks. 11. In any case, under the DRS Policy, rights -may include rights in descriptive terms which have acquired a secondary meaning-. To the extent that the term is descriptive, which is not admitted, the Complainant has acquired secondary rights. See, e.g., machinebuildingsystems.co.uk (DRS 7195) where the complainant was found to have acquired a reputation in the name -Machine Building Systems- as a source of products used by machine builders notwithstanding that use also by some competitors to describe such products. The expert took into account the complainant-s dominant presence in a Google search. 12. The Respondent does not contest the evidence of extensive use by the Complainant of the term -SMS PASSCODE- but dismisses it on the basis that -matters outside of the UK- are irrelevant. However, while there is some UK use, -rights- are defined as those -enforceable by the Complainant, whether under English law or otherwise...-. See, e.g., 4inkjet.co.uk (DRS 4192) where registered and unregistered US rights sufficed. 13. The Complainant will be resisting the Respondent-s revocation application. For the purposes of the DRS, the CTM must be presumed valid. The DRS would be unworkable if respondents could reopen decisions of trade mark registries. 14. Not only was the Respondent well aware of the Complainant, it almost certainly knew of the registered mark also, given the extensive use of the -R- sign on the Complainant-s website homepage. In particular: - the Respondent was clearly aware of the Complainant when registering the Domain Name. The Respondent-s reluctance to face up to this is telling. If genuine, it would surely have been more candid. Instead, it has carefully evaded the issue. In dealing with its failure to address the point in correspondence, the Respondent simply asserts that lack of an express denial is not an admission. Yet even here it fails to explain its position; - the Respondent claims that it was unaware of the Complainant-s registered mark until receipt of the Complainant-s letter. Even if that is so, was the Respondent otherwise aware of the Complainant? The Complainant had stated in its complaint that the parties competed for the business of two clients including Edda Media AS in Norway at around the time of registration. Yet in the Response the Respondent simply claims, again choosing its words carefully, that it has not encountered the Complaint in any competitive bid -in the UK-. But the location is irrelevant. What matters is that the Respondent was competing with the Complainant and clearly aware of it. An email is exhibited from Edda Media in June 2008 informing the Complainant that the Respondent was another bidder; - the Respondent downplays its activities in Denmark, the Complainant-s home country presumably to imply lack of knowledge of the Complainant. No detail or proof is given 28682047 9 as to alleged micro-sites. However, not only did the Respondent have a .dk site in Danish, the Respondent-s representatives were physically present in Denmark close to the date of registration of the Domain Name. An email is exhibited dated 18 June 2008 from a Danish reseller of the Complainant mentioning a recent visit by the Respondent and another dated 7 November 2008 concerning a forthcoming presentation by the Respondent-s European Sales Manager. Yet the Respondent makes no mention of any of this; and - the Complainant has identified that a UK user with a geo-IP address in the Basingstoke area, close to the Respondent, visited the Complainant-s website frequently, particularly around the time the Domain Name was registered including 14, 19, 20 and 24 November 2008. It is reasonable to infer, on the balance of the probabilities, that this was the Respondent. An extract from the Complainant-s weblog is exhibited together with a postcode search showing the location of the Respondent near Basingstoke, an IP search showing the IP location in the Basingstoke area and a spreadsheet listing the visits from that IP address to the site. 15. The Respondent claims that it registered the Domain Name as part of a -web strategy- of registering domains comprising technical terms in the authentication industry. But the registration dates of the other domains relied on by the Respondent were registered over a six year period as follows: - securenvoy.com 4 August 2003 - tokenlessauthentication.com 19 November 2007 - mysecurenvoy.com 26 March 2008 - saveon2fa.com 29 September 2008 - vpn2fa.com 19 May 2009 16. Two of these represent the Respondent-s own trading name. That leaves three domains registered over 18 months (none including -SMS-). This can hardly be described as a -strategy-. In any case the Domain Name is a .co.uk unlike the others. The Respondent-s implausible claim is further evidence that its intentions were not genuine. 17. It is clear from the timing and circumstances of registration of the Domain Name that it was registered to target the Complainant and not for its so-called genericness or descriptiveness. The Respondent registered the Domain Name only some six years after it allegedly first used the term and has deliberately avoided answering as to its knowledge of the Complainant on registration, while at the same time making misleading assertions relating to this issue. And it has come up with an implausible explanation about registering the Domain Name as part of a -web strategy-. It is impossible to conceive that the Respondent-s purpose was other than to target the Complainant. 