When you take a photo today, software can attach a label that says who made it and whether anyone changed it. That label can carry your name. But if a company somewhere along the chain decides your photo can’t be trusted, the rules give you no one to complain to. The companies that build the chain get a hearing, and you don’t.
Other systems have made a different choice. In 2025 a water-bottle company won back a website that was impersonating it, from a registrar it had never dealt with, because the domain system decided decades ago that its interest counted. This piece is about how a system decides who is allowed to push back, and who it leaves out.
When I started this piece I tried to describe what a remedy for the photographer would look like, and it was the wrong place to start. A remedy that could exist is a proposal, and proposals are cheap. The better question is what the systems that already federate authority across many organizations actually do when one of their members gets something wrong, because they do something, and some of them have been doing it for decades. Two of those systems are worth looking at closely. One hands out domain names. The other decides which websites your browser trusts. Neither has anything to do with photographs, and both show, more clearly than anything in the provenance world does, where the line runs between the institutions a system holds accountable and the people its decisions land on.
The series hypothesis from Part I still stands untested, that a system which makes decisions people have to live with, and never says how those decisions can be questioned, uses up their willingness to go along with it. Part III does not test it. It looks at how a system decides who is allowed to question anything at all.
How an outsider got in
In February 2025 someone registered the domain onehydrojug.com and put up a website that copied the landing page of Hydrojug, a company that sells water bottles. The copy used Hydrojug’s logo and product photographs and offered Hydrojug-branded goods at a discount. Hydrojug had never dealt with the registrar that sold the domain, a company called PublicDomainRegistry.com, and had no contract with it. It filed a complaint anyway, with the World Intellectual Property Organization, under a process called the Uniform Domain-Name Dispute-Resolution Policy. A single panelist heard the case. The registrant never responded. On May 19, 2025, the panel ordered the domain transferred to Hydrojug. Under the rules the registrar then had ten business days to carry that out unless the registrant went to court.
That process is older than most of the web’s governance. ICANN, the organization that coordinates the domain name system, adopted the UDRP on August 26, 1999. The policy is written into every domain registration agreement, and it says a registrant must submit to a mandatory proceeding if a third party asserts three things. The domain is identical or confusingly similar to a trademark the complainant holds. The registrant has no rights or legitimate interest in it. And it was registered and is being used in bad faith. The complainant has to prove all three. If it does, the remedy is one of two things and nothing else. The domain is cancelled, or it is transferred to the complainant. Either side can still go to court, and a registrar waits ten business days before carrying out a transfer in case the registrant does.
What makes the registrar obey is not the panel. It is the contract the registrar signed to be allowed to sell domains at all. Section 3.8 of ICANN’s Registrar Accreditation Agreement requires every accredited registrar to comply with the UDRP as ICANN publishes it. The panel decides, and the registrar’s own accreditation is what binds it to the decision. The panels themselves are run by approved providers, with WIPO handling the largest share, and a case with no procedural complications usually closes within about two months.
Look at who is in that arrangement. ICANN sits above the registrars. The registrars sit above the registrants. The panels are outside all of them. And Hydrojug, the party that was actually harmed, is none of those things. It is an outsider with a trademark, which is an interest the law recognized long before ICANN existed. ICANN did not create that interest. What it did was decide that this one outside interest counts inside its system, bound the injury to one narrow kind of abuse, limited the remedy to two outcomes, and made every registrar agree to honor the result as a condition of participating. That is what it looks like when a federated system decides, on purpose, who outside its membership is allowed to bring a grievance.
It is worth being exact about the boundary. The UDRP does not let anyone who feels wronged by a domain file a complaint. It lets trademark holders file about a specific kind of harm, and panels say no when the facts do not fit. In another 2025 case, a company whose trademark did not exist when the disputed domain was registered had its complaint denied and was found to have brought it in bad faith. The door is real, and it is narrow, and someone decided exactly how wide to make it.
