Who runs the internet? An ICANN 49 primer
The ICANN 49 public meeting is kicking off here in Singapore right now, and control of the domain name system is going to be the hottest of hot topics for the next four days.
Two Fridays ago the US government announced its plan to remove itself from oversight of key internet functions currently managed by ICANN, causing a firestorm of controversy in the US.
A lot of the media commentary has been poorly informed, politically motivated and misleading.
According to this commentary, the move means that regimes more repressive that the United States government are going to take over the internet, killing off free speech.
Here I present a backgrounder on the issue, a primer for those who may not be familiar with the history and the issues. ICANN addicts may find the latter half of the piece interesting too, but first…
Let’s go back to basics
The issue here is control over the DNS root zone file. Basically, the root zone file is a 454K text file that lists all the top-level domains that are live on the internet today.
Each TLD is listed alongside the DNS name servers that it is delegated to and control it. So .com has some name servers, .uk has some name servers, .info has some name servers, etc.
If an internet user in San Francisco or London or Ulan Bator tries to visit google.com, her ISP finds that web site by asking the .com zone file for its IP address. It finds the location of the .com zone file (managed by Verisign) in turn by asking the root zone file.
The root zone files are served up by 13 logical root zone servers named A through M, managed by 12 different entities. Verisign runs two. ICANN runs one. Most are US-based entities.
Every root server operator agrees that Verisign’s root is authoritative. They all take their copies of the root zone file from this server. This keeps the data clean and consistent around the world.
So Verisign, in terms of actually sitting at a keyboard and physically adding, deleting or amending entries in the root zone file, has all of the power over the internet’s DNS.
Verisign could in theory assign .uk or .xxx or .com to name servers belonging to Canada or the Vatican or McDonalds or me.
But in practice, Verisign only makes changes to the root zone when authorized to do so by the US National Telecommunications and Information Administration, part of the Department of Commerce.
That’s because Verisign’s power to amend the root zone comes from its Cooperative Agreement with NTIA.
Amendment 11 (pdf) of this agreement dates from 1999, a time before Verisign acquired Network Solutions (NSI) and before ICANN had a name and was known as “NewCo”. It states:
NSI agrees to continue to function as the administrator for the primary root server for the root server system and as a root zone administrator until such time as the USG instructs NSI in writing to transfer either or both of these functions to NewCo or a specified alternate entity.
While NSI continues to operate the primary root server, it shall request written direction from an authorized USG official before making or rejecting any modifications, additions or deletions to the root zone file. Such direction will be provided within ten (10) working days and it may instruct NSI to process any such changes directed by NewCo when submitted to NST in conformity with written procedures established by NewCo and recognized by the USG.
So the power to amend the root zone — and therefore decide which TLDs get to exist and who gets to run them — actually lies in NTIA’s hands, the hands of the US government.
NTIA says its role is “largely symbolic” in this regard.
That’s because the power to decide what changes should be made to the root zone has been delegated to ICANN via the “IANA functions” contract.
What you’re looking at here is a diagram, from the latest IANA contract, showing that whatever changes ICANN proposes to make to the root (such as adding a new gTLD) must be authorized by NTIA before somebody at Verisign sits at a keyboard and physically makes the change.
In the diagram, “IANA Functions Operator” is ICANN, “Administrator” is NTIA, and “Root Zone Maintainer” is Verisign.
What NTIA now proposes is to remove itself from this workflow. No longer would ICANN have to seek a US government rubber stamp in order to add a new TLD or change ownership of an existing TLD.
It’s possible that Verisign will also be removed from the diagram. ICANN runs a root server already, which could replace Verisign’s A-root as the authoritative one of the 13.
NTIA says that the Cooperative Agreement and the IANA contract are “inextricably intertwined” and that it will “coordinate a related and parallel transition in these responsibilities.”
If this all sounds dry and technical so far, that’s because it is.
So why is it so important?
An entry in the DNS root zone has economic value. The fact that the record for .com points to Verisign’s name servers and not yours means that Verisign is worth $7 billion and you’re not.
Whoever has power over the root therefore has the ability to dictate terms to the entities that want their TLD listed.
ICANN’s contract with Verisign makes Verisign pay ICANN $0.25 for every .com name sold, for example.
The contract also forces Verisign to only sell its names via registrars that have been accredited by ICANN.
This gives ICANN, by indirect virtue of its control of the root, power over registrars too.
The Registrar Accreditation Agreement contains terms that require registrars to publish, openly, the names and addresses of all of their customers, for example.
Suddenly, control of the root is not only about lines in a database, it’s about consumer privacy too.
The same goes for other important issues, such as free speech.
Should people have the right to say that a company or a politician “sucks”? Most of us would agree that they should.
However, if they want to register a .sucks domain name in future they’re going to have to abide by rules, developed by ICANN and its community, that protect trademark owners from cybersquatting.
Over the course of many years, ICANN has decided that trademark owners should always have the right to preemptively register any domain name that matches their brands. This will apply to .sucks too.