18. In machinebuildingsystems.co.uk (DRS 7195) the expert concluded that although the words -machine building systems- were used descriptively on competitor sites and on the respondent-s own site, the respondent must have been aware of its use by the complainant. At least, some of the site visitors would expect to find the complainant and, in the circumstances (including the lack of identification on the website), the domain name was an abusive registration. Similarly, in danceexperiences.co.uk (DRS 7027), the expert rejected the Respondent-s claim that it registered the domain because it was -a nice descriptive term-. Registration and use of the domain was done in full knowledge of 28682047 10 the complainant and it was difficult to see how advantage or detriment could be anything other than unfair. 19. The Complainant did not say that the Respondent-s website was a copy of the Complainant-s website. The Complaint said that the Respondent-s purpose was to create and capitalise on the likelihood of confusion in the minds of the relevant public as to an association between the Respondent and the Complainant. It makes no difference whether or not the Respondent-s name or logo appeared on the website - due to the concept of initial interest confusion. 20. The Complainant-s exhibit 13 has not been -cropped-. The document was exhibited exactly as printed. The Respondent is also entirely wrong to claim that the Complainant-s Exhibit 15 was deliberately cropped. The Respondent-s webpage is such that some images do not reproduce when printed. Respondent-s exhibit R5 likewise omits the Respondent-s logo. 6. Discussions and Findings Before dealing with the complaint, one procedural issue needs to be dealt with. Neither party has taken the point but it is nevertheless appropriate to consider whether or not the DRS proceedings should be suspended under Paragraph 20 of the DRS Procedure, which states as follows: 20. Effect of Court Proceedings a. If legal proceedings relating to a Domain Name are issued in a court of competent jurisdiction before or during the course of proceedings under the DRS and are brought to our attention, we will suspend the proceedings, pending the outcome of the legal proceedings. b. A Party must promptly notify us if it initiates legal proceedings in a court of competent jurisdiction in relating to a Domain Name during the course of proceedings under the DRS. The Complainant has registered SMS PASSCODE as a Community Trade Mark (CTM) and bases its claim to Rights on the CTM and common law use rights. In response to the complaint, the Respondent has applied to OHIM (the Community trade mark office) for a declaration that the CTM is invalid and should be revoked, claiming that "SMS passcode" was a generic descriptive term at the time of registration and was registered in bad faith and has not subsequently acquired a secondary meaning through use. The OHIM application was made two days before the Response was filed. I have considered whether or not an application to OHIM to declare invalid a CTM being relied upon for Rights brings Paragraph 20 a) of the DRS Procedure into effect such that the DRS complaint proceedings should be stayed pending the outcome of the OHIM proceedings. This depends upon whether or not such an OHIM invalidity application is, in the terms of Paragraph 20 a), "legal proceedings relating to a Domain Name ... issued in a court of competent jurisdiction." Nominet's mediation process proceeded notwithstanding the OHIM application. In general terms, I would be reluctant to conclude that a respondent could always "trump" a DRS complaint by issuing trade mark invalidity proceedings, and thus suspend the effect of a DRS complaint for quite some time. However, Peter Smith J. has recently confirmed in 28682047 11 Evans -v- Focal Point Fires (2009 EWHC 2784) that the UK Intellectual Property Office is "a court of competent jurisdiction" when dealing with invalidity proceedings. In coming to that conclusion the judge distinguished invalidity from opposition proceedings and reviewed and followed the reasoning of the court in Special Effects -v- L'Oreal (2007 EWCA Civ 1) and Hormel Foods -v- Antilles Landscape (2005 EWHC 13). Following that reasoning, the Cancellation Division of OHIM must likewise be a court of competent jurisdiction when dealing with invalidity applications. The CTM is identical to the Domain Name, ignoring the co.uk suffix, and is one of the bases upon which Rights are being asserted. The definition of "Rights" for the purposes of the DRS are rights enforceable by the Complainant, whether under English law or otherwise, "and may include rights in descriptive terms which have acquired a secondary meaning". Whether or not "SMS passcode" was a descriptive term and, if so, whether or not it has now acquired a distinctive character by reason of the Complainant's use of it, is precisely the issue to be decided in the OHIM proceedings under Article 52 of the CTM Regulation (EC No. 207/2009). A subsequent finding by OHIM that SMS PASSCODE was and still is a generic descriptive term in relation to the relevant goods and services could therefore have an important bearing on the Complainant's position. However, my view on balance is that, whilst indirectly having an impact on the Domain Name, I do not believe the OHIM proceedings "relate" to the Domain Name as such. They relate to the validity of the registered trade mark. My view is therefore that Paragraph 20 a) of the DRS Procedure does not apply and the DRS proceedings do not need to be suspended pending the outcome of the OHIM proceedings. I am supported in that conclusion by my opinion that even if the Respondent is successful in the OHIM invalidity proceedings, that will not necessarily be determinative of these DRS proceedings. In coming to that view I am conscious that the definition of "Rights" in the previous version of the DRS Policy was as follows: -Rights includes but is not limited to, rights enforceable under English law. However, a Complainant will be unable to rely on rights in a name or term which is wholly descriptive of the Complainant-s business-. The previous definition expressly excluded reliance on names or terms that were "wholly descriptive" whereas the current definition is phrased in an inclusive manner, so that a complainant may rely on rights in descriptive terms which have acquired a secondary meaning. On balance, whilst the change of definition may have raised the hurdle for a complainant a little higher, I do not believe that the current definition of Rights for the purposes of the DRS necessarily and automatically excludes, by implication, any reliance upon rights in descriptive terms which have not acquired a secondary meaning distinctive of the complainant sufficient for the purposes of registration as a trade mark. It may leave only a narrow area of enforceable "Rights", but the definition is phrased in an inclusive manner and under English law, an unregistrable descriptive mark (i.e. one where the use made of it has not yet been sufficient for it to have acquired a secondary meaning for the purpose of registerability) can still constitute a common law mark depending upon the particular circumstances of the mark and its use. Therefore, for the reasons outlined above, my view is that Paragraph 20 a) of the DRS Procedure does not apply and the DRS proceedings should not be suspended pending the outcome of the Respondent's CTM invalidity proceedings. 28682047 12 In order to succeed in the complaint the Complainant must prove, on the balance of probabilities, two matters, i.e. that: 1. The Complainant has Rights in respect of a name or mark which is identical or similar to the Domain Name; and 2. The Domain Name, in the hands of the Respondent, is an Abusive Registration. These terms are defined in the DRS Policy as follows: - Rights means rights enforceable by the Complainant, whether under English law or otherwise, and may include rights in descriptive terms which have acquired a secondary meaning; - Abusive Registration means a Domain Name which either: i. was registered or otherwise acquired in a manner which, at the time when the registration or acquisition took place, took unfair advantage of or was unfairly detrimental to the Complainant's Rights; or ii. has been used in a manner which took unfair advantage of or was unfairly detrimental to the Complainant's Rights. Complainant-s Rights The first point to make is that the Respondent appears to be labouring under the mistaken belief that because the Complaint is concerned with a .uk domain name any use and rights relied on by the Complainant outside of the UK are irrelevant for the purposes of the DRS Policy. They are not. Even rights existing wholly outside the UK can still be Rights for the purposes of the DRS. They are given equal weight to any rights and use within the UK. This is made clear in the "Dispute Resolution Service - Experts- Overview" document published on Nominet's website to assist all participants or would-be participants in disputes under the DRS Policy by explaining commonly raised issues and how Experts have dealt with those issues to date. It also draws attention to areas where Experts- views differ. Paragraph 1.5 of the Overview states as follows: "1.5 Can an overseas right constitute a relevant right within the definition of Rights? Yes. The rights must be enforceable rights, but there is no geographical/jurisdictional restriction. If the Upper Volta Gas Board can demonstrate rights in respect of its name enforceable in Upper Volta, the Policy is broad enough to deal with a cybersquatter, for example, registering "uppervoltagasboard.co.uk". If it was otherwise, the -.uk- domain would be likely to become a haven for cybersquatters." The Complainant claims Rights in SMS PASSCODE being a name or mark identical to the Domain Name, ignoring the suffix. The Complainant relies on the fact that it has "sms passcode" (in lower case) registered as a Community trade mark and in addition relies on quite extensive evidence of widespread use of the mark since 2006. That would normally be more than enough to establish relevant Rights for the purposes of the DRS. 28682047 13 However, the Respondent is challenging the validity of the CTM via an application for a declaration of invalidity made to OHIM saying that at all material times SMS PASSCODE was and still is a generic descriptive phrase and was registered in bad faith. In support of its claim that SMS PASSCODE is generic, the