If I, militant vegetarian that I am, wanted to register mcdonalds.sucks after .sucks becomes available, there’s a significant probability that I’m not going to get the opportunity to do so.
Of course, there’s nothing stopping you and I publishing our opinion of a worthless politician or corrupt company in other ways using other domain names, but it remains true that ICANN has essentially prioritized, for very good reasons, the rights of trademark owners over the rights of other internet users.
Theoretically, at some point in the future, ICANN could amend the Registrar Accreditation Agreement to require registrars to, for example, always deactivate a domain name when they receive a cease and desist letter, no matter how unfounded or spurious, from a trademark lawyer.
Suddenly, the web belongs to the IP attorneys, free speech is damaged, and it’s all because ICANN controls the DNS root.
I’m not saying that’s going to happen, I’m just using this as an example of how ruling the root has implications beyond adding records to a database.
What does US oversight have to do with this?
The question is, does the US removing itself from the root zone equation have any impact on what ICANN does in future? Has the US in fact been a good custodian of the root?
Commentators, many of them Republicans apparently seizing on the NTIA’s move as the latest opportunity to bash President Obama’s administration, would have you believe that the answer is yes.
I’m not so sure.
The US in fact has a track record of using its power in ways that would reduce free speech on the internet.
Back in 2005, there was a controversy about ICANN’s decision to add .xxx — a top-level domain for pornography — to the root zone. Whatever you think about porn, this is undeniably a free speech issue.
The US government, under the Bush administration, was initially ambivalent about the issue. Then a bunch of right-wing religious groups started lobbying the NTIA en masse, demanding .xxx be rejected.
The NTIA suddenly switched its position, and actually considered (ab)using its power over the root zone to block .xxx’s approval and therefore appease the Republican base.
This all came out due to .xxx operator ICM Registry’s Freedom of Information Act requests, which were detailed in the the declaration (pdf) of an Independent Review Panel — three neutral, respected judges — that oversaw ICM’s appeal against ICANN:
Copies of messages obtained by ICM under the Freedom of Information Act show that while officials of the Department of Commerce concerned with Internet questions earlier did not oppose and indeed apparently favored ICANN’s approval of the application of ICM, the Department of Commerce was galvanized into opposition by the generated torrent of negative demands, and by representations by leading figures of the so-called “religious right”, such as Jim Dobson, who had influential access to high level officials of the U.S. Administration. There was even indication in the Department of Commerce that, if ICANN were to approve a top level domain for adult material, it would not be entered into the root if the United States Government did not approve
US lobbying via ICANN’s Governmental Advisory Committee and other channels had the effect that ICANN rejected ICM’s .xxx application. It’s only because ICM was prepared to spend years and millions of dollars appealing the decision that .xxx was finally added to the root.
When you read an article claiming that the US government relinquishing its root oversight role will have a negative effect on free speech, ask yourself what the record actually shows.
The .xxx case is the only example I’m aware of the US leveraging or preparing to leverage its oversight role in any way. On free speech, USG is 0 for 1.
The US is also a powerful member of the Governmental Advisory Committee, the collection of dozens of national governments that have a strong voice in ICANN policy-making.
Under the rules of the new gTLD program, the GAC has right to veto any new gTLD — prevent it being added to the DNS root zone — if all the governments on the GAC unanimously agree to the veto.
Currently, there’s a controversy about the proposed gTLD .amazon, which has been applied for by the online retail behemoth Amazon.
Latin American countries that count the Amazonia region and Amazon river as part of their territories don’t want it approved; they believe they have the better rights to the .amazon string.
Despite this outrage, the GAC initially could not find unanimous consensus to veto .amazon. It transpired that the US, no doubt protecting the interests of a massive US-based corporation, was the hold-out.
Last July, NTIA decided to drop its opposition to the veto, leading to a GAC consensus that .amazon should be rejected.
In its position paper (pdf) announcing the .amazon veto block reversal, NTIA said the US “affirms our support for the free flow of information and freedom of expression”.
By its own definitions, the US made a decision that harmed free expression (not to mention Amazon’s business interests). It seems to have done so, again, in the name of political expediency.
I’m not saying that the US decision was right or wrong, merely that the record again shows that it’s not the great protector of free speech that many commentators are making it out to be.
What should replace the US?
The question for the ICANN community this week in Singapore and over the coming months is what, if anything, should replace the US in terms of root zone oversight.
The NTIA has been adamant that a “multi-stakeholder” solution is the way to go and that it “will not accept a proposal that replaces NTIA’s role with a government-led or an inter-governmental solution.”
The weirdness in this statement, and with the whole transition process in general, is ICANN is already a multi-stakeholder system.
In light of the US’ longstanding “hands off” approach (with the aforementioned exception of .xxx), does ICANN even need any additional oversight?
Today, legislative power in ICANN resides with its board of directors. The ICANN staff wield executive control.
In theory and under ICANN’s extensive governance rules, the board is only supposed to approve the consensus decisions of the community and the staff are only supposed to execute the wishes of the board.
In practice, both board and staff are often criticized for stepping beyond these bounds, making decisions that do not appear to have originated in the community policy-making process.
The ruling on vertical integration between registries and registrars, where the community could not even approach consensus, appears to have originated with ICANN’s legal department, for example.
There has also been substantial concern about the extent of the power handed to hand-picked advisory panels created by CEO Fadi Chehade recently.
In that light, perhaps what ICANN needs is not oversight from some third party but rather stronger community accountability mechanisms that prevent capture and abuse.
That’s certainly my view today. But I don’t have any particularly strong feelings on these issues, and I’m open to have my mind changed during this week’s discussions in Singapore.
Lorem ipsum
US Government has shown at numerous times to impose sanctions and take down websites using it’s jurisdictional authority over registries or registrars, like in the rojadirecta.com where it lost in Spanish courts but did it anyway because they could.
The NTIA argument that US never overstepped its powers may hold up regarding root zone, but doesn’t hold up regarding DNS.
IIRC, that was the FBI with a court order against Verisign, rather than the USG as such, but your point is well taken.
Correct. And I don’t believe that just because the NTIA is stepping back from iANA the FBI will suddenly become shy about takedowns.
“FBI.gov is an official site of the U.S. government, U.S. Department of Justice”
The important part of my comment was “court order”, not “FBI”.
Exactly, Kevin. This process is unrelated to NTIA oversight of IANA functions, and will continue (possibly increase) regardless of the governance structure adopted.
Due process is not a strong quality of federal agencies domain seizures, it seems:
http://domainincite.com/10311-congressmen-quiz-ice-over-domain-seizures
Kevin, you write that “Under the rules of the new gTLD program, the GAC has right to veto any new gTLD — prevent it being added to the DNS root zone — if all the governments on the GAC unanimously agree to the veto.”
Unless the new gTLD Applicant Guidebook was changed in these past months (not impossible…) that is simply not true.
The GAC continues to have an advisory role in the new gTLD Programme. A consensus objection by the GAC to a new gTLD application means that there is a strong presumption the Board will not accept that application, but it is fully within the powers of the Boars pursuant to the bylaws to actually accept it.
Since this would mean a disagreement with an advice of the GAC, it would trigger the relevant provisions of the bylaws (explanations by the Board, good-faith negotiations, etc). But again, the Board retains ultimate decision-power capabilities within the ICANN organization itself.
I’m not sure how you can actually qualify this is as a “veto”.
It was an oversimplification. I accept your interpretation of the Guidebook as my own.
I was trying to convey the fact that in practice, it’s essentially a veto.
Until the board rejects GAC consensus advice regarding .Amazon.
This can happen, but I wouldn’t count on it.Even for things that NGPC wants to reject, they go to extreme measures to dress them as acceptance… when it comes to applications, they can’t do that. Although AGB+Bylaws provide for some grey area that allowed lots of GAC Advice into process, AGB was clear that GAC could kill applications, and this already happened with other applications. My guess is they are buying time by getting legal opinions that will be used to fight Amazon Inc. when it sues ICANN.
You may be right Rubens, and I hold your opinion in the highest regard in this space.
They could also be getting legal opinions that would provide rationale to reject GAC advice.
This is a great discussion, thank you, Kevin. I’ve already sent it around to the people who, upon the announcement that NTIA was relinquishing its role, immediately emailed me asking what this means.
Also, +1 to Andrea—GAC may only advise the Board.
Thank you Kevin. This is an extremely comprehensive analysis of a rather complicated issue for most and as @Reg has noted above, great material to forward to make one look knowledgeable on the subject. Your vigilant oversight is not only welcomed, it is comforting to know you are there keeping track of the bigger picture yet holding all the parts in memory and check as well.
That being said and wholeheartedly believed with gratitude, may I suggest that there is even a more “root” issue here that is only prudent for us all to consider or accentuate at this time and I think you have already alluded to it. Although the USA may be guilty as charged in having slightly overstepped it “free speech” bounds over it’s 20 plus years of custodianship, its’ infractions in this area might be considered minuscule compared to the potential abuse that could have transpired and MAY transpire, under different control and influence.
It brings to mind a saying my grandmother use to drill into me as a child. “The devil you know may be better than the devil you don’t know.” It is easy for us all to sit back and complain about the bits of dust that may be falling or have in-fact fallen upon the lens that tend to obstruct the perfect view but how concerned with dust will we be if and when the lens is cracked and not by accident, but by conscious design? It may be too simple and mundane for some, but through personal experience I find it not only valid, but safer and comforting to follow my maternal grandmother’s wise counsel. “Just sayin.” Thanks again Kevin, the service and insight you provide I find invaluable.
So what you’re saying is that ICANN can do anything they want?
Like decide to give TLDs to huge companies willing to pay millions of dollars instead of the pioneers that actually worked with Jon Postel to kick this whole thing off from the start?
Yeah. Nice racket if you can get it.