Respondent relies principally on its own use and some use by two other companies, BT and Signify. The Complainant denies that SMS PASSCODE is anywhere near being a generic phrase. It points to the fact that the evidence put forward in support by the Respondent shows scant use by a very small number of companies and points out that none of the websites of what it says are all the main players in the industry use the phrase at all. I have outlined above why I do not believe the existence of the OHIM invalidity proceedings is a reason to suspend these DRS proceedings. It is not my role to decide the likely outcome of the Respondent's OHIM invalidity proceedings and it must be borne in mind that the Respondent's evidence may be improved by the time of the hearing. However, I think I can take note of the current apparent relative weakness of the Respondent's supporting evidence in its quest to establish that the phrase has always been and still is a generic descriptive phrase in common use in the industry in which both parties do business. That is the extent of the evidence put before me by the Respondent for the purpose of defending the Complainant's DRS complaint and, at present, the Complainant has a registered CTM for "sms passcode" and any registered CTM is presumed valid unless and until it is revoked. However, the Respondent goes further and says that even if the CTM remains registered, it is not infringed by and cannot be enforced against descriptive use made by the Respondent. I would again refer the Respondent to the Experts' Overview document which confirms, at paragraph 4.9, that even use of a purely generic or descriptive term can be abusive in appropriate circumstances. Whilst I am conscious of the fact that any relevant rights for the purposes of the DRS have to be enforceable rights, the Respondent is confusing trade mark infringement law as applied to particular circumstances with the general test of enforceable rights under the DRS Policy. The two are not the same. The Respondent may be correct in saying that, under UK law, any purely descriptive non trade mark use of a name or phrase (or at least use that is perceived as such by relevant consumers) does not infringe a registered trade mark in any event. But that is just an example of one particular type of use. It does not mean that the trade mark is not an enforceable right per se. The registered trade mark might be enforced against use of the same name or phrase which in fact is perceived by a substantial proportion of relevant consumers as being use in a non-descriptive trade mark sense, regardless of the intentions of the user. In addition, some countries, for example the Netherlands, have taken advantage of Article 5(5) of Directive 89/104 (the Directive to Approximate the Laws of the Member States Relating to Trade Marks) by giving registered trade marks additional protection against "the use of a sign other than for the purposes of distinguishing goods or services". Further, many countries have common law or statutory rights based on principles of unfair competition or unfair trading and which can apply irrespective of the registerability of a trade mark. In the present case, the Complainant also claims to have enforceable common law rights and, in support, it has exhibited evidence of widespread use of the phrase both in and outside the UK, it being used and claimed as a trade mark. For the purposes of the DRS Policy, the relevant rights have to be enforceable rights, but that just means they have to be enforceable in some appropriate circumstances under the laws of at least one jurisdiction. They do not need to be shown to be enforceable in all and any particular circumstances, including against purely descriptive use in the UK. Once Rights have been established, the particular manner or type of use by a respondent under a DRS complaint is only relevant to deciding whether or not that particular use by that particular respondent is abusive. 28682047 14 In the present case, the Complainant has a registered CTM for SMS PASSCODE, which is presumed to be valid unless and until revoked, and quite extensive common law use. SMS PASSCODE is a combination of a reasonably well known acronym when associated with mobile phones and a reasonably common word broadly equivalent to "password". But the two in combination do not appear to be an inherently obvious generic term, and the Respondent has put forward only limited evidence of use by itself and a small number of others to support its claim that the term has at all material times been in common use in the parties' industry. In my view, on the evidence before me, the Complainant has proved, on the balance of probabilities, that it does have Rights in SMS PASSCODE, being a name or mark identical to the Domain Name. Abusive Registration From the matters relied on by the Complainant in its submissions the following parts of paragraph 3 of the Policy (being factors which may be evidence that the Domain Name is an Abusive Registration) are potentially relevant: Paragraph 3 a. i. "Circumstances indicating that the Respondent has registered or otherwise acquired the Domain Name primarily: B. as a blocking registration against a name or mark in which the Complainant has Rights; or C. for the purpose of unfairly disrupting the business of the Complainant." Paragraph 3 a. ii. "Circumstances indicating that the Respondent is using the Domain Name in a way which has confused people or businesses into believing that the Domain Name is registered to, operated or authorised by, or otherwise connected with the Complainant." From the matters relied on by the Respondent in its submissions the following parts of paragraph 4 of the Policy (being factors which may be evidence that the Domain Name is not an Abusive Registration) are potentially relevant: Paragraph 4 a. i. "Before being aware of the Complainant's cause for complaint (not necessarily the 'complaint' under the DRS), the Respondent has: A. used or made demonstrable preparations to use the Domain Name or a domain name which is similar to the Domain Name in connection with a genuine offering of goods or services; B. been commonly known by the name or legitimately connected with a mark which is identical or similar to the Domain Name; C. made legitimate non-commercial or fair use of the Domain Name;" Paragraph 4 a. ii. 28682047 15 "The Domain Name is generic or descriptive and the Respondent is making fair use of it" The crux of this case is what the Respondent is likely to have had in mind when first registering the Domain Name on 21 November 2008 and then using it to resolve to its main website. If the Respondent had not even known of the existence of the Complainant when registering and then subsequently using the Domain Name it would make it much harder for the Complainant to allege and prove that it is an Abusive Registration. The Respondent has been challenged by the Complainant on the basis that it must have known of the Complainant and its trade mark rights. I agree with the Complainant that the Respondent's answers on that point give every appearance of having been very carefully worded and being somewhat economical with the truth. For example, it says that it was unaware of the CTM being registered and that it had not encountered the Complainant "in any competitive bids for business in the UK". The Respondent does not say whether or not it had encountered the Complainant in any competitive bids for business outside the UK or if it had actually been aware of the Complainant at all. It also ignored the fact that it had recently moved into the Danish market. In its Reply, the Complainant has exhibited emails showing that the Respondent was in fact actively competing against the Complainant. The Complainant has even examined its website visitor traffic to identify a UK visitor with a geo-IP address in the Basingstoke area, close to the Respondent, who visited the Complainant-s website frequently, particularly around the time the Domain Name was registered including 14, 19, 20 and 24 November 2008. The Complainant says it is reasonable to infer, on the balance of the probabilities, that this was the Respondent. I would not go as far as to say that this particular visitor to the website was the Respondent. It may or may not have been. Having said that, in addition to SMS PASSCODE being the Complainant's trading name, the Complainant's website prominently and frequently displays SMS PASSCODE as a trade mark, including use of the ® symbol after the name. Given that the Respondent was in competition with the Complainant for particular customers' business and that its sales staff were visiting the Complainant's resellers and giving presentations to them, it seems to me to be more likely than not that the Respondent will at the very least have visited the Complainant's website to assess what its competitor was offering. I note that at least one of the documents exhibited by the Respondent in support of its claim of prior use of SMS PASSCODE as a descriptive term is its "Product comparison" report comparing the Respondent's product with a competitor product, so actively assessing its competitors' products is something which the Respondent clearly does. It is possible that anyone seeing the frequent use of SMS PASSCODE® on the Complainant's website might believe it was a claim to a Danish national registered trade mark or simply not bother looking any further to confirm details of the claim that it is a registered trade mark. They might then be able to say, choosing their words carefully, that at the relevant time they were not aware that it had, in fact, been registered as a trade mark either at all or at least as a CTM. But closing one's eyes to the obvious does not enable a respondent to deny Nelsonian knowledge of a complainant's cause for complaint. The Respondent has also put forward a positive case to explain why it chose the Domain Name and why it registered it when it did. The Respondent says that it registered the Domain Name on 21 November 2008 as part of an expansion of the Respondent-s web strategy, which involved registering domain names containing technical terms widely used in the authentication industry and indicative of the Respondent-s products, such as 28682047 16 mysecurenvoy.com; saveon2fa.com; secureenvoy.com; tokenlessauthentication.com; and vpn2fa.com which were also registered as part of this strategy. However, and as the Complainant pointed out in its Reply, this explanation does not sit very neatly with the fact that the other domain names relied on were registered over a 6 year period and two of the domain names represent the Respondent-s own trading name. I believe that the Respondent's evasive response on the issue of its knowledge of the Complainant and its somewhat implausible explanation as to why it registered the Domain Name when it did, gives support to a finding that, on the balance of probabilities, when registering and subsequently using the Domain Name the Respondent was well aware of the Complainant's existence, its trading name and the fact that it was at least claiming SMS PASSCODE to be its registered trade mark. It was therefore aware of the Complainant's cause for complaint at the relevant times of registering and then using the Domain Name. I would also point out that just because there may have been innocent use of a name or phrase by a respondent before having knowledge of a complainant's cause for complaint, that does not give a respondent carte blanche to add to or, depending upon the circumstances, even continue the same use once it does have knowledge of the cause for complaint. The Respondent says that the use it made of the Domain Name to resolve to its main website would not have caused any visitor to be confused as it would be very clear to any visitor that the website was that of the Respondent and not the Complainant. This issue is discussed in paragraph 3.3 of the Experts' Overview document which discusses the nature of confusion for the purposes of the DRS as follows: 3.3 Paragraph 3(a)(ii) concerns confusing use of the domain name. What is meant by confusing use? The -confusion- referred to in this paragraph of the Policy is confusion as to the identity of the person/entity behind the domain name. Will an Internet user seeing the domain name or the site to which it is connected believe or be likely to believe that -the domain name is registered to, operated or authorised by, or otherwise connected with the Complainant-? -.. Commonly, Internet users will visit web sites either by way of search engines or by guessing the relevant URL. If the domain name in dispute is identical to the name of the Complainant and that name cannot sensibly refer to anyone else, there is bound to be a severe risk that a search engine, which is being asked for the Complainant, will produce high up on its list the URL for the web site connected to the domain name in issue. Similarly, there is bound to be a severe risk that an Internet user guessing the URL for the Complainant-s web site will use the domain name for that purpose. In such cases, the speculative visitor to the registrant-s web site will be visiting it in the hope and expectation that the web site is a web site -operated or authorised by, or otherwise connected with the Complainant.- This is what is known as -initial interest confusion- and the overwhelming majority of Experts view it as a possible basis for a finding of Abusive Registration, the vice being that even if it is immediately apparent to the visitor to the web site that the site is not in any way connected with the Complainant, the visitor has been deceived. Having drawn the visitor to the site, the visitor may well be faced with an unauthorised tribute or 28682047 17 criticism site (usually the latter) devoted to the Complainant; or a commercial web site, which may or may not advertise goods or services similar to those produced by the Complainant. Either way, the visitor will have been sucked in/deceived by the domain name. Findings of Abusive Registration in this context are most likely to be made where the domain name in issue is identical to the name or mark of the Complainant and without any adornment (other than the generic domain suffix). -." In the present case, the Domain Name is identical to the name and mark of the Complainant and without any adornment (other than the generic domain suffix). Its use to resolve to the Respondent's website is a classic case of initial interest confusion. Therefore, in summary, the Respondent cannot rely on paragraph 4 a. i. of the DRS as I have found that, on the balance of probabilities, it was aware of the Complainant's cause for complaint when registering and then using the Domain Name. Neither can it rely on paragraph 4 a. ii. of the DRS as, on the evidence before me, I am not satisfied that the Domain Name is generic, and, whilst it may be somewhat descriptive, the use made of it by the Respondent to resolve to its website is not fair use because it is likely to cause initial interest confusion. In the circumstances, the Domain Name, in the hands of the Respondent, is an Abusive Registration as its registration by the Respondent when being aware of the Complainant's cause for complaint took unfair advantage of and was unfairly detrimental to the Complainant's Rights. In addition, the subsequent use of the Domain Name in a manner likely to cause initial interest confusion, also took unfair advantage of and was unfairly detrimental to the Complainant's Rights. 7. Decision For the reasons outlined above I find that the Complainant has proved, on the balance of probabilities, that it has Rights in respect of the name SMS PASSCODE being a name or mark which is identical or similar to the Domain Name, and that the Domain Name, in the hands of the Respondent, is an Abusive Registration. In the circumstances I order that the Domain Name be transferred to the Complainant. Signed Chris Tulley Dated 3 March 2010 28682047 18